[HN Gopher] How to earn money by hacking a "walking for money" app
___________________________________________________________________
How to earn money by hacking a "walking for money" app
Author : deadf00d
Score : 96 points
Date : 2022-02-28 12:56 UTC (10 hours ago)
(HTM) web link (www.deadf00d.com)
(TXT) w3m dump (www.deadf00d.com)
| bitwize wrote:
| AllAdvantage, 2020s edition!
| hombre_fatal wrote:
| "Web surfing for money" was pretty lame. But inspiring people
| to get off their ass and walk around with rewards seems nice
| whether it's financial rewards or to catch pokemon.
|
| A simple UI on my phone that tells me how many steps I have and
| a progress bar was enough to make me religious about getting my
| 10k steps each day, and it's been nothing but a good thing in
| my life. I even got my girlfriend addicted.
|
| We'll take a walk to the grocery store together to buy a
| pineapple, just for the steps.
| Nextgrid wrote:
| "inspiring people to get off their ass and walk around" is
| nice.
|
| Conning them into believing the app is after their well-being
| while stalking them in the background and selling their
| personal data is scummy.
| deadf00d wrote:
| Yeah, these concepts are pretty annoying..
| gigaflop wrote:
| Reading this made me confused. You have a 'hire me' link on a
| page where you talk about exploiting someone's app? If you're not
| writing this up like a white hat, isn't the article
| counterproductive to you?
|
| I can understand why you did all this (and hopefully, you reached
| out to the app provider to let them know about these holes), and
| it seems like you know enough about what you're doing. I'm just
| scratching my head at the end of all of this, and the article
| itself feels like it lacks structure.
| deadf00d wrote:
| The idea is to show my work. I tried to add a touch of humor, I
| think it's funny to try to earn money like this (actually you
| can't because they verify all transaction). If you think I can
| be seen as a black hat, I might modify some of it.
|
| Also, a lot of developer (and some of my colleague too) tends
| to think that "hacking" doesn't exist like in movies or even
| doesn't exist at all (because they use ORM, don't laugh, I
| really got this one). By taking a real world example, I think
| It's a cool way to get people back in reality.
|
| Anyway, people and my customers, hire me for my skills, and for
| what I did. Nobody care that you hacked an office, but if this
| office is the CIA, then it's cool.
|
| For the lack of structure, it probably is, if you can give me
| example that I could fix, It would be very kind of you.
|
| Thanks for your feedback.
| [deleted]
| noasaservice wrote:
| You're going to get a lot of hate here from the tech bros.
|
| This, however, is much more inline with Defcon, CCC, and
| hacking culture. And this sort of writeup about (React, API
| endpoint insecurity, cheating apps) would be a straight-up
| accepted submission to the respective cons.
| deadf00d wrote:
| As usual.
|
| That's cool ! Might try to do a submission.
| sockpuppet69 wrote:
| Yeahhhhhh you're not gonna get hired by any scrupulous
| company.
| gigaflop wrote:
| First off, you've done useful and valid work. Not that you
| should need me to say it, but I'll throw some kudos.
|
| Explaining that it's not possible to actually 'cash out'
| would be great, and that would probably help deter script
| kiddies from trying to defraud the app. There are real people
| on the other side!
|
| Tokens should be marked as redacted imo, and code sections
| could probably do to be snipped.
|
| If you wanted a tl;dr, I guess it would be that it looks like
| ctrl-c and ctrl-v were your primary editing tools. They're
| great, and I use them all the time, but that w(t) thing took
| me 10 seconds of scrolling to get through when skimming,
| which was 10 seconds with none of your own words on screen.
| Less can often be more! Especially if I'm looking at
| disassembled gibberish.
| deadf00d wrote:
| Thanks for your wonderful feedback.
|
| I understood my mistake. I think the article humor has not
| been received as intended, that's why I added a disclaimer
| in the top level of the article to contextualize it a
| little bit more. Hope I've not done any harm to their
| infrastructure.
|
| I'll definitely take care to this in my next articles.
|
| I also trimmed a bit the long code of the w() function,
| making the article easier to read.
| ska wrote:
| For what it's worth, I think that is an idiosyncratic use of
| "earn".
| UncleMeat wrote:
| > I think it's funny to try to earn money like this
|
| A lot of us think it is unethical and would take it as a huge
| red flag.
| deadf00d wrote:
| It's a concept, what I mean is the goal is cool. Feeling
| like in a movie.
| mr-wendel wrote:
| I would like to highlight the parent post's comment about
| attempting to contact the people whose work you are exposing
| vulnerabilities in.
|
| I have to say that if this is "showing your work" then the
| most important thing you've shown is poor judgement in
| publishing their secrets in a submission to a very popular
| website. The fact that they have followed such shockingly bad
| security practices themselves is absolutely no excuse.
|
| The work I wish we saw was the valiant effort you made to
| contact the company and help them see their mistakes. That is
| an area where we can all use more good examples, even if only
| to show how difficult it is to get something so obviously
| problematic taken seriously.
|
| I'm certain you mean no ill will, but the lack of
| consideration here is concerning.
|
| [EDIT] As per the posters comments, the keys included weren't
| the real ones. I still think the point stands: they are
| trivial to obtain when you know they are included in the
| package so their exclusion only means so much.
| noasaservice wrote:
| This is an 0day public disclosure. The company affected
| should THANK this person for not selling the exploit on the
| dark web and making bank.
|
| And this goes back to the whole "responsible vulnerability
| disclosure". The damned white hats want to demonize anybody
| not reaching out to some opaque company and being told it
| might be fixed in 90-360 days.
|
| 0Days are JUST AS responsible as other types of disclosure.
| You owe them nothing, and they owe you nothing. And you're
| publishing info to everyone. Information symmetry.
| [deleted]
| deadf00d wrote:
| Yeah, that's what I think too.
| mr-wendel wrote:
| I can't disagree more. They should thank him if he
| actually reached out to help, even if only to say "look
| how bad this is; you're easy pwnbait, kthxbye". Based on
| this article we don't even know if they are opaque (or
| worse, belligerent).
|
| I've tried to be as careful as possible in my wording to
| avoid demonizing the poster. I still see absolutely
| nothing indicating maliciousness or ill intent and I
| would just as strongly disagree with anyone trying to do
| that. My apologies if I have come across as being hateful
| in any way.
|
| I prefer to champion a web that goes back to a "hacker"
| culture I learned from in my youth that predates Internet
| culture: we believe DO owe each other something,
| somewhere in the positive gradient: basic decency, an
| assumption that we're all worthy of respect (unless
| proven otherwise), and that you never try to "score
| points" at the expense of someone else.
|
| But that is just what I believe and what my preferences
| are. Certainly "do no harm" is the rock bottom line.
| orf wrote:
| You don't owe companies that don't invest in security
| anything. This whole comment smells of upmost naivete.
|
| It's a for-profit company without a bug bounty program,
| in no way whatsoever should they expect someone to work
| for free to fix issues they created.
|
| The keys are public, _they_ made them public. Do you
| expect that there are not automated systems trawling apps
| from the g-play store and doing what he's doing?
| noasaservice wrote:
| I'm sitting there at -3 for what amounts to be an
| "unpopular opinion" (aside: downvotes/silencing/dead'ing
| is common here for unpopular but realistic comments in
| IT, or how dare you offend the techbros, who are
| invariably writing shitty apps with garbage APIs.)
|
| I've made money from selling exploits to companies. Ive
| also been cheated out and had bugs downrated so they
| could pay less. Ive also seen colleagues who reported
| bugs they inadvertently found get hit with a felony
| (found not guilty).
|
| Frankly, this company should thank its lucky stars that
| the disclosure was an 0Day and not "sell this on dark web
| and have it exploited for 3mo from 1500 accounts and
| drain the company's coffers".
|
| This person owes the company *nothing*. They found an
| exploit due to bad API implementation, and wrote about it
| publicly. If they were in the USA, that's completely in
| 1fa territory.
| mr-wendel wrote:
| If this be naivete, then I'll happily wear that label,
| and wear it proudly. I've been around enough to have a
| good sense of the value you create when you make an
| effort to consider other people's interests, and that
| seemed absent in the original post. I disagree that this
| is naive, however. I've worked with far too many talented
| people who think the same way to chalk this thinking up
| to inexperience or simplicity.
|
| That they are a for-profit company is completely
| irrelevant, as is whether or not they have a bug bounty
| program. Legal abstractions aside, it's still just people
| on both sides.
|
| The expectation isn't that the poster work for free. The
| poster could have easily obscured identifying details and
| the content of his article would not be diminished. It is
| my opinion that if he wanted to "show his work", work
| done of his own initiative, then I think it would be more
| interesting and useful to include something about
| attempting to assist in remediation. I think, as
| mentioned by others, it would make a far stronger
| argument to click that "hire me!" button than anything in
| his technical analysis.
|
| Of course automated systems are on the hunt for this
| stuff. Same with public code repositories, Docker images,
| and if you operate a subscription-based service with any
| popularity then your web interfaces for sign-up, login,
| etc will be subject to well-orchestrated brute force
| attacks. That someone did a poor job is all the more
| reason to avoid potentially contributing to their
| exploitation.
|
| A response within the positive spectrum is absolutely
| above and beyond. Of all the feedback this community can
| provide, I think this is the most useful and I'm grateful
| that the poster has been responsive to it.
| gigaflop wrote:
| If I leave my door unlocked by accident, and someone
| leave a note to tell me so, I'm shocked, but happy that I
| can lock my door and fix the problem.
|
| If I accidentally leave my door unlocked, and someone
| comes in and steals my TV, I'd be upset. I made an honest
| mistake, and had to pay for it when I wasn't expecting
| to.
|
| If ..., and someone makes a blog post to tell the world
| that my door is unlocked, my dwelling may be in a
| permanent state of disrepair by the time I notice. I'd be
| incredibly unhappy.
|
| Mischief doesn't need to cause misery.
| deadf00d wrote:
| There is no vulnerability here. Secrets has been
| anonymised, tokens and secrets provided are not the real
| ones. I'll follow your advice and update the article once I
| have an answer from the company.
| dncornholio wrote:
| > Secrets has been anonymised
|
| After or before posting it to the internet?
| deadf00d wrote:
| Before.
|
| I'm not that crazy.
| dncornholio wrote:
| They don't look redacted though, I also don't remember
| reading you redacted them.
| deadf00d wrote:
| I dont say it. If people try, it's gonna lead to nothing.
|
| But it's going to be fixed soon.
| mr-wendel wrote:
| > ... and update the article once I have an answer from
| the company
|
| I look forward to the update and will be very curious to
| see how that goes. Best of luck!
|
| [EDIT] Also I think it worth adding one more thing. I
| think the poster has demonstrated an openness to feedback
| that is wonderful. Coming back to the keyboard to read
| "let me give that a try; I'll update things" is really
| cool.
| jotm wrote:
| Well, you know how some hackers are hired by companies they
| hacked? That kind of idea, I'm guessing.
| nsarafa wrote:
| I would hire this guy. Knows what he's doing and is clearly
| talented
| PaulHoule wrote:
| I can make most pedometers think I am walking by folding my arms
| so they cross my chest and then moving my lower arms in circles
| along the horizontal axis perpendicular to my body. I am not sure
| if getting 10,000 steps this way is easier or harder than walking
| but then again in the summer I like to get up at sunrise and got
| walk six miles, then walk another six miles before sunset.
| Jabbles wrote:
| Are "walking for money" apps just scams?
|
| If not on the user, then on the advertisers who fund it?
| orf wrote:
| Archive link:
| https://web.archive.org/web/20220228134714/https://www.deadf...
| dangerboysteve wrote:
| interesting, all the urls in the source have have been prefixed
| with "https://web.archive.org/web/20220228134715/" by
| arvhive.org
| danpalmer wrote:
| It's a snapshot. If they didn't do that then all URLs would
| be resolved against the original page which could change or
| disappear.
| ale42 wrote:
| But also URLs in the extracted/reverse engineered source
| code are prefixed, doesn't make sense. It's a bug from
| archive.org...
| hombre_fatal wrote:
| They rewrite the hrefs in the document so that you can
| easily click around inside the snapshot. The links just
| aren't necessarily archived as well, but sometimes they
| are.
| deadf00d wrote:
| Back online ! for the last time I hope :') Also strapi take soooo
| much ressources...
| actually_a_dog wrote:
| I've got a better hack:
|
| Step 1. Get a dog.
|
| Step 2. Walk your dog.
|
| That's it.
| vanous wrote:
| I simplified it to just:
|
| - walk
|
| And it has been amazing.
| laurent123456 wrote:
| It feels like the presence of the Google and Slack API keys
| should have been responsibly disclosed to the company before
| writing this article. Now that it hits the front page of HN
| there's a strong change someone's going to exploit that.
| deadf00d wrote:
| Thanks for the feedback ! All keys, secrets, credentials has
| been anonymized.
| laurent123456 wrote:
| Well, yes, but you didn't anonymize the name of the app, so
| it's easy to download it and extract the credentials.
| gunfighthacksaw wrote:
| That's not their fault lol
| mousetree wrote:
| It's still available on the archive.org link
| deadf00d wrote:
| Nop, it was from the first publishing of the article.
| dncornholio wrote:
| You scored some internet points.. But posting this before the
| company could react, smells of bad taste, and won't score you
| much respect.
| gamblor956 wrote:
| It's not just bad taste. Some of the described actions would
| legally be considered fraud (both in the U.S., and in France
| where the author and app are based).
| deadf00d wrote:
| Like what ?
| encryptluks2 wrote:
| I mean in the US, you have the CFAA and in France a quick
| Google search indicates the illegalities of doing something
| like this. I wouldn't be surprised to see the company go
| after you and to be questioned by law enforcement. Don't
| say no one warned you.
| deadf00d wrote:
| "illegalities of doing something like this" -> Like what
| ?
|
| Maybe you can provide sources ?
| deadf00d wrote:
| I don't think so. Take it as it is. A funny pretexte to speak
| about serious stuff.
|
| EDIT: I'm waiting for WeWard answer. And will help them fix
| stuff presented in this article.
| MisterSandman wrote:
| You should honestly take this post down. You've literally
| revealed how to gain access to their API keys, mentioned that
| it can be used to devestate the company and commit fraud,
| then just added a message in parentheses asking the reader
| not to do it.
|
| This is a shitty article that isn't humorous at all. It
| would've been funny if you had reported it, they had fixed
| and you'd posted the article after. This reads like an
| engineer trying to get an ego boost and a pat on the back.
| orf wrote:
| The keys are already public, he's not documenting some
| super secret zero-day way of extracting keys. He...
| downloaded the app and unzipped it, basically.
|
| Be angry at the company who clearly don't have a clue how
| to secure anything.
| laurent123456 wrote:
| All apps have security vulnerabilities though - where do
| we draw the line?
| floodyberry- wrote:
| You're supposed to tell them it's broken before you tell
| everyone else it's broken
| Gepsens wrote:
| Ca fait pitie.
| CraneWorm wrote:
| doesn't load w/o js
| encryptluks2 wrote:
| Another title for this could be, how to get prison time for
| committing fraud.
| deadf00d wrote:
| For which crime ?
| encryptluks2 wrote:
| Hacking and abusing a walking for money app for profit.
| deadf00d wrote:
| "for profit" that's what I say in the article.
|
| But reality is different, I didn't earned money on this.
| rat9988 wrote:
| No, but you enable other people to do it.
| kevinh wrote:
| The company who made the app enabled other people to do
| it.
| y42 wrote:
| Im Germany there is the term "instruction to the offence" -
| that is a crime itself. Just saying...but I'm not a lawyer,
| dunno how that's handled globally.
| asteroidp wrote:
| No one would ever see prison time for some thing like this..
| ever
| gowld wrote:
| Aside from now doing the Google API work client side, how to
| build an app like this, _securely_? If the server does work based
| on client data, I can still do more "normal" work by modifying
| the client.
|
| That is, what is a non-hackable way to measure the physical
| environment of a consumer smartphone?
|
| Can the critical data be stored in a DRM module protected by OEM
| TPM module?
| JeanSebTr wrote:
| A solution would be for the OS developers (Apple/Google) to
| provide a way to retrieve data from the backend. This would not
| fully prevent it to be hacked but would change the difficulty:
|
| - wanna be GPS spoofers would need to emulate the whole
| OS/sensors to send spoofed data to Apple/Google
|
| - the platform/OS developers would have more ressources and
| incentives to detect spoofed data
|
| The cat&mouse game is harder when played against Apple/Google
| than against a single small developer.
| Nextgrid wrote:
| > to measure the physical environment of a consumer smartphone?
|
| At this point you need to be more precise about what you
| exactly intend to measure. Even if you build something
| perfectly unbreakable, nothing prevents an attacker from
| simulating _the environment_ around it, whether movement (by
| building a robot to shake the device), visual (monitor in front
| of camera sensor), radio (GPS constellation simulators, etc).
|
| I've seen physical security companies enforce patrols by having
| their guards tap their phone on a physical device in the
| secured property (which does a challenge-response) to prove
| that they've indeed been there at a given time, but even that
| can be defeated by attaching a device with a microcontroller
| and some out-of-band channel (cellular, etc) to relay the
| signals over the internet and allow them to "check-in" at every
| location without physically being there. The system works
| because in most cases the cost & skill required for such an
| attack isn't worth it (if you have those skills you typically
| already have access to better-paying jobs).
|
| Health tracker apps typically don't have this problem because
| the incentives are aligned - the user has no incentive to lie
| to their health tracking app so no security is needed. It's a
| problem for _this_ particular app because the true purpose of
| the app isn 't to encourage healthy living, it's "growth and
| engagement" where advertisers can pay to get people to go to
| certain places and most likely buy their location data as well
| - in this case the relationship is adversarial and there's no
| bulletproof solution, it will always be a game of cat & mouse.
| The proper solution is to just find a better business model
| where incentives are aligned.
| deadf00d wrote:
| It's exacly my point in the "about phone data" section.
| MaxLeiter wrote:
| Niantic tried to implement anti-cheat measures around Pokemon
| Go. They hashed a lot of data available to the client and the
| phone. With some math/ML it's easy to do outlier detection and
| find the hacked/spoofed clients based on their
| GPS/gyroscope/accelerator/... data. It took ~4 days for the
| community (some bot devs, mostly map / tool developers) to
| figure it out, although the scene has never been the same
| since.
| [deleted]
| anticristi wrote:
| I demonstrated browser automation to the sales/marketing team.
| The world is simply not ready to know.
| aj7 wrote:
| Have you checked what constitutes fraud in France? Just sayin'...
| deadf00d wrote:
| Well, technically there's no intrusion here. And I did not
| tried to cashout my rewards.
| deadf00d wrote:
| But I don't know
| jonasdegendt wrote:
| Hackers News hug of death? :)
| archi42 wrote:
| Seems to be back online. Archive link:
| https://web.archive.org/web/20220228134714/https://www.deadf...
| deadf00d wrote:
| Yeah ! It's back online
| deadf00d wrote:
| Me: publish on HackerNews
|
| Strapi:
|
| - [2022-02-28T14:27:04.385Z] error KnexTimeoutError: Knex:
| Timeout acquiring a connection. The pool is probably full. Are
| you missing a .transacting(trx) call?
|
| - That's the best I can do.
| withinboredom wrote:
| Who the heck puts a slack webhook in a client? That's literally
| begging for disaster.
| deadf00d wrote:
| Yep, that's pretty bad.
___________________________________________________________________
(page generated 2022-02-28 23:01 UTC)