Why is TikTok (and other apps) constantly snooping on your clipboard?

on

This year’s WWDC saw Apple lean heavily on privacy. It touted all new features and initiatives that would protect and give a better idea on how companies are using your data. But a new privacy feature might have inadvertently exposed that Apple’s privacy messaging might just be smoke and mirrors.

iOS 14 will now alert you when an application accesses your clipboard – basically, the place where you store anything you want to cut/copy and paste somewhere else. And there are legitimate reasons why you want to access the clipboard: for example, copying a password from your password manager to an app.

However, instead of being helpful, the new alert has revealed that a lot of third-party developers are suddenly accessing your clipboard for no reason, and without you interacting with a text input field. For example, a video from Ryan Jones shows after copying a photo from iMessage, applications like AccuWeather, Fox News, Vice News, the New York Times and even Google Chrome suddenly “pasted” the image with no interaction from the user.

An even scarier video comes from Jeremy Burge from Emojipedia. He found that TikTok was “pasting” content whilst he was typing. It is unclear if the content is reading his clipboard, or is logging his keystrokes. That being said, TechGeek has been able to independently verify and reproduce this via a third party who is running iOS 14.

We have contacted TikTok about the tweet, and asked them several questions including why does the app need access to a person’s clipboard and if the data is being used for any purpose (for example: analytics, advertising, and diagnostic/debugging support). We did not receive a comment in time of publication.

It was brought up in March – but now we know it’s even worse

This issue was brought to everyone’s attention back in March by Talal Haj Bakry and Tommy Mysk, who observed that a lot of popular apps “frequently access the [clipboard] and read its content without user consent” but also noted, in an interview with iMore, that it seemed that some of the apps they tested were only interested in listening for text.

“The exploit works with all data types such as text, photos, or PDF documents. Surprisingly, the apps we tested only chose to read text, but ignore other data types such as photos or PDF documents. In other words, all the apps we listed in our blog are only interested in reading text from the clipboard,” they said.

Apps named in Bakry and Mysk’s report included TikTok, The Wall Street Journal, the New York Times, Fox News, Fruit Ninja, Plants vs Zombies Heroes, Viber, Truecaller, and DAZN.

They also reported this to Apple back in January and even wrote a proof of concept to show how unrestricted the access is to someone’s clipboard (widgets can even read the clipboard’s content too). Apple told the developers they did not see this as a security vulnerability, despite evidence on the contrary.

It might not be for evil intent, but we don’t know

Just because you see the notification does not necessarily mean the application is secretly sending back your data for advertising or tracking. For example, any iOS application built on the Flutter framework will also receive this notification because of a recent addition where it would check the clipboard contents to determine if it needed to display the paste button. An issue has been raised and people are working to resolve this issue.

Apple even has a new API that will let you determine (without reading the actual contents of the clipboard) if it has something to paste or not. Unfortunately, it only exists for iOS 14 and above.

In addition, some applications have been built to read the clipboard and enact some sort of action to make it more convenient for people. For example, the Deliveries app reads the clipboard to see if it is a valid package tracking number or URL and prompt you if you want to include it in your tracking list. Apollo, the Reddit client, will automatically go to that post if you have a Reddit URL in your clipboard.

But, unless the application source code is publicly available, we just do not know. There are many illegitimate and malicious reasons why someone would want to read your clipboard as there are legitimate ones. What’s even worse is that this is being done in the shadows right now – until iOS 14 comes out later this year (most likely October).

And even then, whilst being notified about it is a start, it’s not enough. Your clipboard can contain a lot of sensitive information – if you’re using a password manager, it could contain your password. Users should be able to control who has access to the clipboard, and be advised why the app needs access to the clipboard outside of a text field.

I guess the only good thing that this has finally come out of the shadows and app developers are shamed into doing something.

The post Why is TikTok (and other apps) constantly snooping on your clipboard? appeared first on TechGeek.



from TechGeek https://ift.tt/3exgCu0

Comments

Post a Comment