Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Trusting clients is probably a security flaw

liberda.nl

Post reply on HN
Print view View original

41–50 of 150 posts

Re: Trusting clients is probably a security flaw

#41

Post by pedrovhb »

> [the extensive anti-reverse engineering measures are] more annoying than any financial app I've had, and I have 5 of them on my phone

Ah, this reminds me of the Tuya app.

I've done some ssl unpinning and mitm to see requests going in and out of my phone, it's pretty fun and there's often really nice and easy to use restful APIs underneath. Among them I've also done a couple of banking apps and they weren't particularly defensive either. That's great; as a user I'm empowered by it and like TFA says, it's totally fine from a security standpoint if you just don't trust the client to do anything they shouldn't be able to do. It shouldn't be your form validation that stops me from transferring a trillion dollars, and though I haven't tried, I'm sure that's not the case for those apps. All it does is allow me to get my monthly statements with a for loop rather than waiting for a laggy UI and clicking through each month.

Now, Tuya is a Chinese company offering a bunch of cheap IoT devices like smart power switches and IR motion detectors. You can interact with everything through their app. That app for some reason has spent by far the most resources on anti-RE of any apps I've seen. I already bought your hardware, mate. Please let me use it on my local network. My smart home infrared motion sensors were meant to turn lights on when I enter a room. But they don't feel very smart when I'm standing in the dark for 4 seconds while they check with a server in China. I don't even need a clean API; just let me see what you do, and I'll do something similar, no support or documentation necessary. But they go through extensive measures to prevent you from interacting with the hardware you bought and which is sitting in your home.

This was a while ago, but I think for the motion sensing in particular, I managed to just put them in a subnetwork with blocked internet access, and snooped on the network to catch their DHCP requests when they tried to call home. This would happen every once in a while presumably for settings/update checks, but crucially also when there was motion detected, and I didn't mind a few false positives. So in the end they were very quick, locally functioning, privacy-friendly little devices!

Re: Trusting clients is probably a security flaw

#42

Post by planb »

pedrovhb wrote: post #41

> [the extensive anti-reverse engineering measures are] more annoying than any financial app I've had, and I have 5 of them on my phone Ah, this reminds me of the Tuya app. I've done some ssl unpinning and mitm to see requests going in and out of my phone, it's pretty fun and there's often really nice and easy to use restful APIs underneath. Among them I've also done a couple of banking apps and they weren't particul…

The problem with Tuya is that they don't manufacture the devices themselves. Instead, they provide a standardized interface for all those low-cost manufacturers and get paid by them. If it were easy to fake Tuya requests or set up your own account (trust me, I tried this to integrate a Fingerbot into Home Assistant, but you have to jump through countless hoops, and the developer account keeps expiring every few weeks), those manufacturers would simply automate this process through their own apps.

Re: Trusting clients is probably a security flaw

#43

Post by liontwist »

robertlagrant wrote: post #28
graemep wrote: post #6

Earlier quoted context omitted.

This sort of things happens a lot. A few years ago a British bus company put certificates in the app to sign tickets. The HSBC UK app will not run if you have any apps installed from outside play store. I cannot log into the website without the app. Luckily all I have with them is a lightly used credit card with a low limit so I have just stopped using it and rely on paper statement. I find it disturbing that any app…

> I find it disturbing that any app can examine your device in this much detail. When I did a tiny bit of Android development a few years ago, I was astonished how free the app I made was to just examine the file system. I assumed it would be like the web, where each website can have its own little SQLite database and cookie store equivalent, but that's it. I don't know if it's changed, or if it was just because I wa…

That is how it works. Apps on android and iOS can’t access data outside of their contsiner.

Re: Trusting clients is probably a security flaw

#44

Post by dspillett »

robertlagrant wrote: post #28
graemep wrote: post #6

Earlier quoted context omitted.

This sort of things happens a lot. A few years ago a British bus company put certificates in the app to sign tickets. The HSBC UK app will not run if you have any apps installed from outside play store. I cannot log into the website without the app. Luckily all I have with them is a lightly used credit card with a low limit so I have just stopped using it and rely on paper statement. I find it disturbing that any app…

> I find it disturbing that any app can examine your device in this much detail. When I did a tiny bit of Android development a few years ago, I was astonished how free the app I made was to just examine the file system. I assumed it would be like the web, where each website can have its own little SQLite database and cookie store equivalent, but that's it. I don't know if it's changed, or if it was just because I wa…

It has certainly been locked down a bit. This makes easily backing up all your data using some techniques harder/impossible.

I can't include podcasts in the backup I do via rsync via termux anymore, unless I switch to an app that uses a shared storage area instead, as termux can not longer read app directories only its own and shared storage. You have to rely on each app that used app-local storage to have its own backup method. Not that I really care from the podcast PoV, hence I've done nothing about it, but it is a sign of apps being better sandboxed at the filesystem level than they used to be.

Re: Trusting clients is probably a security flaw

#45

Post by liontwist »

nonrandomstring wrote: post #8

Ick. That turned my stomach. Sure it's bad for end users that corporate mobile app development is a swamp. In this case it only affects the vendor who lost out on users and reputation. But cavalier, reckless engineering equally causes harm to the client device or end user - if only in wasted time. Given the audience here, I hope many would agree it's pitiful that developers are wasting their time building this junk.…

I think you should study how well such professional posturing helps groups that have it (civil engineers, lawyers, etc).

In my experience it’s a symbolic political power that management has effective ways of limiting.

Re: Trusting clients is probably a security flaw

#46

Post by izacus »

red_trumpet wrote: post #35
izacus wrote: post #34

Earlier quoted context omitted.

Well, they're also an app that relies (at least on Android) on Google's Play Integrity DRM to "keep it safe" from those pesky root users. And like clockwork, this false sense of security leads developers into stupidly trusting the client.

I don't know much about this. Is this a (possible fundamental) flaw in Google's Play Integrity DRM, or did the developers implement it wrongly?

What's implemented wrongly is the idea that this kind of client side check somehow removes the need for server side verification.

And the idea that this kind of check can't be defeated.

Re: Trusting clients is probably a security flaw

#47

Post by kuschku »

red_trumpet wrote: post #35
izacus wrote: post #34

Earlier quoted context omitted.

Well, they're also an app that relies (at least on Android) on Google's Play Integrity DRM to "keep it safe" from those pesky root users. And like clockwork, this false sense of security leads developers into stupidly trusting the client.

I don't know much about this. Is this a (possible fundamental) flaw in Google's Play Integrity DRM, or did the developers implement it wrongly?

DRM doesn't protect, it only delays.

Never trust the client. Anything the client has access to, whether "protected" by Play Integrity or not, should be considered compromised.

Re: Trusting clients is probably a security flaw

#48

Post by miki123211 »

1317 wrote: post #39
graemep wrote: post #6

Earlier quoted context omitted.

This sort of things happens a lot. A few years ago a British bus company put certificates in the app to sign tickets. The HSBC UK app will not run if you have any apps installed from outside play store. I cannot log into the website without the app. Luckily all I have with them is a lightly used credit card with a low limit so I have just stopped using it and rely on paper statement. I find it disturbing that any app…

It used to let you use it with a full-on rooted phone, it just popped up a message saying 'it's not our problem if you get robbed' i wonder what caused the change as others have said, you can ring them up and get a physical security key, it works for the website

> i wonder what caused the change

In many countries, if the consumer gets defrauded, the bank foots the bill.

I don't think the problem here is consumers getting defrauded by having an insecure rooted device. It's fraudsters using the mobile app APIs for nefarious purposes, and the best way to prevent that is to use SafetyNet and other similar mechanisms.

Re: Trusting clients is probably a security flaw

#49

Post by nslqnd »

pta2002 wrote: post #2

This is like the fifth article I've read about the McDonald's app not having any sort of server-side validation. How do they keep getting this wrong???

As a contractor who works building apps (and their server backends) for big clients: I don’t give a fuck. I just do the minimum so the app works. The worst that can happen is that the client asks me to fix the flaw later on, for which I will bill more hours.

I can 100% guarantee that’s what happened here.

Re: Trusting clients is probably a security flaw

#50

Post by [deleted] »

nslqnd wrote: post #49
pta2002 wrote: post #2

This is like the fifth article I've read about the McDonald's app not having any sort of server-side validation. How do they keep getting this wrong???

As a contractor who works building apps (and their server backends) for big clients: I don’t give a fuck. I just do the minimum so the app works. The worst that can happen is that the client asks me to fix the flaw later on, for which I will bill more hours. I can 100% guarantee that’s what happened here.

[deleted]
Post reply on HN