A shipped mobile app that was a credential vault

The challenge

A software vendor needed the cross-platform client it ships to other organisations validated across Android, iOS and Windows.

How it unfolded

1. Treated the shipped app as an archive, not a program — unpacked and read the binary.
2. Found hardcoded backend credentials compiled into the bundle.
3. Confirmed (read-only) they granted a live, authenticated session to an internal customer-data API.
4. Recovered the at-rest database key from device-derivable material (weak, unsalted key derivation).
5. Decrypted the offline data store; bypassed jailbreak detection with a single runtime hook.
6. Showed an MDM default silently disabled TLS pinning — enabling full session interception.

Impact

A motivated attacker with nothing but the public app could reach a live customer-data API and decrypt the offline store — on all three platforms.

Outcome

One Critical and five High issues with end-to-end runtime proof, a prioritised “rotate now” credential list, and concrete key-derivation, pinning and token-handling fixes. Testing stopped at proof — no customer records were exfiltrated.