5 ms·

Wait a minute. 5 lines of code were missing in the app, causing users to be refunded. So does this mean a malicious user could decompile the app, remove this co

by mrb 7y ago

Wait a minute. 5 lines of code were missing in the app, causing users to be refunded. So does this mean a malicious user could decompile the app, remove this code, recompile, and get these auto refunds? This seems a way easier mechanism to get free in-app purchases rather than reverse-engineering the rest of the code.

tomglynch 7y ago
Great potential exploit. From what I have read, decompiling usually doesn't reproduce the app 100% though so it usually won't run. Is this correct?
- mruts 7y ago
  How could this be?
abedja 7y ago
Your recompiled version would not have the proper cryptographic signature as you don't have the keystore used by the dev on your pc
- numerlo 7y ago
  The version without those 5 lines will now be forever out there though. Malicious peers can download the apk and get the premium version for free. This feels like a poorly thought out design on Google's part.
  - kabwj 7y ago
    Obviously if you decompile the application and modify it you can get the premium features for free. What’s your point?
    - beering 7y ago
      numerlo is saying that users don't even need to decompile the app - they can continue sharing the buggy APK with each other to get free stuff.
kevincox 7y ago
You could also just modify the app to skip the "is premium" check to get all the premium features. I would hope that there is something more robust for server-handled purchased though.