nullpt.rs

Quite a few ways, whether through device/session fingerprinting [1], in-app browser keystroke tracking [2], frequent third-party post requests [3], individiual app usage patterns [4], geo-tracking [5], dark-patterned user onboarding [6] and continual facial recognition [7].

A canary blog series kicked off by the company itself is worth keeping an eye on to see the 'myths' they want to debunk most scrupously (such as keytracking)[8].

[1]: https://www.nullpt.rs/reverse-engineering-tiktok-vm-1

[2]: https://krausefx.com/blog/announcing-inappbrowsercom-see-what-javascript-commands-get-executed-in-an-in-app-browser

[3]: https://app.urlgeni.us/blog/new-research-across-200-ios-apps-hints-surveillance-marketing-may-still-be-going-strong

[4]: https://www.nytimes.com/2021/12/05/business/media/tiktok-algorithm.html

[5]: https://www.afr.com/technology/tiktok-admits-collecting-location-data-20230309-p5cqo8

[6]: https://au.reset.tech/uploads/resettechaustralia_policymemo_tiktok_final_online.pdf

[7]: https://www.npr.org/2021/02/25/971460327/tiktok-to-pay-92-million-to-settle-class-action-suit-over-theft-of-personal-data

[8]: https://newsroom.tiktok.com/en-us/tiktok-truths-a-new-series-on-our-privacy-and-data-security-practices

I'm sure that happens, but I haven't done any work with gyro data myself. There's similar logic for mouse cursor movements, there are libraries out there that will generate a natural looking curve that moves the cursor from one position to another, with imperfections that emulate human hand movement.

> Why do we even need an actual device? We can emulate if we even need to and set our headers to look like we're coming from a device browser.

This one is much harder, your browser, OS, and hardware leave a uniquely identifiable fingerprint (with Javascript enabled). A website can render some graphical pattern on a <canvas> or audio in an audio context, and the resulting output will have minute differences that originate from your rendering and audio pipelines.

Check out: https://amiunique.org/fingerprint https://browserleaks.com/ https://fingerprint.com/ https://coveryourtracks.eff.org/

You can try to fake these, but it all depends on the sophistication of the target website. You can quickly end up in really deep rabbit holes: https://www.nullpt.rs/devirtualizing-nike-vm-1

No, they absolutely export malware still. All of DJI's apps need to be sideloaded on android because the obfuscated data collection they do is not allowed in Play Store apps[0]. TikTok uses an obfuscated VM to do user tracking[1]. Then there's the malware that the US government has to routinely delete from compromised computers [2][3]

Chinese software deserves the reputation it has.

[0] https://arstechnica.com/information-technology/2020/07/chinese-made-drone-app-in-google-play-spooks-security-researchers/

[1] https://www.nullpt.rs/reverse-engineering-tiktok-vm-1

[2] https://arstechnica.com/tech-policy/2025/01/fbi-forces-chinese-malware-to-delete-itself-from-thousands-of-us-computers

[3] https://arstechnica.com/security/2024/01/chinese-malware-removed-from-soho-routers-after-fbi-issues-covert-commands/

> 2. Despite tiktok having a giant target painted on its back for its perceived connections to the CCP, I haven't really seen any evidence that it does any more tracking/fingerprinting that most other websites (eg. facebook) or security services (eg. cloudflare or recaptcha) already do.

Take a look for request parameters in TikTok vs. Instagram for example.

Every request for TikTok forces you to pass most of the information that browser can collect from the end-user before server responds:

https://www.nullpt.rs/reverse-engineering-tiktok-vm-1

Yes, but automatic obfuscation can be interesting, if not only simple substitution methods presented here.

E.g. something like [1] (Devirtualizing Nike.com's Bot Protection) discussed here [2].
Or something like this [3] (Analysis of Obfuscation Techniques Found in Apple FairPlay)

[1] https://www.nullpt.rs/devirtualizing-nike-vm-1

[2] https://news.ycombinator.com/item?id=34285747

[3] https://news.ycombinator.com/item?id=37307653