DoorDash Android app stores credentials in plain text in the log during auth
1–4 of 4 posts
Re: DoorDash Android app stores credentials in plain text in the log during auth
#2To exploit this and acquire the door dash account credentials: One must first gain access to an individual’s device and the device password to grant adb access on an untrusted machine. Then grep the door dash request from logcat while simultaneously initiating a door dash auth challenge using the very same credentials you are trying to acquire.
I’m not saying plaintext credential logging is at all acceptable, but I’m also not sure this is headline worthy. Unless I’m missing something?
Re: DoorDash Android app stores credentials in plain text in the log during auth
#3To exploit this and acquire the door dash account credentials: One must first gain access to an individual’s device and the device password to grant adb access on an untrusted machine. Then grep the door dash request from logcat while simultaneously initiating a door dash auth challenge using the very same credentials you are trying to acquire. I’m not saying plaintext credential logging is at all acceptable, but I’m…
Any app installed on old versions of Android prior to Jellybean can access Logcat without any permission.
Re: DoorDash Android app stores credentials in plain text in the log during auth
#4To exploit this and acquire the door dash account credentials: One must first gain access to an individual’s device and the device password to grant adb access on an untrusted machine. Then grep the door dash request from logcat while simultaneously initiating a door dash auth challenge using the very same credentials you are trying to acquire. I’m not saying plaintext credential logging is at all acceptable, but I’m…
Any app installed on old versions of Android prior to Jellybean can access Logcat without any permission.
The minimum target API level for the play store has been higher than that for a year now.