4 ms·
>All extracted information is bundled as a ZIP file, without applying any protection like a password. The ZIP file is then sent via an HTTP POST request to http
by dfcmt 7y ago
>All extracted information is bundled as a ZIP file, without applying any protection like a
password. The ZIP file is then sent via an HTTP POST request to
http://192.168.43.1:8080/ http://192.168.43.1:8080/. This shows that not only no transport security (e.g. https:// https://) is
in place, but also that an internal IP address is used.
Unless they're expecting a MITM from the police network (or wherever they use this app) why is no https a problem?
>BXAQ uses the default icon for Android apps, which means there is no attempt at being
covert or discreet about it.
...or maybe they didn't put an icon because it's optional and unnecessary for what essentially is an internal app.
I mean really they are not trying to be unbiased or anything about the analysis.
- cal5k 7y agoMITM? You don't need to MITM something that isn't even encrypted... anyone with a modicum of technical ability can use WireShark to grab these files if they're transmitted over public Wi-Fi. And probably cellular connections, too.
- sheep-a 7y agoExactly, sit outside the police station/wherever just nearby spin up wireshark in monitor mode and you have a stream of personal info on the owners of those scanned phones
- dfcmt 7y agoBut they aren't transmitted over public wifi. They are transmitted inside of some kind of private network, given that they are transmitted to a server in the 192.168/24 range
- yorwba 7y agoYou can have servers with an IP in that range available on public WiFi, no problem at all. If the network is not public, whoever installs the app still needs to connect to it, so you can intercept any credentials they enter, or even run Wireshark on the device.
- morpheuskafka 7y agoSomeone could theoretically use a modified version of Android to capture the police wifi login even after they forget the network, and then use that to connect and log all captures in the future.