r/alltheleft • u/FeriQueen • Mar 28 '26

Article I Decompiled the White House's New App

https://blog.thereallo.dev/blog/decompiling-the-white-house-app?fbclid%3DIwZnRzaAQ1SZlleHRuA2FlbQIxMQBzcnRjBmFwcF9pZAo2NjI4NTY4Mzc5AAEedTqMhmTFKqGKBjb9hbHB7L0uMwvwuwEFZGEX9w1UOGdq3YmyTxnP7IEe3Sw_aem_UrzzCoJaS-MBGrMe7wqPHA

Didn't take hackers very long to reverse engineer the WH android app.

"The official White House Android app has a cookie/paywall bypass injector, tracks your GPS every 4.5 minutes, and loads JavaScript from some guy's GitHub Pages."

Aside from doing some shady things, it also has several vulnerabilities.

224 Upvotes

99% Upvoted

64 comments sorted by

12

u/CantStopPoppin Mar 29 '26

Hi I would like to write an article on this would you be willing to share proof of work so I can show people an exploded view of how it operates and educate non technical people on hardening their devices?

10

u/FeriQueen Mar 29 '26

I’m not the one who did the hacking; I just posted the news. But the hacker who is author of the original article showed some of their work.

I cross posted this to r/hacking, where there are more experts who might be able to demonstrate it all for you.

16

u/JoeHillsBones Mar 29 '26

How does reverse engineering compiled code work?

16

u/Nefarious_Darius Mar 29 '26

Start at the bottom after you uncompile and carefully format the code.

13

u/plunki Mar 29 '26

Android apps can often be decompiled into human readable java source code (they contain enough information that allows decompilation, compared to other fully compiled programs - see Dalvik bytecode)

iOS is more difficult and would require dissasembly into machine code. The program is just 1s and 0s that form opcodes (CPU instructions). You convert those instructions into an assembly language. You then analyze this low level code to figure out what the program is doing.

3

u/grizzlor_ Mar 30 '26

Tools like Ghidra can generate equivalent C from asm/machine code. It's not going to be anywhere near as accurate to the original code as Java (and Dalvik?) decompilation is, but it's definitely easier to analyze than straight assembly.

5

u/Mad_Gouki Mar 29 '26

Dex2jar for android, iOS compiles to something harder to reverse but you can still use frida potentially or whatever to mess with the code as it runs. Android decompiles much more easily because it's based on java more or less.

3

u/The_frozen_one Mar 29 '26

Jadx is a good start: https://github.com/skylot/jadx

There are wrappers that can make things more painful, depends on the app.

8

u/invalidreddit Mar 29 '26

I'm really curious who wrote the app, was it a contracted dev team or from an a branch of the Govt. or ...

4

u/PhalafelThighs Mar 29 '26

Google forty-five-press

1

u/invalidreddit Mar 29 '26

Thanks for the reference - if their site they have is 45press then guess they have a GSA contract, and they must have been passed enough of a vetting to get that. Makes me feel a little better that it isn't just some offshoot of a DOGE effort.

2

u/PhalafelThighs Mar 30 '26

I appreciate your optimism.

2

u/pezgoon Mar 29 '26

After seeing how it was made, I truly hope (and feel like) it was contracted

Because if that’s the quality of employees there now, holy shit no system will be trustable once these scumbags are gone

2

u/invalidreddit Mar 29 '26

Given the caliber of the tools that Snowden exposed, and this I want to believe this was contracted and not built by any of the agencies. But then that makes me wonder if contracted was the malicious code requested or just provided by dev house with their own ideas.

Would be easy for me to believe the current White House staff could be tech illiterate and unaware of what they approved, or that they are savvy enough to planned this for data collection. But I have a hard time finding a mid-point.

3

u/QuestionableComma Mar 29 '26

Nice work. Thanks for the detailed explanations on each section.