Tinder Flaw: Location-Based Application Payment Logic Bypass

Mobile platforms carry users' most intimate data, yet security is often an afterthought. NetSPI offers a threat modeling framework to evaluate mobile apps at design time or retroactively.

An overview of iOS app reverse engineering: class-dumping ipa binaries with Cycript and class-dump-z, hooking Objective-C methods via MobileSubstrate, and using iNalyzer or Snoop-it.

Surveys how MDM solutions detect rooted Android devices, cataloging the packages, files, permissions, and commands they check, from BUILD test-keys to su binaries, tested on a rooted Nexus 4.

Passbook boarding passes are zip archives that can be modified and re-signed with an Apple developer account; the author alters Sky Priority imagery but warns tampering invites TSA trouble.

MDM products like AirWatch enforce Android policies, but restrictions aren't hard to bypass. The post evades AirWatch root detection on a rooted Nexus 4 so the device stays rooted and compliant.

Mobile apps are common MITM targets; certificate pinning — hardcoding trusted certificates or public keys in the app — helps by rejecting every certificate outside the pinned set.