Mobile app developers Tommy Mysk and Talal Haj Bakry just published a blog article entitled “TikTok vulnerability enables hackers to show users fake videos“.

As far as we can see, they’re right.

(We replicated their results with a slightly older Android version of TikTok from a few days ago, 15.5.44; their tests included the very latest builds on Android and iOS, numbered 15.7.4 and 15.5.6 respectively.)

We used a similar approach to Mysk and Haj Bakry to look at the network traffic produced by TikTok – we installed the tPacketCapture app on Android and then ran the TikTok app for a while to flip through a few popular videos.

The tPacketCapture app works rather like tcpdump on Unix/Linux computers, logging your network packets to a file called a .pcap (short for packet capture) that you can analyze later at your leisure.

We imported our .pcap file back into Wireshark on Linux, which automatically “dissects” the captured packets to give you a human-readable interpretation of their contents.

As you’d expect, a lot of TikTok’s network conversation is encrypted using TLS to create HTTPS (secure HTTP) connections, as you can see if we extract a representative subset of TLS setup packets from our capture file:

TLSv1.2 Client Hello TLSv1.2 Server Hello, Certificate TLSv1.2 Certificate Status, Server Key Exchange, Server Hello Done TLSv1.2 Client Key Exchange, Change Cipher Spec, Encrypted Handshake Message TLSv1.2 New Session Ticket, Change Cipher Spec, Encrypted Handshake Message TLSv1.2 Client Hello TLSv1.2 Server Hello, Certificate, Certificate Status, Server Key Exchange, Server Hello Done TLSv1.2 Client Key Exchange, Change Cipher Spec, Encrypted Handshake Message TLSv1.2 New Session Ticket, Change Cipher Spec, Encrypted Handshake Message, Application Data TLSv1.2 Client Hello TLSv1.2 Server Hello TLSv1.2 Certificate, Certificate Status, Server Key Exchange, Server Hello Done TLSv1.2 Client Key Exchange, Change Cipher Spec, Encrypted Handshake Message TLSv1.2 New Session Ticket, Change Cipher Spec, Encrypted Handshake Message, Application Data

So the TikTok programmers certainly seem to know about TLS and why it’s important.

But huge swathes of the content that gets sent back from TikTok’s content delivery network (CDN) isn’t encrypted, as this randomly chosen sample of packets from the capture reveals (we shortened the URLs because some of them were very long):