Researcher bypassed custom token-based brute force protection in an Android mobile app by reverse-engineering a native .so library with JADX, extracting it via ADB, analyzing it with IDA, and using FRIDA to dynamically inject JavaScript that overloaded the token generation function at runtime, allowing arbitrary token generation and defeating the rate-limiting mechanism.
ByteDance's Pangle SDK, embedded in 40+ popular apps including Duolingo and BeReal, transmits sensitive device fingerprinting data (battery level, IP address, storage, IDFV) encrypted with AES-256-CBC where the encryption key and IV are embedded in every message in plaintext, making the encryption trivial to break via reverse-engineered SDK code. Additionally, a hardcoded AES key was found in the native library, shared across all SDK versions.