Reverse engineering Lyft Bikes for fun (and profit?)
ilanbigio.com
Reverse engineering Lyft Bikes for fun (and profit?)
1–10 of 30 posts
Re: Reverse engineering Lyft Bikes for fun (and profit?)
#2Howdy.
Back in 2019 I reverse engineered the lyft bikes api to unlock them from my bed. It's one of my favorite stories, and after telling it dozens of times I finally decided to write it up in its full technical glory.
I used to love learning about security through blog posts/writeups, so I tried to include as much detail as possible. Let me know if you like this style!
Re: Reverse engineering Lyft Bikes for fun (and profit?)
#3Howdy. Back in 2019 I reverse engineered the lyft bikes api to unlock them from my bed. It's one of my favorite stories, and after telling it dozens of times I finally decided to write it up in its full technical glory. I used to love learning about security through blog posts/writeups, so I tried to include as much detail as possible. Let me know if you like this style!
Believe it or not, straight to jail! Just kidding, great writeup. I know it's not groundbreaking, but does surprise me how many products don't bother with rate limiting controls.
Re: Reverse engineering Lyft Bikes for fun (and profit?)
#4You never know with corporations. Consequences range from "federal pound-in-the-ass prison" or "here is $500".
Re: Reverse engineering Lyft Bikes for fun (and profit?)
#5You'd generally expect a company like Lyft to pin its certificates, so it's notable that they don't. Any ideas as to why?
Re: Reverse engineering Lyft Bikes for fun (and profit?)
#6You'd generally expect a company like Lyft to pin its certificates, so it's notable that they don't. Any ideas as to why?
If it's intentional, the only thing I can think of is access from corporate networks where SSL-intercepting proxies are absolutely common.
Re: Reverse engineering Lyft Bikes for fun (and profit?)
#7Howdy. Back in 2019 I reverse engineered the lyft bikes api to unlock them from my bed. It's one of my favorite stories, and after telling it dozens of times I finally decided to write it up in its full technical glory. I used to love learning about security through blog posts/writeups, so I tried to include as much detail as possible. Let me know if you like this style!
[deleted]
Re: Reverse engineering Lyft Bikes for fun (and profit?)
#8Another "bike hack" if you're into that (from 2004 and in German):
Re: Reverse engineering Lyft Bikes for fun (and profit?)
#9> Geofence bypass: As far as I understand, there's no easy way to enforce a geofence server-side other than timing, consistency, etc. You sort of just have to trust whatever the phone tells you.
There's no fool proof method but you can make it very hard and impractical.
Both Apple and Google offer attestation mechanisms to confirm the integrity of the App and Device Environment that it's running on. This ensures that the API requests are coming from an attested device.
To mitigate the MITM attack you can use TLS Certificate pinning on sensitive API requests.
You could have the server side API provide a session specific signing token that the App uses to sign payloads attached to API calls.
Re: Reverse engineering Lyft Bikes for fun (and profit?)
#10You'd generally expect a company like Lyft to pin its certificates, so it's notable that they don't. Any ideas as to why?
Pinning certs has generally been discouraged for a while afaik. It's pretty trivial to bypass, at least on Android where you can side load easy, and it's a pain in the ass to manage with a huge potential to just take down your app if you mess it up