Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reverse-engineering the Starbucks ordering API

blog.tendigi.com

Post reply on HN
Print view View original

21–30 of 157 posts

Re: Reverse-engineering the Starbucks ordering API

#21

Post by dsacco »

Nelgraf wrote: post #20
dsacco wrote: post #10

Solid writeup. From someone who does/did a lot of this professionally: 1. Android typically is easier for this kind of work (you don't even need a rooted/jailbroken device, and it's all Java/smali), 2. That said, instead of installing an entire framework like Xposed that hooks the process to bypass certificate pinning, you can usually just decompile the APK and nop out all the function calls in the smali related to c…

Could you pontificate a bit on four? Because of the identity problem, or is there something about a mobile app that is fundamentally less secure than say, a web browser? I'm genuinely ignorant, seems like it would be good to know.

Sure. The only way to sign requests is through something both parties can verify. The client you're using must have access to the shared secret key used in (e.g.) the HMAC process. While you can obfuscate the secret key to extents that would make a reverse engineer's life miserable (for a case study in that, see the Facebook app), you fundamentally cannot prevent the request signing process from being reversed with enough effort.

It's a very simple principle: the relevant data must necessarily be exposed, even if only in memory, at some point. Like any other DRM, it's imperfect.

Re: Reverse-engineering the Starbucks ordering API

#22

Post by tachang »

dsacco wrote: post #10

Solid writeup. From someone who does/did a lot of this professionally: 1. Android typically is easier for this kind of work (you don't even need a rooted/jailbroken device, and it's all Java/smali), 2. That said, instead of installing an entire framework like Xposed that hooks the process to bypass certificate pinning, you can usually just decompile the APK and nop out all the function calls in the smali related to c…

As to point #4 I think the hardest api I tried to reverse was sim city build it. I couldn't seem to find the right signature generating code.

Re: Reverse-engineering the Starbucks ordering API

#24

Post by dsacco »

flyinfungi wrote: post #18
dsacco wrote: post #10

Solid writeup. From someone who does/did a lot of this professionally: 1. Android typically is easier for this kind of work (you don't even need a rooted/jailbroken device, and it's all Java/smali), 2. That said, instead of installing an entire framework like Xposed that hooks the process to bypass certificate pinning, you can usually just decompile the APK and nop out all the function calls in the smali related to c…

Any chances you would be willing to share some of the online resources you use for this? I have recently been getting into mobile security development professionally.

I don't use online resources. I mostly used a combination of dex2jar and apktool. Some custom coding to automate the process. When I'm doing this on iOS I use Hopper.

Re: Reverse-engineering the Starbucks ordering API

#25

Post by leesalminen »

pat_space wrote: post #13
turdnagel wrote: post #7

Earlier quoted context omitted.

Looks like someone already did: https://www.ryanpickren.com/starbucks-button

Awesome read. Just enough info given to attempt yourself, without giving it away.

Agreed. I just found my new weekend project (though maybe not for a couple weeks because the AWS IoT buttons are sold out).

Re: Reverse-engineering the Starbucks ordering API

#26

Post by leesalminen »

pbhjpbhj wrote: post #23
leesalminen wrote: post #4

If there was a IoT button in my kitchen that could order my usual morning order, well I'm not sure. I may or not shout out in joy.

Couldn't you just hit the button on a home bean to cup machine and save the journey?

I like getting out of the house in the morning. Starbucks is a ~4 minute walk away. I get to chit chat with folks, take the dogs out with me and get a feel for the weather that day. If I made my coffee at home, I would be on my laptop and totally forget about making it.

Re: Reverse-engineering the Starbucks ordering API

#27

Post by userbinator »

Nelgraf wrote: post #20
dsacco wrote: post #10

Solid writeup. From someone who does/did a lot of this professionally: 1. Android typically is easier for this kind of work (you don't even need a rooted/jailbroken device, and it's all Java/smali), 2. That said, instead of installing an entire framework like Xposed that hooks the process to bypass certificate pinning, you can usually just decompile the APK and nop out all the function calls in the smali related to c…

Could you pontificate a bit on four? Because of the identity problem, or is there something about a mobile app that is fundamentally less secure than say, a web browser? I'm genuinely ignorant, seems like it would be good to know.

The "protect" which 4 is referring to is fundamentally like any other DRM: you're trying to give someone access to the content, but also deny it at the same time. In the case of an API, you've given someone an app which knows how to use it, which they can execute on their own computer and control the inputs of, and inspect the output.

If you don't feel like RE'ing the API, you can always just supply the inputs to the app yourself from somewhere else. ("All problems in computer science can be solved by another level of indirection", as the saying goes.)

Re: Reverse-engineering the Starbucks ordering API

#28

Post by sashk »

KekDemaga wrote: post #12
bpicolo wrote: post #6

Opening up an API like this is ripe for abuse, so taking care makes sense. Bad actors translate directly to lost money. A real method of securing APIs would be a godsend, but in current tech it's just not possible. This is the one place where mediocre security-by-obscurity is your only choice =(

"2,147,483,647 large coffees? I'd better get to work." - some poor Starbucks employee

This reminded me about call to Starbucks during the iPhone announcement in 2007 -- https://youtu.be/bd6dQmN-mPw?t=34s

Re: Reverse-engineering the Starbucks ordering API

#29

Post by canistr »

turdnagel wrote: post #5

Is there a good guide out there on reverse engineering mobile apps for iOS & Android?

I liked this guide on reversing Android. https://www.evilsocket.net/2017/04/27/Android-Applications-R...

CharlesProxy is a must-have whether you're a dev or reverse-engineering.

JADX is the best for reversing Android because it produces readable Android code which is fantastic for current Android developers who expect things to be organized like Android Studio.

Post reply on HN