Full transcript
0:00TikTok has known about this
0:01vulnerability for over a year, but they
0:03haven't fixed it. And the problem is
0:05that it is actively being used and
0:07abused in a handful of different
0:09phishing email campaigns. This is one
0:11email that we saw with the subject line
0:13incoming voice message transcription
0:15available play now. And it's the usual
0:17like oh listen to a voicemail social
0:20engineering pretense. But it includes an
0:21attachment that is not a sound file or
0:24audio. It's an HTML file called play _
0:27now. And that HTML attachment is just
0:30this. A body tag and a script language
0:33to trigger some JavaScript and
0:35redirecting in their web browser to a
0:36different location. But take a look.
0:39They're going to tiktok.com.
0:42And just to be clear, that is the real
0:44tiktok.com
0:45obviously. The gimmick is that the rest
0:48of this URL contains some extra secret
0:50sauce to redirect the end user to a
0:54different website. Something that the
0:55attacker controls. Let me copy paste
0:57this. Again, going to the real
1:00tiktok.com as the domain, press an
1:03enter, it brings you to a Cloudflare
1:06Turnstile. Actually, you might have saw
1:07it over in the address bar. We're not at
1:10TikTok anymore. We're at
1:11holistic.homes.s3.us-east.amazon.aws
1:14an S3 bucket. Amazon AWS S3 bucket. With
1:18what I would have thought would have
1:19been a click fix lure like oh verify
1:21you're human I'm not a robot and
1:23actually tell you to press the Windows
1:24key and R on your keyboard. Press
1:26control V to paste the payload and run
1:28malware and infect your system with a
1:30virus. But clicking through here, I get
1:32an invalid email format because really
1:34it had a victim email address that I
1:37have redacted. You might have caught
1:38that while I was showing you the
1:40attachment. But the parts and pieces of
1:42this that make for an open redirect
1:45vulnerability, cleaning up what was here
1:48previously, all of these percent 2F
1:50percent 2F they're URL escaped or
1:52encoded representations of just a
1:55forward slash. Since those are
1:56duplicative, we can remove them. The %6B
1:59is just the letter K to fill out the
2:02word link. V2 being that usual address
2:04AID as a variable that's set. That is
2:07important. The language doesn't really
2:09matter, but seen as a variable to bio
2:12URL and a target actually lets an any
2:16end user go to any other website like
2:19facebook.com. Let's get back to take a
2:21look. Let me paste that in and now I'll
2:23head to Facebook. Not TikTok. Obviously,
2:27this is just a little slight of hand an
2:29open redirect vulnerability to look like
2:32oh, some end user might think they're
2:34going to tiktok.com, but you could fill
2:36this out with anything. Pad up and make
2:39a whole lot of noise and nonsense so
2:40they never actually check or see what's
2:42in that URL. Maybe add another variable
2:45at the end and just to add even more
2:46noise. You can fill that up with more
2:48random data to look like some sort of
2:50key or token or whatever. But this on
2:52its own lets an adversary steer a victim
2:56anywhere they want. In this specific
2:57case for this fishing email, if this
3:00were to actually have an email address
3:02included as an argument, that would
3:04redirect you. We could click through our
3:06fake Cloudflare Turnstile and things
3:07just some fake GIF animation brings you
3:10to another page where it looks like you
3:12see an Outlook Entra ID animation to oh,
3:15access your email. But at the moment at
3:17the time recording, I think the hacker's
3:19infrastructure is broke cuz we're
3:20getting an error API expired. I'll show
3:22you a screenshot though. This is what it
3:24did look like of the hey, listen to your
3:26voicemails and sign in with the usual
3:29AITM adversary in the middle maybe
3:32reverse proxy
3:34to be able to collect your credentials
3:35as you think you're signing into your
3:37online account filling out multi-factor
3:39authentication. The hacker is listening
3:41and collecting all that data to receive
3:42it at the other end. I don't want to
3:44fall down the rabbit hole too much on
3:45the code here, but if I hit F12 on my
3:47keyboard and actually try to track a lot
3:49of the network requests to see the
3:51redirect and to see what happens
3:53following this, we actually kind of hit
3:55something interesting when the next page
3:57loads. It gets paused in the debugger.
4:00And there's some more JavaScript that we
4:01could see in a little cool fishing kit
4:04syntax. Let me pull this into Sublime
4:06Text so we have a little bit better
4:07syntax highlighting and color coding.
4:09And you could see through some of the
4:10stuff here. Oh, they're tracking the
4:12browser navigator and they can
4:14determine, oh, is the webdriver actually
4:16something that includes Phantom, like
4:18Phantom JS? They're looking for others
4:20here. Does the user agent match
4:21something indicating Burp Suite, like a
4:23debugger? If that's the case, they
4:24actually redirect you, bring your
4:26location to about:blank. They're trying
4:28to bail out because it's likely that
4:30individual accessing this page is an
4:32analyst or a security researcher trying
4:34to understand this. The key codes here
4:36that they're checking and tracking are
4:38actually maybe you pressing
4:39control-shift-L or control-U to view the
4:42source or F12 to open up the browser
4:44tools like we just did. That's all to
4:46prevent you and not allow you to press
4:48those keys. And they don't even let you
4:50right-click, so you won't be able to
4:51open, oh, view source from a context
4:54menu. So you can see a lot of these
4:55tricks with random variable names, with
4:57sort of this obfuscation, and even
4:59anti-debugger checks where they actually
5:01intentionally trigger the debugger, just
5:03like we saw, and then determine is there
5:06a time difference or a little bit of a
5:08delta as to when you resumed? Because if
5:11it did actually pause, they know they're
5:13being analyzed, they're under the
5:15microscope, and then they take you to
5:16Google or some other safe, innocent, and
5:19not malicious site. All to trick or to
5:21fool the security researcher or analyst.
5:24The rest of the gunk here is all the
5:26actual payload doing some funny, silly
5:28XOR capability to then get more, another
5:31stage or payload of JavaScript. That's
5:33the real malicious piece of this fishing
5:35kit. But by the way, a lot of the
5:36breadcrumbs and kind of puzzle pieces
5:38we're seeing here map really well to a
5:40cool webinar that I just did last week
5:42with Sublime Security looking at the
5:44trends to watch out for in 2026. A lot
5:46of fishing email shenanigans, myself and
5:48Brian Baskin, and we covered exactly
5:50this. Uh that happened last week, but if
5:52you're curious, you can grab the
5:53recording, tune in, and see what we were
5:55up to. Literally some of those exact
5:56fishing kit telltale signs and syntax
5:59that we just saw in the JavaScript code.
6:00Funny thing, now that we got a chance to
6:02look through the JavaScript, we know,
6:03okay, we hit the debugger, the time is
6:05going to pass, and it's going to
6:07redirect me to Google, and there it is.
6:09They don't want me to see the shady
6:11shenanigans of the real fishing email.
6:13Anyway, that specific email isn't really
6:15what I wanted to scream and shout about
6:16in this video. I think the real takeaway
6:18here is that, hey, this TikTok open
6:21redirect has been around for a while,
6:23and it's actively being used and abused.
6:26This blog post write-up article from
6:28Cofense and a couple others that have
6:29seen it are from 2024. This is September
6:32of 2024, and they see the exact same
6:34indicator of compromise with a
6:36different, you know, infrastructure
6:37here. But it's that TikTok link V2 AID
6:401988, when a scene is a bio URL, and
6:43then the target can be anything. Others
6:46in the industry, Hawks Hunt, are also
6:48tracking this just as well, and they see
6:50the same thing. It's a TikTok fishing
6:52link kill chain. And maybe someway,
6:54somehow, the lure of, "Oh, check out
6:56this video that I shared with you," and
6:58they include, oh, bad actor provides a
7:01genuine tiktok.com real legitimate
7:03domain URL, it doesn't know, the end
7:06user isn't aware, that's going to drive
7:08them wherever because of the open
7:10redirect vulnerability. But why haven't
7:13they fixed this? Is this intended
7:15behavior? Is this a feature or not a
7:17bug? Is this just part of a TikTok
7:19profile someway, somehow, to include a
7:21bio URL, and then it just goes anywhere?
7:24But I feel like there could be some
7:26better checks in place. I don't know if
7:28there are, maybe if it does some domain
7:29reputation, but we were getting shot
7:31straight to the adversary infrastructure
7:34for them to collect your credentials and
7:35multi-factor authentication. Or because
7:37it hits an Amazon S3 bucket and then
7:39redirects you through even more hoops
7:41and hurdles.
7:43It's bad news bears, right? TikTok open
7:45redirect vulnerability, that's the
7:47video.