How I Reverse-Engineered one of the biggest GSM Operator's application.
isayeter.com
How I found a critical bug in one of the biggest GSM Operator's application that allowed logging into any user account without a password.
  • unitedwithme@lemmy.todayEnglish
    5 days

    Good article! At least it was patched in about a week! I feel like so many others wouldn’t take the time to address promptly.

  • TryingSomethingNew@sopuli.xyzEnglish
    5 days

    I saw how they created the SHA-1 signature string, it was something like: “THAT_PART1_STRING(35235nnASaf12) + APPTOKEN + UDID + MYPHONENUMBER + SECURITY_IMAGE_ID”

    That string, i think, looks like a “pepper”. A salt is unique per user and stored in the database; that would’ve prevented this. The pepper should never be hard coded either.