News for hackers. Stuff that matters.

A comment on Insurance Buys the Wheelchair, but Not the App to Run It.

Re:Insurance Buys the Wheelchair, but Not the App to Run It by tagyro on Sunday March 10, 2024 @06:32AM (#39658117)
A couple of notes on the manufacturer (and the insurance company)

- the manufacturer and the insurer are connected: https://www.northdata.de/Alber+GmbH,+Albstadt/Amtsgericht+St...

- their iOS apps link to privacy and instructions web pages that are missing (404) and, while the AppStore page mentions that no data is collected, their apps connect to googleapis(dot)com and request access to location (I'll spin up a proxy and do a MitM to gather more info)

- the reviews from their employees are ...less than stelar: https://www.kununu.com/de/alber1/kommentare

[ Parent | on HN ]
Re:Insurance Buys the Wheelchair, but Not the App to Run It by WirelessGigabit on Sunday March 10, 2024 @12:09PM (#39660260)
FYI I have seen many apps that use certificate pinning so MITM becomes really hard.

You'll need either root on an Android and make sure the app doesn't detect it.

I used Frida with ADB to bypass the pin.

Although a quick Google search showed me that maybe now it is easer: https://ayoubnajim.medium.com/bypass-ssl-pinning-for-flutter...

On iOS it's even harder due to the need of a jailbroken device.

[ Parent | on HN ]