- 21 Eki 2015
- 477
- 1
AppSec: How to NOT create a job app
Few days ago, I received this private message on Twitter.
It has been a while since I didnt analysed a mobile app, so I decided to look at this app. For the moment, the issues have not been fixed so I redacted the details.
I) Recon
Before jumping to the code, always use the app as a normal user. In this case, the app asks you to create an account, you can look for someone to hire or propose your services. You can also browse different categories like mechanical, home, etc.
I went to their official website, clicked on the Get it on Google Play badge and downloaded the app on my test phone. Then I extracted the app from my phone to analysed it on my computer.
The next step is to look at the AndroidManifest.xml of the app. Thanks to apktool you can easily extract the resources of the app
Now, we can read the AndroidManifest.xml. The first thing I noticed is the references to React Native.
As suspected, the assets folder contains an index.android.bundle file. So yes, this is a React Native app.
Extract the source code of a React Native app is easy. With the help of jsbeautifier you can get a readable enormous javascript file.
Lets be honest, I dont like React Native apps, in general they are quite boring. So, I decided to look at their API instead.
II) API Analysis
Its time to open Burp Suite and see what the app sends to the outside. In this phase, use all the features of the app, try all the use cases, the edge cases, everything. Then, go back to your Burp Suite and analyse what happened.
According to the network requests made by the app, it uses FireStore to store info about their projects and they use a custom API located at api.target.app to store user info. If they made an error, its probably on their custom API, lets focus on that.
II.1) Expose user l0cation and phone number
In the app, when you select a category, you will have a list of expert. The app is doing the following request
This request returns a JSON object with all the experts private info: name, profession, phone number, l0cation, Obviously, these information are not available in the user interface. The endpoint /prod/user/taskers/<user_id> is also leaking the same private user info
II.2) Expose device token
The same endpoint, /prod/user/get-services/taskers/filter/<category>, leaks the device token of the user.
II.3) Modify idCognito
In order to be incognito, an idCognito with the UUID format is assigned to all the users. Not a bad idea, right?
But next time, dont forget to remove the insert-id endpoint. With this endpoint, anyone can modify the idCognito. You just have to know the userName of the victim which is his name
Once the attacker modified the idCognito of his victim, he can get his info easily by requesting the /prod/user/<idCognito>
II.4) Scrape the entire database
Remember the initial private message I received? This app is potentially used by a lot of und0cumented workers. Is ICE or another US gov entity able to scrape the entire database? YES.
1. First, get all the available services. It will returns all the categories.
2. Parse the previous JSON and for every category request the list of experts.
3. Bingo, you have all the experts with their names, l0cations, phone numbers, etc
III) Conclusion
Before putting your private info on a random app think twice. Is this app really secure? Who made this app? Is it a legitimate company? Evaluate the risks for your situation. What is your threat model?
Take care of yourself.
Few days ago, I received this private message on Twitter.
It has been a while since I didnt analysed a mobile app, so I decided to look at this app. For the moment, the issues have not been fixed so I redacted the details.
I) Recon
Before jumping to the code, always use the app as a normal user. In this case, the app asks you to create an account, you can look for someone to hire or propose your services. You can also browse different categories like mechanical, home, etc.
I went to their official website, clicked on the Get it on Google Play badge and downloaded the app on my test phone. Then I extracted the app from my phone to analysed it on my computer.
The next step is to look at the AndroidManifest.xml of the app. Thanks to apktool you can easily extract the resources of the app
Now, we can read the AndroidManifest.xml. The first thing I noticed is the references to React Native.
As suspected, the assets folder contains an index.android.bundle file. So yes, this is a React Native app.
Extract the source code of a React Native app is easy. With the help of jsbeautifier you can get a readable enormous javascript file.
Lets be honest, I dont like React Native apps, in general they are quite boring. So, I decided to look at their API instead.
II) API Analysis
Its time to open Burp Suite and see what the app sends to the outside. In this phase, use all the features of the app, try all the use cases, the edge cases, everything. Then, go back to your Burp Suite and analyse what happened.
According to the network requests made by the app, it uses FireStore to store info about their projects and they use a custom API located at api.target.app to store user info. If they made an error, its probably on their custom API, lets focus on that.
II.1) Expose user l0cation and phone number
In the app, when you select a category, you will have a list of expert. The app is doing the following request
This request returns a JSON object with all the experts private info: name, profession, phone number, l0cation, Obviously, these information are not available in the user interface. The endpoint /prod/user/taskers/<user_id> is also leaking the same private user info
II.2) Expose device token
The same endpoint, /prod/user/get-services/taskers/filter/<category>, leaks the device token of the user.
II.3) Modify idCognito
In order to be incognito, an idCognito with the UUID format is assigned to all the users. Not a bad idea, right?
But next time, dont forget to remove the insert-id endpoint. With this endpoint, anyone can modify the idCognito. You just have to know the userName of the victim which is his name
Once the attacker modified the idCognito of his victim, he can get his info easily by requesting the /prod/user/<idCognito>
II.4) Scrape the entire database
Remember the initial private message I received? This app is potentially used by a lot of und0cumented workers. Is ICE or another US gov entity able to scrape the entire database? YES.
1. First, get all the available services. It will returns all the categories.
2. Parse the previous JSON and for every category request the list of experts.
3. Bingo, you have all the experts with their names, l0cations, phone numbers, etc
III) Conclusion
Before putting your private info on a random app think twice. Is this app really secure? Who made this app? Is it a legitimate company? Evaluate the risks for your situation. What is your threat model?
Take care of yourself.
Son düzenleme:
