Security Vulnerability in Tapatalk - Android Software Development

This is a simple proof of concept, this apk retrieves your login credentials in plaintext for Android Forums from the tapatalk demo application. It was not designed for the pro nor the XDA versions, but this method may work on those versions as well. This application has been confirmed to work on MotoDroid (cyanogenmod6) and Droid Eris (various custom roms).
This application does not require root access at all. Just requires demo version of tapatalk, and previously logged into android forums).
Developers please encrypt sensitive data.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
*UPDATE* Removed file for now. This appears to be a two part vulnerability. First part being a permissions issue on some custom roms. Second is total lack of securing credentials on Tapatalk's part.

i can confirm this!!!

Yeah ...this works

yea it works. shows all my log info.

Yeah... shows everything....

jcase said:
This is a simple proof of concept, this apk retrieves your login credentials in plaintext for Android Forums from the tapatalk demo application. It was not designed for the pro nor the XDA versions, but this method may work on those versions as well. This application has been confirmed to work on MotoDroid (cyanogenmod6) and Droid Eris (various custom roms).
This application does not require root access at all. Just requires demo version of tapatalk, and previously logged into android forums).
Developers please encrypt sensitive data.
Click to expand...
Click to collapse
Nice work.

Still working this issue?

scandiun said:
Still working this issue?
Click to expand...
Click to collapse
This thread is nearly 2 years old, so I doubt you'll get a response. Also, since xda has a working friendship with the TapaTalk team I don't think discussion of hacking their software is appropriate. With that in mind I'll close this thread so it stops now.
Thread closed.

Related

Modified flash apk doesn't work..no Hulu

For those who have an android phone running froyo your probably aware that hulu had blocked their site from android users. Generally in the past there were methods around this which involved installing a modified flash.apk.
http://forum.xda-developers.com/showthread.php?t=688054
Okay so I went ahead and removed the previously installed flash apk (use root explorer to do it) then I use adb to install it. The next step involved using the debug mode in the browser to make our seem like it is a desktop. Well when I type about:debug in my browser and go into the settings there is no option to change it to desktop. I only see these options:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
So my question is, how the heck do we get hulu working?! When I used skyfire to and switched it to the desktop view, it said I didn't have flash installed. Any ideas?
update:
okay so i found a thread on XDA that seemed to get me a lil further but not where i wanna be.
http://forum.xda-developers.com/showthread.php?t=794512&page=12
this thread suggest that you just install the latest flash.apk and just replace the lib file they give u with the one that comes preinstalled. doing that gets me an error on hulu:
"Unfortunately Hulu is not supported on your platform. We apologize for any inconvenience."
Before, I just got an error saying that they are gonna bring hulu plus to android but thats about it. yes i changed it to desktop and even tried it on skyfire. nothing.
anyone?
Sent from my Samsung Galaxy Tab
Okay sorry the image came out all compressed. I couldn't find anything in the settings tho.
Sent from my Samsung Galaxy Tab
Try about:useragent.
Regards,
Dave
Hi dave. thanks i used the wrong cmd to get to the useragent mode. but i got it set to desktop and now its saying flash i need flash player 10.0.32 or higher (tho i have the most up to date one). hmm...what u think?
You can't use the Nexus One hacked apks on the Tab. I posted instructions for hacking the Tab in another thread - http://forum.xda-developers.com/showthread.php?p=9494802
don't waste your time, hulu will have it patched in a week....
iLoveGoogle said:
don't waste your time, hulu will have it patched in a week....
Click to expand...
Click to collapse
I don't understand why hulu would block us anyway.
Sent from my GT-P1000 using XDA App

installLocation feature and HTC

Hi there,
it seems to be that some manufactor's, like HTC (Sense 3.0), overwrite the "installLocation" attribute through own patched android os versions.
I don't know if this is true, but in fact i have the problem that my app SD-Booster can be moved to SD-Card without a "installLocation" XML statement in the AndroidManifest.xml file.
Well, i guess they use own implemented formulas to verify each app, but in this case it doesn't work very well.
HTC Nexus One (Stock Rom 2.3.3): SD-Booster v1.5.1 can't be moved (option disabled)
HTC Sensation (HTC Stock Rom/Sense 3.0/2.3.3) SD-Booster v1.5.1 can be moved!
Any ideas?
Regards
Akusari
Here are some screenshots, shows up the ****:
Identical installations...
HTC Nexus One (works correct)
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
HTC Sensation (failed, allow moving)
Well this can be overiden with ADB:
adb shell
setInstallLocation 2
So HTC could well have set this in their ROM... seems strange, but I guess you have proof
So if there is no way to stop htc from letting users move your app you could do a check for install location and disable the functionality (if any will be comprised by the app moving) and prompt the user to move it back before letting them use the app
From something awesome
killersnowman said:
So if there is no way to stop htc from letting users move your app you could do a check for install location and disable the functionality (if any will be comprised by the app moving) and prompt the user to move it back before letting them use the app
From something awesome
Click to expand...
Click to collapse
Yes, it looks like that i must do something in this direction...
eatmold said:
Well this can be overiden with ADB:
adb shell
setInstallLocation 2
So HTC could well have set this in their ROM... seems strange, but I guess you have proof
Click to expand...
Click to collapse
Thanks for the information
Yes, it's pretty heavy, isn't it ?
I hope some other devs doing a verification as well and if it's a real problem we should find more app issues anyway.
Regards,
Akusari

[App][2.2+]Rootland Root Android

This app is from ScieNext
All the credit goes to them and not me. I'm jus sharing with you all
★★★Internet Connection Must be Required For Few Important Online Updates After Install.★★★
Always Confuse About Rooting Your Android Device?
Thinking All time What is Root?
You are Zero About android Root?
Want to know All about Root?
Want to Root your device Safely Yourself?
Well All your Wishes Will gonna Comes true finally.
Welcome to the Land of Root. Welcome to the Rootland Root Android.
Rootland is Huge Platform to Root your android Phones/tablets or any of android Device Safely and Successfully.
You can See now Days Millions of TOP Android Apps available in the Play Store Which Require Root if you Want to Use it.
No need to worry because Rootland Root Android is here.
What We have in this Rootland Root Android app?
# Basic Information About Root.
# Deep knowledge of Rooting the phone.
# Perfectly Explained Rooting Tutorials With necessary Screenshots.
# Learn About How can you Backup Your Android Devices.
# Learn About How Can You flash Custom ROMs on your Android Devices.
# Awesome Common Methods Which will Root your Device Safely.
Tested On Almost Famous Android Phones/Tablets Successfully.
This application is brought to you totally free with the help of search monetization. I have opted to use this to be able to keep creating more free apps for you. Please note that with this app you will receive a few search points on your device, all are easily deleted or replaced. Thank you for your understanding.
Facing Trouble to Understand Anything than we are 24h available to Help you as Supporting mail service.
After your mail we'll touch Back to you within 24hours.
Join Us at Facebook for Regular Updates
http://Facebook.com/scienext
Download from Google Play
https://play.google.com/store/apps/details?id=com.rootlandscn
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
[/IMG]

Full Access WPSystem Folder. Browse Isolated storage. [My 2nd attempt]

Full Access WPSystem Folder. Browse Isolated Storage on every devices.
No restrictions. No need any unlocked methods. Works on User device.
Works on Any WP8.1 Firmware update including DP GDR 1 Update.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
download link:?
Isn't it a surprise??
Sad, no response ;-(
djamol said:
Isn't it a surprise??
Sad, no response ;-(
Click to expand...
Click to collapse
Sorry, but we need an explanation, not just screenshots. You already mentioned that it is (Full FS Access) possible for you so no one wonders you finally show it. All we need to know is how to achieve this (xda stuff is also will check for legal things) and why you'll making steps to open your achievements. Previously you said it is Microsoft things to care about, looks like they're disappointed you somehow.
Some answers are right in front of you
Files&folder pro
Aerize explorer pro
the windows explorer app ( the older one ) doesnt work anymore in cyane/gdr1
Maybe if you had *explained* anything, instead of just doing a pile of screenshots, you would have gotten some response...
Are you saying that they have removed the restrictions on accessing app data on the SD card and any app which can browse the SD card can now access that data? Because that's cool and useful, but simply posting a bunch of screenshots is an uneeded and largely unhelpful way to explain that. You say "My 2nd attempt" as though you did something meaningful, but don't explain what that thing is. Did you just install the latest update and try again? If so, say *THAT* instead of posting multiple pages of screenshots.
djamol said:
Isn't it a surprise??
Sad, no response ;-(
Click to expand...
Click to collapse
Not to mention this response ????????????????
As it seems its just a other app.
No names, no steps no nothing.
Confusion abounds... Thread closed...

Multiple windows - Android 6.0

Hey friends,
this thread is a friendly reminder how to activate 'multiple windows' on your Elephone P9000.
Most of you know how to achieve it, but there are still some guys out there who are clueless.
No credits to me ))
As always: Not my fault if you delete or add the wrong ones, be careful(!)
First of all:
1. You Need to have root http://bbs.elephone.hk/thread-9919-1-1.html
2. Now you download as example 'Root explorer' https://play.google.com/store/apps/details?id=com.speedsoftware.rootexplorer&hl=de (links of cracks wont be supported)
3 .Now navigate to "System"
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
4. Click on build.prop and open it with your favorite text Editor (included one is more than enough)
5. Now add this to your last line; persist.sys.debug.multi_window=true
6. Afterwards save it, restart your phone and voila )))
thanks for sharing
Works perfect, thank you
Bradco said:
thanks for sharing
Click to expand...
Click to collapse
You are welcome ))
racer290 said:
Works perfect, thank you
Click to expand...
Click to collapse
Glad it worked )
is it really usefull ??
just to know before
Its also enabled in Eragon 2.8 ROM, afaik its not possible to root Stock 31052016 with the known method, so no chance to use that tutorial at the moment.
I tested the feature and its funny to play around with, but i do not think i will use it very often: Even on the "big" P9000 5,5 inch screen the splitted apps are very small and hard to use.
Great, is working for me. Comes in handy sometimes
Sent from my P9000 using XDA-Developers mobile app
Haven't rooted yet. I really miss multi-window from my S4, YouTube video running at the bottom and reddit at the top for me to read through. The UI on this split screen looks worse though, no divider, no focus (it seems).

Categories

Resources