26 ms·

Reverse-engineering the Starbucks ordering API

658 points by nickplee 9y ago

zitterbewegung 9y ago
If an open API existed yes there would be more integrations. Of course you would have to hire engineers to perform upkeep. Eventually if the ordering API isn't profitable you get a bunch of sunk costs and have to reassign people. Its not just "make this open" and POOF. Also your access could be revoked by unofficially using the API and or they could just change it at any time.
- StavrosK 9y ago
  It seems to me that you can make an API that is trivially reverse-engineerable and both have your pie and eat it.
  - dave5104 9y ago
    In this case, don't you mean have your frappuccino and drink it?
    - karljtaylor 9y ago
      thanks a latte.
  - tuna-piano 9y ago
    But then your users start using the Starbucks ordering Slack channel, cool! But their credit card is hacked. Or the slack channel breaks. Or a stalking ex-boyfriend intercepts the order and delivers the latte himself. Starbucks would likely be blamed for these problems. Remember the Snapchat leak from a few years ago?[1] I'd bet almost everyone who heard about the leak thought that Snapchat got hacked, and many then thought that their personal photos are not safe on Snapchat. But the reality is different. Users logged into a site called "Snapsave", many probably thinking it was part of Snapchat. It was Snapsave that used the private Snapchat API and got hacked... not Snapchat. [1] http://www.huffingtonpost.com/2014/10/10/snapchat-leak_n_5965590.html http://www.huffingtonpost.com/2014/10/10/snapchat-leak_n_596...
- 1690v 9y ago
  It also expands the total attack surface of a system, which can lead to security problems. If you read some of the public disclosures from various bug bounty programs, neglected APIs have led to some serious vulnerabilities. "Underprotected APIs" is actually number 10 on the OWASP Top 10 for 2017.
  - userbinator 9y ago
    The attack surface is the same whether the API is officially open/documented or not --- if you think that data received through a web API is somehow more trustworthy/less demanding of validation just because you haven't documented it and only release an app which uses it, you are doing it wrong. Conceptually, it's just a listening server on the public Internet, and will be subject to arbitrary data anyone willing to connect to it can send.
    - noway421 9y ago
      Published docs (auto generated or not) increase the risk of discovery. Security through obscurity, yeah, but it reduces chances.
- shortstuffsushi 9y ago
  Why would their API need to be anything more than what they offer to their app? Why not something like "hey, you can use our stuff, but you've only got access to the same set of APIs we use in our app, and we may change it as we please. Oh btw, here are the auto-gen'd docs, hope those are enough" That seems like it'd be both developer friendly and no more maintenance than they're already putting into it. The alternative is basically things like this, where someone figures it out anyway, and we have to wait and see if they play it cool, or take it badly and make the author take it down.
  - BHSPitMonkey 9y ago
    You can't make breaking changes to a public API, for starters. Needing to maintain/version APIs you want to deprecate has a nonzero cost.
    - Spivak 9y ago
      Why not? The real cost would be documenting it, but a lot of devs would be willing to accept essentially being on a mailing list for breaking changes a few weeks in advance. It's not like Starbucks can roll out breaking changes to their own API instantly. It would only really be used by enthusiasts and techies who are used to this sort of thing.
    - TeMPOraL 9y ago
      Of course you can. All you have to do is to say: "this is our internal API, we're releasing endpoint documentation for curious developers, but be warned, that the API may, and will, change without any notice". I.e. when you're releasing something in the open, you don't have to take social responsibilities if you don't want to. It's not a binary choice between "release a fully supported product" and "don't release at all".
      - noway421 9y ago
        That makes me wonder, are the any commercial/consumer products that use that model?
leesalminen 9y ago
If there was a IoT button in my kitchen that could order my usual morning order, well I'm not sure. I may or not shout out in joy.
- turdnagel 9y ago
  Looks like someone already did: https://www.ryanpickren.com/starbucks-button https://www.ryanpickren.com/starbucks-button
  - pat_space 9y ago
    Awesome read. Just enough info given to attempt yourself, without giving it away.
    - leesalminen 9y ago
      Agreed. I just found my new weekend project (though maybe not for a couple weeks because the AWS IoT buttons are sold out).
- pbhjpbhj 9y ago
  Couldn't you just hit the button on a home bean to cup machine and save the journey?
  - leesalminen 9y ago
    I like getting out of the house in the morning. Starbucks is a ~4 minute walk away. I get to chit chat with folks, take the dogs out with me and get a feel for the weather that day. If I made my coffee at home, I would be on my laptop and totally forget about making it.
turdnagel 9y ago
Is there a good guide out there on reverse engineering mobile apps for iOS & Android?
- seanp2k2 9y ago
  Use http://www.telerik.com/fiddler http://www.telerik.com/fiddler or https://www.charlesproxy.com https://www.charlesproxy.com or https://mitmproxy.org https://mitmproxy.org If they pin certs it can be harder but not impossible.
  - _e 9y ago
    Xposed Framework module to disable SSL cert pinning https://github.com/Fuzion24/JustTrustMe https://github.com/Fuzion24/JustTrustMe
- amenghra 9y ago
  https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2015/january/bypassing-openssl-certificate-pinning-in-ios-apps/ https://www.nccgroup.trust/us/about-us/newsroom-and-events/b... is a good start. You can do some fun stuff once you can see/proxy/modify requests. If you want to get started, start by poking at something simple (e.g. your own app). Then google as you run into specific issues.
- canistr 9y ago
  I liked this guide on reversing Android. https://www.evilsocket.net/2017/04/27/Android-Applications-Reversing-101/ https://www.evilsocket.net/2017/04/27/Android-Applications-R... CharlesProxy is a must-have whether you're a dev or reverse-engineering. JADX is the best for reversing Android because it produces readable Android code which is fantastic for current Android developers who expect things to be organized like Android Studio.
- conradev 9y ago
  I gave an intro of sorts here for iOS: https://news.realm.io/news/conrad-kramer-reverse-engineering-ios-apps-lyft/ https://news.realm.io/news/conrad-kramer-reverse-engineering...
bpicolo 9y ago
Opening up an API like this is ripe for abuse, so taking care makes sense. Bad actors translate directly to lost money. A real method of securing APIs would be a godsend, but in current tech it's just not possible. This is the one place where mediocre security-by-obscurity is your only choice =(
- KekDemaga 9y ago
  "2,147,483,647 large coffees? I'd better get to work." - some poor Starbucks employee
  - Jonovono 9y ago
    lol. Reminds me of high school. Constructing a green roof garden. We have the genius (see stupid) idea to go order 20 large waters from McDonalds. They just tell us to drive forward and park. Sure enough, not long later, they bring us 20 large waters!
    - smt88 9y ago
      An interaction that cost McDonald's under $2 and is something you won't forget and will actually tell others about. Sounds like they got their money's worth.
  - sashk 9y ago
    This reminded me about call to Starbucks during the iPhone announcement in 2007 -- https://youtu.be/bd6dQmN-mPw?t=34s https://youtu.be/bd6dQmN-mPw?t=34s
- _pmf_ 9y ago
  > A real method of securing APIs would be a godsend, but in current tech it's just not possible. This is the one place where mediocre security-by-obscurity is your only choice It's magically possible when tying it to a payment processor, though.
- IshKebab 9y ago
  What abuse would it be ripe for exactly? I assume the only thing they were trying to prevent is third party apps.
dsacco 9y ago
Solid writeup. From someone who does/did a lot of this professionally: 1. Android typically is easier for this kind of work (you don't even need a rooted/jailbroken device, and it's all Java/smali), 2. That said, instead of installing an entire framework like Xposed that hooks the process to bypass certificate pinning, you can usually just decompile the APK and nop out all the function calls in the smali related to checking if the certificate is correct, then recompile/resign it for your device (again, easier on Android than iOS), 3. Request signing is increasingly implemented on APIs with any sort of business value, but you can almost always bypass it within an hour by searching through the application for functions related to things like "HMAC", figuring out exactly which request inputs are put into the algorithm in which order, and seeing where/how the secret key is stored (or loaded, as it were), 4. There is no true way to protect an API on a mobile app. You can only make it more or less difficult to secure. The best you can do is a frequently rotated secret key stored in shared libraries with weird parameters attached to the signing algorithm. To make up for this savvy companies typically reduce the cover time required (i.e. change the secret key very frequently by updating the app weekly or biweekly) or by using using a secret key with several parts generated from components in .so files, which are significantly more tedious to reverse.
- patcon 9y ago
  True say, did a similar thing here that might messily fill in some of those blanks on at least one set of tool options: https://gist.github.com/patcon/ee96b9bb0f3141b37146#notes https://gist.github.com/patcon/ee96b9bb0f3141b37146#notes (but it was definitely easier than in the blog post!)
- flyinfungi 9y ago
  Any chances you would be willing to share some of the online resources you use for this? I have recently been getting into mobile security development professionally.
  - dsacco 9y ago
    I don't use online resources. I mostly used a combination of dex2jar and apktool. Some custom coding to automate the process. When I'm doing this on iOS I use Hopper.
chx 9y ago
Xposed is the reason I am never getting anything but an unlockable Android phone.
catshirt 9y ago
eyyyyy tendigi. hi Jeff! looks like you're doing some cool stuff. - your old downstairs guy
- jeffsoto 9y ago
  Yo dude!
deleted 9y ago
[deleted]
rconti 9y ago
Excellent writeup. I have to take issue with the "Starbucks app is great" line, though. I think I've had more problems with it (on iOS) than any other app. It's the only app that (for a period of many months if not a year) was regularly unable to find my location. Even if I opened up Maps or some other location enabled app and found my location before launching Starbucks, it would just bomb out. Overall the app seems to have tons of 'issues'. It's been better the past few months though. And it beats the hell out of standing in a 10 minute line. I honestly wouldn't stop at Starbucks anymore if it wasn't for the app.
- nickplee 9y ago
  Strange. I've never had a problem with it. And yes, it makes the coffee taste better.
- veritas3241 9y ago
  I just wish I could customize the requests on breakfast items. I want no cheese on my sandwich. I can request it in person. Can't on the app.
  - djrogers 9y ago
    Select the sandwich, tap on Sandwich Options, tap the google for No Cheese. You've been able to customize orders for as long as I've been using it to order stuff.
- vinhboy 9y ago
  Agreed. I'd also add that the UI for the app needs work. Ordering coffee for a group of people becomes a huge hassle on my phone because their search is not precise, and customizing drinks is a bit cumbersome. I spent like 20 minutes trying to order 5 drinks the other day. It was also annoying because when I left the app, all my selected items disappeared.
  - CodeWriter23 9y ago
    I'd call that an app fail, taking more time to use the app than writing a list then walking there and back with your complete order.
joombaga 9y ago
I did this with the Papa John's webapp a while back (which was waaaay simpler btw). They limited duplicate toppings to (I think) 3 of the same, but "duplicate_item" was just a numerical property on the (e.g.) "bacon" object. Turns out you could just add multiple "bacon" members to the toppings array to exceed the limit, and they didn't charge for duplicates, so I ordered a pizza with like 50 bacons. It definitely didn't have 50x worth of bacon, but it did have more than 3x, maybe 5x-6x. The receipt was hilariously long though.
- nickplee 9y ago
  You are my spirit animal.
- benmoot 9y ago
  Haha that's awesome.
- 13of40 9y ago
  Whenever you do this sort of thing, you should check whether they do negative number checking on the client side or in the API itself. You might be able to get 1 pizza with bacon and (1) pizza without, all for the price of the bacon.
  - joombaga 9y ago
    Good advice; I'm not sure I tried that. The goal wasn't to steal toppings or get free pizza though; it was an impromptu response to my desire for lots of bacon and encountering the duplicate limit, and then a busy signal on the phone. Once I figured out it didn't charge me for more, I just wanted to see what would happen. I figured they'd think it was a system glitch and call when they received the order.
  - BigJono 9y ago
    I'm struggling to grok exactly how that would work. 1 pizza with bacon, -1 pizza (without bacon?) Then what, hope the employee reads -1 as 1 and doesn't cancel the order and call you to find out what you wanted? I must be missing something...
shortstuffsushi 9y ago
This is super interesting, especially the part about trying to reverse engineer their "security" measure. I did something like this a few months back for Paylocity, a time logging system that has a terrible web interface. After trying to talk with their sales people about them potentially offering an API, I was told "no API, just this mobile app." Turns out the mobile app is just an Ionic app with all of the resources (all, including tests and even test environment logins and stuff) baked in. Super easy to grab their API out of that (literally called /mobileapi/), but then the trouble was figuring out how they generated their security token header, which was also a little dance of timestamps and faked device info. The best part was when I contacted them afterwards and warned them about the extra pieces of info they had baked in, their response was basically "yeah, we're aware that there's more in there than there should be, but it's not a priority." Oh well, they just have all of my personal information.
Lxr 9y ago
What's the motivation for Starbucks to make it this difficult to reverse?
- sigjuice 9y ago
  Limit the potential of fraud and abuse?
  - ryandrake 9y ago
    I'd argue that time spent actually securing it against abuse would yield more actual value than time spent obfuscating, but this is almost a religious argument that has been carrying on since before I was born.
dabockster 9y ago
>issue tracking turned off Well, now how am I supposed to tell him that Tully's is better?
King-Aaron 9y ago
Good article, though one main take-home for me is some killer new Spotify playlists to run at work :D
jorblumesea 9y ago
Interesting, what's with the hardcoded new relic ID? Writeup didn't mention it, I assume that's analytics/monitoring related? Does it need to be set?
coworkerblues 9y ago
I want to write a similar write-up for a company which basically does everything over HTTP with their own half-baked hardcoded AES key in app for sending credit card info. and that their confirmation checkup is stupid (for SMS) and can be bypassed. The problem is that their site TOS forbids reverse engineering, and I am afraid their lawyers will go after me instead of fixing the security issues (even if I just contact them), any tips for me ?
- cwsx 9y ago
  Just formally ask the company, if they don't want you to they will tell you. Could be worth including a pitch of sorts ('Hey, Ive noticed a few problems using your site...') but MAKE SURE you don't incriminate yourself. Do NOT show evidence of you 'reverse engineering' anything. Do not do anything without gaining permission, as there's a very good chance you're going to run into their legal team.
  - coworkerblues 9y ago
    I don't want to contact them in a way that they can trace me, since I'm pretty sure that they will try to covert up / threat me (I would hope that someone there already knows this is an issue....).
    - shinolajla1 9y ago
      Starbucks has a bug bounty program, and they do actually pay out. https://www.starbucks.com/whitehat https://www.starbucks.com/whitehat
      - coworkerblues 9y ago
        Nice (altough the URL does not work) unfortunately in our startup nation there are 0 programs like this :(
- qb45 9y ago
  > HTTP with their own half-baked hardcoded AES key in app for sending credit card info. You mean, no TLS, JavaScript crypto and credit card info? Are there no authorities to report that kind of garbage? No certification they are supposed to pass? I would research that angle first before hacking. It doesn't take any reversing to realize everyone can pwn you on a public WiFi. Otherwise, at the very least use tor...
pilif 9y ago
I wonder why they went such great lengths to prevent unauthorized clients (which also is a thing that’s fundamentally impossible. All you can do is making it harder for attackers). What would be so bad about third party apps ordering coffee? Generally, it’s a good idea to be protective, but between cert pinning and that encrypted device fingerprint and the time based signature, this adds a lot of points of possible failure to an app you want to be as available as possible to as many people as possible. What information this API has access to is so precious to warrant all of this?
- evan_ 9y ago
  I'm thinking they probably don't want unauthorized clients just to lower the support threshold. Some percentage of people will hold them responsible for broken third-party clients.
- mansilladev 9y ago
  "sig" hash's intention is to reduce risk of someone bookmarking and replaying same API call.
spike021 9y ago
Maybe a bit off-topic, but APIs always make me wonder a bit when they can be reverse-engineered or.. for lack of a better word, misused. I know of one website (site A) that sells items for sports and uses an API of a sports website (site B) to provide current statistics and other information. Thing is, that sports website's API is now deprecated for public use, there's no way to request a token, and from what I can tell it's only to be used for commercial purposes/paid for by companies. But, I can easily find the API token being used on site A, dig through the private/deprecated docs for the API of site B, and use any of their endpoints and data for pretty much whatever I want. At least, this was the case roughly 4-6 months ago and I haven't looked into it since; perhaps they've changed it since then. But I wonder how this works. Wouldn't it be a misuse of their API and something they wouldn't want allowed? Usually sports statistics APIs are fairly expensive, and the fact that some random person like me can get access easily for free seems unfair to site B, especially when they don't want normal people using their API anymore.
- semi-extrinsic 9y ago
  I was looking at statistics for prices of sold houses in a European country a few years back, and started digging around in the javascript of a local newspaper that every month listed the local sold properties. Turned out in the API they were using from the central statistics provider, they just had "days=30" and "municipalities=[list]". They weren't even caching it, every user visiting the page was another (identical) request to the API provider. And sure enough, sending a request with "days=3650","municipalities=[{all of them}] gave me 10 years of data with every property sale in the country.
  - zilian 9y ago
    I am really curious which country you're referring to.
    - semi-extrinsic 9y ago
      Norway.
rkunnamp 9y ago
The dominos ordering app in India had a terrible flow a while back. Once the products are added to the cart and proceeded to checkout , the flow was as follows 1. First a payment collection flow is initiated from the browser (asking Credit Card details, pin etc) 2. The payment confirmation comes to the browser 3. The browser then places the order(the pizza information) to another api end point, marking the payment part as 'Paid' The thing is, one could add as many pizzas to the cart in a different tab, while the original tab proceeds to payment. The end result is, you get to pay only for pizzas that were initially in the cart, but could get any number of pizzas. For literally Rs100 one could order thousands of rupees worth pizza. I discovered it accidentally and did report to them. Neither did they acknowledge nor did they send me a free pizza :( They later fixed this, by not allowing to load the cart in a different tab. But there is a high chance that there could be another hack even now. Since I had wowed not to eat junk food anymore, there was not much incentive for me to spend any more time on it.
- CodeWriter23 9y ago
  This is why we never trust input from the client.
- qb45 9y ago
  Surely you can do just point 3 if you know how the API works. Atrocious design. There used to be some "secure pendrive" which worked similar way: an app asks you for password, checks if it matches hash stored on the drive and optionally commands the drive to unlock itself. What could possibly go wrong? ;)
IshKebab 9y ago
Probably would have been easier to decompile the Android app than the iOS one. Even if they use proguard the code is much easier to read.
masthead 9y ago
This was already done before, in 2016 https://www.ryanpickren.com/starbucks-button https://www.ryanpickren.com/starbucks-button
githubcomyottu 9y ago
Starbucks is nice for dessert, I wish they sold decent coffee though.
nailer 9y ago
From: https://github.com/tendigi/starbucks https://github.com/tendigi/starbucks > Once you've obtained your client_id, client_secret I'd like to use this module. Question for author: what's the fastest way to get a CLIENT_ID and CLIENT_SECRET?
- webfreak7 9y ago
  I'm wondering the same thing. Is there any way to do this?
amelius 9y ago
Can somebody explain what the use/fun of this is, if Starbucks can push an update that invalidates the approach anytime they want?
deleted 9y ago
[deleted]
supergeek133 9y ago
The way to solve this is just for companies to give out their API in a public manner. You'll almost never be able to secure it from scrapers. We experienced this at Honeywell, when I first started here we were blocking users that scraped the app instead of giving them public access and teach them how to use it correctly.
heywire 9y ago
I've always wondered the legality of doing things like this. Have there been cases where someone was taken to court (in the US) for reversing an API from a mobile app or website? Assuming no malicious action or intent of course. Could the CFAA be used in this case, even if the intent was just to understand the API for personal use? With so many IoT devices out there relying on 3rd party web services that may or may not be around a year from now, I expect that the right to inspect and understand these APIs will become more and more important. Not to mention wanting the ability to build interactions between devices where the manufacturer may not have interest (IFTTT, etc).
Budweiser 9y ago
I want to write a similar write-up for a company which basically does everything over HTTP with their own half-baked hardcoded AES key in app for sending credit card info. and that their confirmation checkup is stupid (for SMS) and can be bypassed. The problem is that their site TOS forbids reverse engineering, and I am afraid their lawyers will go after me instead of fixing the security issues (even if I just contact them), any tips?
wpovell 9y ago
Is there a good place to learn how to do this sort of reverse engineering?
kyle-rb 9y ago
HTCPCP implementation when?

658 points by nickplee 9y ago

If an open API existed yes there would be more integrations. Of course you would have to hire engineers to perform upkeep. Eventually if the ordering API isn't profitable you get a bunch of sunk costs and have to reassign people. Its not just "make this open" and POOF. Also your access could be revoked by unofficially using the API and or they could just change it at any time.

StavrosK 9y ago
It seems to me that you can make an API that is trivially reverse-engineerable and both have your pie and eat it.
- dave5104 9y ago
  In this case, don't you mean have your frappuccino and drink it?
  - karljtaylor 9y ago
    thanks a latte.
- tuna-piano 9y ago
  But then your users start using the Starbucks ordering Slack channel, cool! But their credit card is hacked. Or the slack channel breaks. Or a stalking ex-boyfriend intercepts the order and delivers the latte himself. Starbucks would likely be blamed for these problems. Remember the Snapchat leak from a few years ago?[1] I'd bet almost everyone who heard about the leak thought that Snapchat got hacked, and many then thought that their personal photos are not safe on Snapchat. But the reality is different. Users logged into a site called "Snapsave", many probably thinking it was part of Snapchat. It was Snapsave that used the private Snapchat API and got hacked... not Snapchat. [1] http://www.huffingtonpost.com/2014/10/10/snapchat-leak_n_5965590.html http://www.huffingtonpost.com/2014/10/10/snapchat-leak_n_596...
1690v 9y ago
It also expands the total attack surface of a system, which can lead to security problems. If you read some of the public disclosures from various bug bounty programs, neglected APIs have led to some serious vulnerabilities. "Underprotected APIs" is actually number 10 on the OWASP Top 10 for 2017.
- userbinator 9y ago
  The attack surface is the same whether the API is officially open/documented or not --- if you think that data received through a web API is somehow more trustworthy/less demanding of validation just because you haven't documented it and only release an app which uses it, you are doing it wrong. Conceptually, it's just a listening server on the public Internet, and will be subject to arbitrary data anyone willing to connect to it can send.
  - noway421 9y ago
    Published docs (auto generated or not) increase the risk of discovery. Security through obscurity, yeah, but it reduces chances.
shortstuffsushi 9y ago
Why would their API need to be anything more than what they offer to their app? Why not something like "hey, you can use our stuff, but you've only got access to the same set of APIs we use in our app, and we may change it as we please. Oh btw, here are the auto-gen'd docs, hope those are enough" That seems like it'd be both developer friendly and no more maintenance than they're already putting into it. The alternative is basically things like this, where someone figures it out anyway, and we have to wait and see if they play it cool, or take it badly and make the author take it down.
- BHSPitMonkey 9y ago
  You can't make breaking changes to a public API, for starters. Needing to maintain/version APIs you want to deprecate has a nonzero cost.
  - Spivak 9y ago
    Why not? The real cost would be documenting it, but a lot of devs would be willing to accept essentially being on a mailing list for breaking changes a few weeks in advance. It's not like Starbucks can roll out breaking changes to their own API instantly. It would only really be used by enthusiasts and techies who are used to this sort of thing.
  - TeMPOraL 9y ago
    Of course you can. All you have to do is to say: "this is our internal API, we're releasing endpoint documentation for curious developers, but be warned, that the API may, and will, change without any notice". I.e. when you're releasing something in the open, you don't have to take social responsibilities if you don't want to. It's not a binary choice between "release a fully supported product" and "don't release at all".
    - noway421 9y ago
      That makes me wonder, are the any commercial/consumer products that use that model?

leesalminen 9y ago

If there was a IoT button in my kitchen that could order my usual morning order, well I'm not sure. I may or not shout out in joy.

turdnagel 9y ago
Looks like someone already did: https://www.ryanpickren.com/starbucks-button https://www.ryanpickren.com/starbucks-button
- pat_space 9y ago
  Awesome read. Just enough info given to attempt yourself, without giving it away.
  - leesalminen 9y ago
    Agreed. I just found my new weekend project (though maybe not for a couple weeks because the AWS IoT buttons are sold out).
pbhjpbhj 9y ago
Couldn't you just hit the button on a home bean to cup machine and save the journey?
- leesalminen 9y ago
  I like getting out of the house in the morning. Starbucks is a ~4 minute walk away. I get to chit chat with folks, take the dogs out with me and get a feel for the weather that day. If I made my coffee at home, I would be on my laptop and totally forget about making it.

turdnagel 9y ago

Is there a good guide out there on reverse engineering mobile apps for iOS & Android?

seanp2k2 9y ago
Use http://www.telerik.com/fiddler http://www.telerik.com/fiddler or https://www.charlesproxy.com https://www.charlesproxy.com or https://mitmproxy.org https://mitmproxy.org If they pin certs it can be harder but not impossible.
- _e 9y ago
  Xposed Framework module to disable SSL cert pinning https://github.com/Fuzion24/JustTrustMe https://github.com/Fuzion24/JustTrustMe
amenghra 9y ago
https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2015/january/bypassing-openssl-certificate-pinning-in-ios-apps/ https://www.nccgroup.trust/us/about-us/newsroom-and-events/b... is a good start. You can do some fun stuff once you can see/proxy/modify requests. If you want to get started, start by poking at something simple (e.g. your own app). Then google as you run into specific issues.
canistr 9y ago
I liked this guide on reversing Android. https://www.evilsocket.net/2017/04/27/Android-Applications-Reversing-101/ https://www.evilsocket.net/2017/04/27/Android-Applications-R... CharlesProxy is a must-have whether you're a dev or reverse-engineering. JADX is the best for reversing Android because it produces readable Android code which is fantastic for current Android developers who expect things to be organized like Android Studio.
conradev 9y ago
I gave an intro of sorts here for iOS: https://news.realm.io/news/conrad-kramer-reverse-engineering-ios-apps-lyft/ https://news.realm.io/news/conrad-kramer-reverse-engineering...

bpicolo 9y ago

Opening up an API like this is ripe for abuse, so taking care makes sense. Bad actors translate directly to lost money. A real method of securing APIs would be a godsend, but in current tech it's just not possible. This is the one place where mediocre security-by-obscurity is your only choice =(

KekDemaga 9y ago
"2,147,483,647 large coffees? I'd better get to work." - some poor Starbucks employee
- Jonovono 9y ago
  lol. Reminds me of high school. Constructing a green roof garden. We have the genius (see stupid) idea to go order 20 large waters from McDonalds. They just tell us to drive forward and park. Sure enough, not long later, they bring us 20 large waters!
  - smt88 9y ago
    An interaction that cost McDonald's under $2 and is something you won't forget and will actually tell others about. Sounds like they got their money's worth.
- sashk 9y ago
  This reminded me about call to Starbucks during the iPhone announcement in 2007 -- https://youtu.be/bd6dQmN-mPw?t=34s https://youtu.be/bd6dQmN-mPw?t=34s
_pmf_ 9y ago
> A real method of securing APIs would be a godsend, but in current tech it's just not possible. This is the one place where mediocre security-by-obscurity is your only choice It's magically possible when tying it to a payment processor, though.
IshKebab 9y ago
What abuse would it be ripe for exactly? I assume the only thing they were trying to prevent is third party apps.

dsacco 9y ago

Solid writeup. From someone who does/did a lot of this professionally: 1. Android typically is easier for this kind of work (you don't even need a rooted/jailbroken device, and it's all Java/smali), 2. That said, instead of installing an entire framework like Xposed that hooks the process to bypass certificate pinning, you can usually just decompile the APK and nop out all the function calls in the smali related to checking if the certificate is correct, then recompile/resign it for your device (again, easier on Android than iOS), 3. Request signing is increasingly implemented on APIs with any sort of business value, but you can almost always bypass it within an hour by searching through the application for functions related to things like "HMAC", figuring out exactly which request inputs are put into the algorithm in which order, and seeing where/how the secret key is stored (or loaded, as it were), 4. There is no true way to protect an API on a mobile app. You can only make it more or less difficult to secure. The best you can do is a frequently rotated secret key stored in shared libraries with weird parameters attached to the signing algorithm. To make up for this savvy companies typically reduce the cover time required (i.e. change the secret key very frequently by updating the app weekly or biweekly) or by using using a secret key with several parts generated from components in .so files, which are significantly more tedious to reverse.

patcon 9y ago
True say, did a similar thing here that might messily fill in some of those blanks on at least one set of tool options: https://gist.github.com/patcon/ee96b9bb0f3141b37146#notes https://gist.github.com/patcon/ee96b9bb0f3141b37146#notes (but it was definitely easier than in the blog post!)
flyinfungi 9y ago
Any chances you would be willing to share some of the online resources you use for this? I have recently been getting into mobile security development professionally.
- dsacco 9y ago
  I don't use online resources. I mostly used a combination of dex2jar and apktool. Some custom coding to automate the process. When I'm doing this on iOS I use Hopper.

chx 9y ago

Xposed is the reason I am never getting anything but an unlockable Android phone.

catshirt 9y ago

eyyyyy tendigi. hi Jeff! looks like you're doing some cool stuff. - your old downstairs guy

jeffsoto 9y ago
Yo dude!

deleted 9y ago

[deleted]

rconti 9y ago

Excellent writeup. I have to take issue with the "Starbucks app is great" line, though. I think I've had more problems with it (on iOS) than any other app. It's the only app that (for a period of many months if not a year) was regularly unable to find my location. Even if I opened up Maps or some other location enabled app and found my location before launching Starbucks, it would just bomb out. Overall the app seems to have tons of 'issues'. It's been better the past few months though. And it beats the hell out of standing in a 10 minute line. I honestly wouldn't stop at Starbucks anymore if it wasn't for the app.

nickplee 9y ago
Strange. I've never had a problem with it. And yes, it makes the coffee taste better.
veritas3241 9y ago
I just wish I could customize the requests on breakfast items. I want no cheese on my sandwich. I can request it in person. Can't on the app.
- djrogers 9y ago
  Select the sandwich, tap on Sandwich Options, tap the google for No Cheese. You've been able to customize orders for as long as I've been using it to order stuff.
vinhboy 9y ago
Agreed. I'd also add that the UI for the app needs work. Ordering coffee for a group of people becomes a huge hassle on my phone because their search is not precise, and customizing drinks is a bit cumbersome. I spent like 20 minutes trying to order 5 drinks the other day. It was also annoying because when I left the app, all my selected items disappeared.
- CodeWriter23 9y ago
  I'd call that an app fail, taking more time to use the app than writing a list then walking there and back with your complete order.

joombaga 9y ago

I did this with the Papa John's webapp a while back (which was waaaay simpler btw). They limited duplicate toppings to (I think) 3 of the same, but "duplicate_item" was just a numerical property on the (e.g.) "bacon" object. Turns out you could just add multiple "bacon" members to the toppings array to exceed the limit, and they didn't charge for duplicates, so I ordered a pizza with like 50 bacons. It definitely didn't have 50x worth of bacon, but it did have more than 3x, maybe 5x-6x. The receipt was hilariously long though.

nickplee 9y ago
You are my spirit animal.
benmoot 9y ago
Haha that's awesome.
13of40 9y ago
Whenever you do this sort of thing, you should check whether they do negative number checking on the client side or in the API itself. You might be able to get 1 pizza with bacon and (1) pizza without, all for the price of the bacon.
- joombaga 9y ago
  Good advice; I'm not sure I tried that. The goal wasn't to steal toppings or get free pizza though; it was an impromptu response to my desire for lots of bacon and encountering the duplicate limit, and then a busy signal on the phone. Once I figured out it didn't charge me for more, I just wanted to see what would happen. I figured they'd think it was a system glitch and call when they received the order.
- BigJono 9y ago
  I'm struggling to grok exactly how that would work. 1 pizza with bacon, -1 pizza (without bacon?) Then what, hope the employee reads -1 as 1 and doesn't cancel the order and call you to find out what you wanted? I must be missing something...

shortstuffsushi 9y ago

This is super interesting, especially the part about trying to reverse engineer their "security" measure. I did something like this a few months back for Paylocity, a time logging system that has a terrible web interface. After trying to talk with their sales people about them potentially offering an API, I was told "no API, just this mobile app." Turns out the mobile app is just an Ionic app with all of the resources (all, including tests and even test environment logins and stuff) baked in. Super easy to grab their API out of that (literally called /mobileapi/), but then the trouble was figuring out how they generated their security token header, which was also a little dance of timestamps and faked device info. The best part was when I contacted them afterwards and warned them about the extra pieces of info they had baked in, their response was basically "yeah, we're aware that there's more in there than there should be, but it's not a priority." Oh well, they just have all of my personal information.

Lxr 9y ago

What's the motivation for Starbucks to make it this difficult to reverse?

sigjuice 9y ago
Limit the potential of fraud and abuse?
- ryandrake 9y ago
  I'd argue that time spent actually securing it against abuse would yield more actual value than time spent obfuscating, but this is almost a religious argument that has been carrying on since before I was born.

dabockster 9y ago

>issue tracking turned off Well, now how am I supposed to tell him that Tully's is better?

King-Aaron 9y ago

Good article, though one main take-home for me is some killer new Spotify playlists to run at work :D

jorblumesea 9y ago

Interesting, what's with the hardcoded new relic ID? Writeup didn't mention it, I assume that's analytics/monitoring related? Does it need to be set?

coworkerblues 9y ago

I want to write a similar write-up for a company which basically does everything over HTTP with their own half-baked hardcoded AES key in app for sending credit card info. and that their confirmation checkup is stupid (for SMS) and can be bypassed. The problem is that their site TOS forbids reverse engineering, and I am afraid their lawyers will go after me instead of fixing the security issues (even if I just contact them), any tips for me ?

cwsx 9y ago
Just formally ask the company, if they don't want you to they will tell you. Could be worth including a pitch of sorts ('Hey, Ive noticed a few problems using your site...') but MAKE SURE you don't incriminate yourself. Do NOT show evidence of you 'reverse engineering' anything. Do not do anything without gaining permission, as there's a very good chance you're going to run into their legal team.
- coworkerblues 9y ago
  I don't want to contact them in a way that they can trace me, since I'm pretty sure that they will try to covert up / threat me (I would hope that someone there already knows this is an issue....).
  - shinolajla1 9y ago
    Starbucks has a bug bounty program, and they do actually pay out. https://www.starbucks.com/whitehat https://www.starbucks.com/whitehat
    - coworkerblues 9y ago
      Nice (altough the URL does not work) unfortunately in our startup nation there are 0 programs like this :(
qb45 9y ago
> HTTP with their own half-baked hardcoded AES key in app for sending credit card info. You mean, no TLS, JavaScript crypto and credit card info? Are there no authorities to report that kind of garbage? No certification they are supposed to pass? I would research that angle first before hacking. It doesn't take any reversing to realize everyone can pwn you on a public WiFi. Otherwise, at the very least use tor...

pilif 9y ago

I wonder why they went such great lengths to prevent unauthorized clients (which also is a thing that’s fundamentally impossible. All you can do is making it harder for attackers). What would be so bad about third party apps ordering coffee? Generally, it’s a good idea to be protective, but between cert pinning and that encrypted device fingerprint and the time based signature, this adds a lot of points of possible failure to an app you want to be as available as possible to as many people as possible. What information this API has access to is so precious to warrant all of this?

evan_ 9y ago
I'm thinking they probably don't want unauthorized clients just to lower the support threshold. Some percentage of people will hold them responsible for broken third-party clients.
mansilladev 9y ago
"sig" hash's intention is to reduce risk of someone bookmarking and replaying same API call.

spike021 9y ago

Maybe a bit off-topic, but APIs always make me wonder a bit when they can be reverse-engineered or.. for lack of a better word, misused. I know of one website (site A) that sells items for sports and uses an API of a sports website (site B) to provide current statistics and other information. Thing is, that sports website's API is now deprecated for public use, there's no way to request a token, and from what I can tell it's only to be used for commercial purposes/paid for by companies. But, I can easily find the API token being used on site A, dig through the private/deprecated docs for the API of site B, and use any of their endpoints and data for pretty much whatever I want. At least, this was the case roughly 4-6 months ago and I haven't looked into it since; perhaps they've changed it since then. But I wonder how this works. Wouldn't it be a misuse of their API and something they wouldn't want allowed? Usually sports statistics APIs are fairly expensive, and the fact that some random person like me can get access easily for free seems unfair to site B, especially when they don't want normal people using their API anymore.

semi-extrinsic 9y ago
I was looking at statistics for prices of sold houses in a European country a few years back, and started digging around in the javascript of a local newspaper that every month listed the local sold properties. Turned out in the API they were using from the central statistics provider, they just had "days=30" and "municipalities=[list]". They weren't even caching it, every user visiting the page was another (identical) request to the API provider. And sure enough, sending a request with "days=3650","municipalities=[{all of them}] gave me 10 years of data with every property sale in the country.
- zilian 9y ago
  I am really curious which country you're referring to.
  - semi-extrinsic 9y ago
    Norway.

rkunnamp 9y ago

The dominos ordering app in India had a terrible flow a while back. Once the products are added to the cart and proceeded to checkout , the flow was as follows 1. First a payment collection flow is initiated from the browser (asking Credit Card details, pin etc) 2. The payment confirmation comes to the browser 3. The browser then places the order(the pizza information) to another api end point, marking the payment part as 'Paid' The thing is, one could add as many pizzas to the cart in a different tab, while the original tab proceeds to payment. The end result is, you get to pay only for pizzas that were initially in the cart, but could get any number of pizzas. For literally Rs100 one could order thousands of rupees worth pizza. I discovered it accidentally and did report to them. Neither did they acknowledge nor did they send me a free pizza :( They later fixed this, by not allowing to load the cart in a different tab. But there is a high chance that there could be another hack even now. Since I had wowed not to eat junk food anymore, there was not much incentive for me to spend any more time on it.

CodeWriter23 9y ago
This is why we never trust input from the client.
qb45 9y ago
Surely you can do just point 3 if you know how the API works. Atrocious design. There used to be some "secure pendrive" which worked similar way: an app asks you for password, checks if it matches hash stored on the drive and optionally commands the drive to unlock itself. What could possibly go wrong? ;)

IshKebab 9y ago

Probably would have been easier to decompile the Android app than the iOS one. Even if they use proguard the code is much easier to read.

masthead 9y ago

This was already done before, in 2016 https://www.ryanpickren.com/starbucks-button https://www.ryanpickren.com/starbucks-button

githubcomyottu 9y ago

Starbucks is nice for dessert, I wish they sold decent coffee though.

nailer 9y ago

From: https://github.com/tendigi/starbucks https://github.com/tendigi/starbucks > Once you've obtained your client_id, client_secret I'd like to use this module. Question for author: what's the fastest way to get a CLIENT_ID and CLIENT_SECRET?

webfreak7 9y ago
I'm wondering the same thing. Is there any way to do this?

amelius 9y ago

Can somebody explain what the use/fun of this is, if Starbucks can push an update that invalidates the approach anytime they want?

deleted 9y ago

[deleted]

supergeek133 9y ago

The way to solve this is just for companies to give out their API in a public manner. You'll almost never be able to secure it from scrapers. We experienced this at Honeywell, when I first started here we were blocking users that scraped the app instead of giving them public access and teach them how to use it correctly.

heywire 9y ago

I've always wondered the legality of doing things like this. Have there been cases where someone was taken to court (in the US) for reversing an API from a mobile app or website? Assuming no malicious action or intent of course. Could the CFAA be used in this case, even if the intent was just to understand the API for personal use? With so many IoT devices out there relying on 3rd party web services that may or may not be around a year from now, I expect that the right to inspect and understand these APIs will become more and more important. Not to mention wanting the ability to build interactions between devices where the manufacturer may not have interest (IFTTT, etc).

Budweiser 9y ago

wpovell 9y ago

Is there a good place to learn how to do this sort of reverse engineering?

kyle-rb 9y ago

HTCPCP implementation when?