Hello, welcome to the Tuesday, September 4th, 2018 edition of the Santernat Storm Center's Stormcast. My name is Johannes Ulrich, and today I'm recording from Amsterdam, Netherlands.

I'm teaching this week the defending web application class here in Amsterdam, and one point that came up today in class is that

really many mobile applications are just front ends for web services.

So not really surprising that some web application flaws make it into these mobile apps.

The latest example is the Android version of the mobile app

for Medium, the blogging platform. That does require a subscription for some of its stories,

but you're allowed to read a limited number of these stories for free. Now the problem is, how does the site actually know how many stories you read?

And apparently, that's just managed via cookies that are kept on declined.

In this case, also the mobile app.

Yuol Sprintz at Hacker Noon wrote up how he reversed the medium mobile app to figure out

how they're tracking their stories and how he actually then modified the mobile app,

recompiled it, and essentially created a mobile app that would allow him to read unlimited

stories. Probably not diverse that can be done with this particular technique.

I believe the medium is charging something like $5 a month for a full subscription.

But it really illustrates nicely this problem in a lot of mobile apps

that do not really take into account that they're still dealing with data

coming from the user using a device that the user controls, and with that the user in the end

controls all requests being sent by this device.

And sticking with learning from the attacker here for a bit more at Black Hills Infosec.

We do have a great blog post by Mike Felch and appears to be the first in a series of blog posts about red teaming Microsoft, particular how to use active directory in particular

if it is linked to Asia in order to for example attack internal networks lots of stuff

in this blog post really way too much to do it justice here in my brief podcast. But for example, one little tip here that I found

...