3 ms·
Anybody here work for vulog? They are another European white-label car share platform provider. I'm nearing the end of reverse engineering one of their clients
by ficklepickle 6y ago
Anybody here work for vulog? They are another European white-label car share platform provider.
I'm nearing the end of reverse engineering one of their clients android apps.
Lots of weak obfuscation, like calling certain endpoints multiple times (2-5x), which is totally useless against a MITM that can decrypt the traffic. Didn't even slow me down.
Oh, and if you miss a certain header, it will respond with invalid JSON prefixed with "[]".
Now I'm curious if they have immobilizers. The keys are kept in the car, so they must.
Not that I want to do anything shady, I just want to use the service without being spied on. Decompiling the app found a bunch of baidu libs, Facebook and retargeting shite. The state of commercial software, yikes.
- camillomiller 6y agoShare Now (car2go + drive now) cars have an immobilizer regardless of the fact that they're keyless or not. Immobilizers are a trivial tech from the 90s, the fact that these company even struggle to cover this basic safety measure is astounding
- tgsovlerkhgsel 6y ago> respond with invalid JSON prefixed with "[]". This is a common security measure against some ancient trick that could be used to get outdated browsers to divulge the content of the JSON contrary to the same origin policy.