4 ms·
Have you tried extracting, decompiling, and modifying someone else's app? It wasn't hard before LLMs and it's nearly trivial now.
by graceful6800 2mo ago
Have you tried extracting, decompiling, and modifying someone else's app?
It wasn't hard before LLMs and it's nearly trivial now.
- hparadiz 2mo agoThe crypographic flow that allows payments to work is straight up pub/priv key encryption with one time use tokens. It's not something you can hack. As soon you see the token it's already been used and thrown away. So whatever nonsense about decompiling literally doesn't matter.
- skinfaxi 2mo agoYou can patch out the payment checks if you can decompile it
- hparadiz 2mo agoThe payment doesn't happen on the device. It happens at the VISA/Mastercard/AMEX level. So "the app" should be doing the validation upstream on the server side and simply reporting yes/no to the app. If you hack the yes/no okay but most payments are for physical things IRL so the payment gateway that is not on your phone is gonna be like ??? - in other words it's on the app not to trust a raw true/false signal and instead rely on server side checks. This is all irrelevant. I make regular massive purchases on my linux box where I can read the memory. It doesn't change anything.
- skinfaxi 2mo agoAh I see you are focusing on apps that have some web component that would enable ongoing authorization. I was thinking about apps that offer a trial but you can upgrade with an in-app purchase and there is no ongoing service component.
- jfyi 2mo agoSo your professional opinion is that the attack surface of mobile banking apps is limited to tokenized payments? Honestly, I'd be appalled if tokens were routed through my banking app. There is no reason the local client needs that data.
- hparadiz 2mo agoMy professional opinion is that APKs can be de-compiled regardless and that has nothing to do with tokenized payments themselves which are like you said handled through server-server communications at the payment processor level. Your phone simply sends a one time use token to authorize the transaction.
- jfyi 2mo agoYou were the one that brought up payments though. Nobody else specified. They just said it could be hacked, which you seem to agree with.
- hparadiz 2mo agoI don't agree that your example makes sense. Don't feel like writing a wall of text. Zero justification for a locked down system.
- jfyi 2mo agoWhat exactly was my example? You agreed with me already. Kind of odd to flip around now. > which are like you said handled Also, I corrected your misstatement about payments. They have absolutely nothing to do with decomp, and certainly can't be used to dismiss the entire attack surface of a mobile banking app. Your example is complete nonsense. You are really digging a hole here.
- pixard 2mo agoHe said his app is a one time payment. Presumably there isn’t a backend and he relies on App Store purchases. I know, it’s shocking an app could just be an actual application rather than a web view.
- skinfaxi 2mo agoIs that not possible with ios applications?
- Xirdus 2mo agoYou can't sideload iOS applications. Meaning there's no point to doing any of the listed things.
- drdexebtjl 2mo agoOf course you can. How do you think developers test their apps?
- actionfromafar 2mo agoNormal people can't. I'd bet more people run jailbroken than bothering with developer-mode sideload.
- Xirdus 2mo agoNever did iOS development. I always assumed it requires active USB connection with a dev machine or an emulator.
- stevefan1999 2mo agoYou technically can sideload. For 7 days or on TestFlight
- fsflover 2mo agoThis is not a practical way for installing apps though.