[HN Gopher] Reverse engineering Lyft Bikes for fun (and profit?)
___________________________________________________________________
Reverse engineering Lyft Bikes for fun (and profit?)
Author : ibigio
Score : 42 points
Date : 2026-01-22 16:45 UTC (6 hours ago)
(HTM) web link (ilanbigio.com)
(TXT) w3m dump (ilanbigio.com)
| ibigio wrote:
| Howdy.
|
| Back in 2019 I reverse engineered the lyft bikes api to unlock
| them from my bed. It's one of my favorite stories, and after
| telling it dozens of times I finally decided to write it up in
| its full technical glory.
|
| I used to love learning about security through blog
| posts/writeups, so I tried to include as much detail as possible.
| Let me know if you like this style!
| spydum wrote:
| Believe it or not, straight to jail! Just kidding, great
| writeup. I know it's not groundbreaking, but does surprise me
| how many products don't bother with rate limiting controls.
| ibigio wrote:
| i actually think a quick-fix was setting a rate limit. which
| sadly thwarted my brute-forcing, but did not actually fix the
| race condition itself. though it's a very fair "kid, stop it"
| response until they fixed the race condition.
| sampton wrote:
| You never know with corporations. Consequences range from
| "federal pound-in-the-ass prison" or "here is $500".
| MarleTangible wrote:
| You'd generally expect a company like Lyft to pin its
| certificates, so it's notable that they don't. Any ideas as to
| why?
| ale42 wrote:
| If it's intentional, the only thing I can think of is access
| from corporate networks where SSL-intercepting proxies are
| absolutely common.
| vimda wrote:
| Pinning certs has generally been discouraged for a while afaik.
| It's pretty trivial to bypass, at least on Android where you
| can side load easy, and it's a pain in the ass to manage with a
| huge potential to just take down your app if you mess it up
| fainpul wrote:
| Another "bike hack" if you're into that (from 2004 and in
| German):
|
| https://www.ccc.de/hackabike/
| cptskippy wrote:
| > Geofence bypass: As far as I understand, there's no easy way to
| enforce a geofence server-side other than timing, consistency,
| etc. You sort of just have to trust whatever the phone tells you.
|
| There's no fool proof method but you can make it very hard and
| impractical.
|
| Both Apple and Google offer attestation mechanisms to confirm the
| integrity of the App and Device Environment that it's running on.
| This ensures that the API requests are coming from an attested
| device.
|
| To mitigate the MITM attack you can use TLS Certificate pinning
| on sensitive API requests.
|
| You could have the server side API provide a session specific
| signing token that the App uses to sign payloads attached to API
| calls.
| knowitnone3 wrote:
| you've unlocked hundreds of bikes under your account. That would
| mean you've reserved the bike and therefore have to pay for
| damage/loss of property?
| ibigio wrote:
| if i would have actually unlocked all bikes then yes, they
| would have been under my account and i could have been in deep
| trouble. fortunately, (I made sure) that did not happen :)
| codetheweb wrote:
| this is cool! funnily enough I just did something very similar
| last weekend: https://github.com/codetheweb/bay-wheels-py
___________________________________________________________________
(page generated 2026-01-22 23:00 UTC)