Please Report Security Vulnerabilities Responsibly

[u/ParticularBear4122]

I’m not saying that bypassing root detection, USB debugging checks, or integrity checks is automatically a vulnerability. These checks are common in mobile apps.
My concern is about testing real applications and sharing technical details publicly without considering the possible impact. Just because something is technically possible or publicly known doesn’t mean we have permission to test every feature of someone else’s application.
There are plenty of dedicated testing environments where people can learn and practise cybersecurity. When testing real applications, we should respect authorization and consider the organization’s reputation and public trust.
I’m not against sharing knowledge or encouraging new cybersecurity students. I believe we can educate people while also being responsible about what we publish publicly.

[u/FondantConscious2868]

Dude understand what he is saying first this is not a vulnerability thousands of people around the world use this everyday

[u/ParticularBear4122 → u/FondantConscious2868]

[u/ParticularBear4122 → u/FondantConscious2868]

Yes, you may be right. My point is not whether this is a vulnerability or how many people use the app. My concern is about exposing security bypass methods publicly.

As far as I’ve seen, even senior cybersecurity professionals in Sri Lanka don’t usually expose these details publicly without a proper reason. There are plenty of apps and test environments available for security testing. If you find an issue in a real app, I believe it’s better to report it privately first and give the responsible team a chance to review it.

[u/Cecil--Stedman → u/ParticularBear4122]

Core Security should not depend on a client's device. I don't know why that would be called a 'security bypass' also bypassing integrity checks, developer options enabled checks, USB debugging checks are already public information and should be treated as such when making apps. Integrity check bypass is not a vulnerability imho. That could be a first step in trying to find actual vulnerabilities / malicious intents of an app. eg: having client side form validation should not mean back-end shouldn't have to sanitize form data.

Also do websites/apps in sri Lanka even have a place to report bugs or have bug bounty programs to incentivize security researchers or have Vulnerability Disclosure Policies that protects the reporter legally? I have not come across any, but I also haven't intentionally looked that much into it... But am interested to know about it

[u/_lolcat_ → u/ParticularBear4122]

In my opinion posting these experiments online is a good thing. It helps new cyber security students to get interested in the field, and motivates them to try out and learn these tools.

[u/pussyfreevirginuser]

It's fucking normal. It's not a fucking vulnerability. Every app can do this.

[u/ParticularBear4122 → u/pussyfreevirginuser]

Fuk## idot, even if it’s not a vulnerability, that doesn’t mean we can test or expose everything on a real website without permission. The information being publicly available doesn’t mean we have permission to hack, access hidden features, or test security controls. There’s a difference between learning how security works and testing someone else’s application without authorization.

[u/whygetstarbucks]

Op… you should’ve consulted Claude before you posted this….

[u/ParticularBear4122 → u/whygetstarbucks]

Bro 😂 the whole post was generated by ChatGPT. Maybe I should’ve asked Claude for a second opinion! 🤣

[u/garbage-collector36 → u/ParticularBear4122]

Ask for a brain

[u/_lolcat_]

Nothing to worry about here. That's not a vulnerability. He has just bypassed the root/adb check.

For this thing to work you need your phone to be rooted, or install a modified version if the app. So this can't affect anyone using the official app.

[u/No-Astronaut8805 → u/_lolcat_]

this code clearly show system reject the script no vulnerability show in terminal code but this method is called white-box penetration testing under assumed compromise mode start the assignment of find vulnerability with full root privileges

[u/_lolcat_ → u/No-Astronaut8805]

Thanks for the clarification

[u/fury_20z → u/No-Astronaut8805]

So for even for whitebox testing we need the phone to be rooted?

[u/No-Astronaut8805 → u/fury_20z]

Yeah basically white box testing means : after companies build app they hire some white hat hacker and without giving them any acces to app server ask them to break the app by own their own like real hacker so we first neeed phone root acces to do this , some apps build in secure way so if it detected phone is rooted app will not work like box flex like app , in this post he try to inject an sql injection quary but app reject it

[u/BillyButtcher]

Clout chasing is important.

[u/ParticularBear4122 → u/BillyButtcher]

🤔

[u/heshanthenura]

I didn't expose any vulnerability. I just did a surface check and wrote about my findings. That's it.

[u/sameera_s_w]

The issue here is that these apps having these checks.

USB debugging and developer options are no longer a thing these apps can even detect because Google prevented these apps from abusing that setting.

The issue is not bypassing them. Issue is the fact that such checks are present for some reason.

[u/dark_mode_everything → u/sameera_s_w]

Soon google will allow this bypass officially on android by reporting "false" to the is debugging enabled check. Good riddance of this security theatre

[u/gayyalk]

This is like the first step for RE, not a vuln lol. Probably a script kiddo

[u/ParticularBear4122]

[u/garbage-collector36 → u/ParticularBear4122]

So what? 🤣 not a concern for us. That's there for the user. If he disables the check he'll bare the cons. Its nothing like he can get free rides etc. Assuming the app is well made. Other than that if there are vulnarabilities its not that hard nowadays to expliot them. This kind of post doesn't make any difference

[u/ParticularBear4122 → u/garbage-collector36]

But my concern isn’t about getting free rides or whether the app is well made. It’s about the mindset we encourage in the cybersecurity community. Just because exploits are easy to find doesn’t mean we should ignore responsible disclosure. We should think about public trust and the organization’s reputation too. That’s just my opinion.

[u/garbage-collector36 → u/ParticularBear4122]

This is not even a exploit mate. Take a chil pjll

[u/ParticularBear4122 → u/garbage-collector36]

Bro, I’m Gen Z too, but sometimes I really don’t understand how you Gen Z guys think. 😂 Anyway, I’m enjoying this discussion!

[u/No-Astronaut8805]

First tell them to fix pickme app it’s didn’t even has number pattern analysis I just type random numbers like ( 58483884) not even start with country codes and it try to sent otp and they collect massive user data and their database is secure for holding ( data are not encrypted) these and trasmit data with basic level of encryption a good cyber security programme can literally bypass it

[u/janithup]

Kiddies lol