Urgent alert issued to millions of Android users – act now or it could cost you

ANDROID phone owners using TikTok are being warned of a cybersecurity gap that means their accounts could have been hacked into.

TikTok admitted that the vulnerability meant that hackers could bypass its Two-Step Verification process using brute force.

The flaw, which also affected web users, allowed hackers to skip authentication without any special tools or tricks.

Fraudsters could instead use brute force, repeatedly logging in over and over again until the Two-Factor Authentication page is skipped and TikTok lets them into the account.

“A vulnerability was found where a random timeout issue on a Two-Step Verification endpoint could have resulted in a potential bypass of authentication if multiple incorrect attempts were entered in quick succession,” TikTok said.

“It was found that this vulnerability required access to the user’s email/password or phone number/code associated with the account and multiple bruteforcing attempts to bypass would be needed.”

The issue was uncovered by cybersecurity researchers at HackerOne.

The team reportedly first flagged the flaw to TikTok in October last year, before it was patched up in mid-December 2022.

The flaw is no longer active.

But researchers have advised TikTok users to update their passwords in case a hacker was able to access their details while the gap was open.

TikTok, owned by one of the biggest tech companies in China, known as ByteDance, has quickly become one of the most popular social media apps in the world.

The app exploded in usership during the Covid-19 pandemic and after the death of the beloved short video sharing app Vine - becoming the most downloaded app on 2021, technology research company Apptopia found.

Nearly 14.5million Android users are on the app everyday, according to the latest figures from analytics organisation Statista in 2021.

While TikTok has 30.8million daily active users who use the app through their Apple iPhone’s iOS system.

We pay for your stories! Do you have a story for The Sun Online Tech & Science team? Email us at tech@the-sun.co.uk