MITM? You don't need to MITM something that isn't even encrypted... anyone with a modicum of technical ability can use WireShark to grab these files if they're transmitted over public Wi-Fi. And probably cellular connections, too.
Exactly, sit outside the police station/wherever just nearby spin up wireshark in monitor mode and you have a stream of personal info on the owners of those scanned phones
But they aren't transmitted over public wifi. They are transmitted inside of some kind of private network, given that they are transmitted to a server in the 192.168/24 range
You can have servers with an IP in that range available on public WiFi, no problem at all. If the network is not public, whoever installs the app still needs to connect to it, so you can intercept any credentials they enter, or even run Wireshark on the device.
Re:Cure53 Audit of Chinese ‘Police App’
by morpheuskafka on Sunday August 04, 2019 @01:57PM
(#20608126)
Someone could theoretically use a modified version of Android to capture the police wifi login even after they forget the network, and then use that to connect and log all captures in the future.
Unless they're expecting a MITM from the police network (or wherever they use this app) why is no https a problem?
>BXAQ uses the default icon for Android apps, which means there is no attempt at being covert or discreet about it.
...or maybe they didn't put an icon because it's optional and unnecessary for what essentially is an internal app.
I mean really they are not trying to be unbiased or anything about the analysis.