🤖 AI Summary
白ハウスの新しいアプリについて、セキュリティ上の深刻な問題があるというレポートがあります。この記事では、GPSトラッキング機能やJavaScriptからのランダムGitHubサイトへの読み込み、SSL証明書のピンningなし、インラインブラウザでのCookie同意ダイアログの削除などの脆弱性が指摘されています。
1. アプリはReact Nativeで作られ、OneSignal SDKを使用しています。GPS位置情報は約4分半と9分半に一度それぞれ更新され、データはOneSignalのサーバーに同期されます。
2. JavaScriptはランダムなGitHubアカウントから読み込まれることもあり、これがハッキングされた場合、任意のコードがアプリ内で実行される可能性があります。
3. SSL証明書pinningがないため、不正なネットワーク上でのトラフィック傍受のリスクがあります。また、インラインブラウザではCookie同意ダイアログなどが削除され、プライバシーに悪影響を及ぼす懸念もあります。
これらの問題は、セキュリティ研究者の APK解析によって明らかになりました。
New submitter spazmonkey writes: From a hidden GPS tracker polling your location every 4.5 minutes to JavaScript loaded from a random GitHub account, no SSL certificate pinning, and an in-app browser that silently strips cookie consent dialogs and paywalls from every page you visit, the new White House app seems to have a little bit of everything. A security researcher pulled the APK apart to discover the cybersecurity vulnerabilities. "The app is a React Native build using Expo SDK 54, with WordPress powering the backend through a custom REST API," reports Android Headlines. "That's pretty normal, as nearly 42% of all websites on the internet are powered by WordPress. But that's just the start; now the nightmare begins..." From the report: To start, the app has a full GPS tracking pipeline compiled in. Essentially, it's set to poll your location every 4.5 minutes in the foreground, and 9.5 minutes in the background. It's syncing latitude, longitude, accuracy, and timestamp data to OneSignal's servers. These location permissions aren't declared in the AndroidManifest, but they are hardcoded as runtime requests in the OneSignal SDK. Some have noted that the tracking only kicks in if the developer enables it server-side and the user grants permission, but it is there, ready to go.
And it gets even stranger. Apparently, the app is loading JavaScript from a random person's GitHub site for YouTube embeds. Yes, you read that right, it's just loading JavaScript from a random GitHub site. So if that account ever gets compromised, arbitrary code could run inside the app's WebView. There's also no SSL certificate pinning, meaning that traffic can potentially be intercepted on compromised networks like sketchy public WiFi or corporate proxies. The app also injects JavaScript and CSS into every page you visit in the in-app browser. This strips away cookie consent dialogs, GDPR banners, login walls, and paywalls. There's also leftover dev artifacts in the production build, including a localhost URL to the Metro bundler.
Read more of this story at Slashdot.
ログイン
