4 ms·

I’m confused, did they somehow just include the source code in the app bundle? As a resource perhaps? Or can source code leak into the app through some other ve

by xevb3k 8y ago

I’m confused, did they somehow just include the source code in the app bundle? As a resource perhaps? Or can source code leak into the app through some other vector?

akerro 8y ago
Once I was hacking an android app to get free coupons. After some investigation I found out they decided to generate the same coupon for n-customers, the coupons were changed every day, the coupon was based on MD5 or SHA1 of generated deterministic value (based on customer ID and date). There were 32k possible coupons per day. App was checking if the account and coupon is valid on their server, but it was always valid as they used the same algorithms in the app and on server... The core of the application was written in C#, launched by Mono on Android. Java was compiled correctly with ProGuard (code obfuscator), but C# code was compiled in debug mode. C# in debug mode keeps variable/class/method names as they are in source code, leaves comments in the binary, binary file is bigger and slower. You can decompile it to compilable source code, literally. I managed to get incorrectly protected secret key (they used GPG to encrypt JWT to server lol), later I managed RE of their API, make my own app with identical UI and working coupons. This allowed me to get free coupons every day for next almost 2 years. There were several updates in Google Play since then, but they haven't changed the logic or anything, the app is still in debug mode and anyone can use it. What is interesting, they have also app for iOS which is not in debug mode. Consistency is the key. After I stopped using their services, I checked their ToS that you have to accept before registering and they prohibit app decompilation, but I never registered and never before read ToS, so it's OK for me ;) I wanted to report the problem but they have literally no contact information, I spent a few hours trying to find their contact details, Twitter is dead since 2014, no contact@ email, no contact form on website... nothing. Lesson for you: check if your apps are correctly compiled and secrets protected, there are tools for it. In my previous company we had a Jenkins job to test it before release.
- SmellyGeekBoy 8y ago
  This sounds like fraud, is it wise to be admitting to this publicly?
  - akerro 8y ago
    No, but it's great story on how not to make apps with coupons. I've learnt a lot from it and you can too. Just look at the bigger picture of it how many antipatterns they implemented and how many things they did wrong.
- dspillett 8y ago
  > Lesson for you: check if your apps are correctly compiled and secrets protected And remember: no matter how well you think you have protected the secret, if it is in the client-side application then someone will be able to find it if they want to enough. It must be unpackable by your local code so it must be unpackable by someone who can unpack and understand that code.
- shittyadmin 8y ago
  Even if they used proguard or similar stuff, if they're putting the full code for that check client side they're dead in the water. People have been cracking obfuscated stuff forever and there's plenty of tooling to make it easier. Honestly, it seems so stupid that their best defense is probably that no cracker even thought to check.
- iforgotpassword 8y ago
  Wait so they shipped the mono runtime with the app? Is this some kind of bloat contest?
- sosense 8y ago
  > no contact@ email Every Play Store app has a contact email in the listing.

by xevb3k 8y ago

I’m confused, did they somehow just include the source code in the app bundle? As a resource perhaps? Or can source code leak into the app through some other vector?

akerro 8y ago

Once I was hacking an android app to get free coupons. After some investigation I found out they decided to generate the same coupon for n-customers, the coupons were changed every day, the coupon was based on MD5 or SHA1 of generated deterministic value (based on customer ID and date). There were 32k possible coupons per day. App was checking if the account and coupon is valid on their server, but it was always valid as they used the same algorithms in the app and on server... The core of the application was written in C#, launched by Mono on Android. Java was compiled correctly with ProGuard (code obfuscator), but C# code was compiled in debug mode. C# in debug mode keeps variable/class/method names as they are in source code, leaves comments in the binary, binary file is bigger and slower. You can decompile it to compilable source code, literally. I managed to get incorrectly protected secret key (they used GPG to encrypt JWT to server lol), later I managed RE of their API, make my own app with identical UI and working coupons. This allowed me to get free coupons every day for next almost 2 years. There were several updates in Google Play since then, but they haven't changed the logic or anything, the app is still in debug mode and anyone can use it. What is interesting, they have also app for iOS which is not in debug mode. Consistency is the key. After I stopped using their services, I checked their ToS that you have to accept before registering and they prohibit app decompilation, but I never registered and never before read ToS, so it's OK for me ;) I wanted to report the problem but they have literally no contact information, I spent a few hours trying to find their contact details, Twitter is dead since 2014, no contact@ email, no contact form on website... nothing. Lesson for you: check if your apps are correctly compiled and secrets protected, there are tools for it. In my previous company we had a Jenkins job to test it before release.

SmellyGeekBoy 8y ago
This sounds like fraud, is it wise to be admitting to this publicly?
- akerro 8y ago
  No, but it's great story on how not to make apps with coupons. I've learnt a lot from it and you can too. Just look at the bigger picture of it how many antipatterns they implemented and how many things they did wrong.
dspillett 8y ago
> Lesson for you: check if your apps are correctly compiled and secrets protected And remember: no matter how well you think you have protected the secret, if it is in the client-side application then someone will be able to find it if they want to enough. It must be unpackable by your local code so it must be unpackable by someone who can unpack and understand that code.
shittyadmin 8y ago
Even if they used proguard or similar stuff, if they're putting the full code for that check client side they're dead in the water. People have been cracking obfuscated stuff forever and there's plenty of tooling to make it easier. Honestly, it seems so stupid that their best defense is probably that no cracker even thought to check.
iforgotpassword 8y ago
Wait so they shipped the mono runtime with the app? Is this some kind of bloat contest?
sosense 8y ago
> no contact@ email Every Play Store app has a contact email in the listing.