"Super secure" MAGA-themed messaging app leaks everyone’s ph...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://ericdaigle.ca/posts/super-secure-maga-messaging-app-leaks-everyones-phone-number/
• Blog Title: "Super secure" MAGA-themed messaging app leaks everyone’s phone number
• Suggested Section: 1) "Mobile Pentesting -> Android Applications Pentesting -> Frida Tutorial" for the FLAG_SECURE bypass trick; 2) "Pentesting Web -> Web Vulnerabilities Methodology" (or a new subsection like "Contact Discovery & Membership Enumeration" / "API Logical Data Leaks") for the membership/participants endpoint abuse, phone-number enumeration, identifier correlation, and large-scale enumeration techniques.

🎯 Content Summary

The post analyzes severe design and privacy flaws in the rebranded Converso app, now called Freedom Chat, a MAGA-themed messaging app that heavily markets end-to-end encryption and security. The author focuses on how the backend APIs and client logic leak highly sensitive metadata (phone numbers and account PINs), not on breaking Seald’s cryptography.

Setup and tools

The author:

• Installs the Freedom Chat Android app from Google Play.
• Inte...

  🔧 Technical Details

  1. Disabling Android screenshot protection with Frida
  The app sets Android’s FLAG_SECURE to prevent screenshots and recordings, but this protection is purely client-side. By hooking the app process with Frida and applying the known FLAG_SECURE bypass (as described in Securify’s blog), an attacker can intercept or override window flag calls at runtime to clear FLAG_SECURE, making it possible to capture full UI screenshots while analyzing traffic or documenting vulnerabilities.

  
  

  2. Extracting secrets from channel membership APIs
  Many chat apps expose a channel or group membership API that returns a list of members and associated metadata. In Freedom Chat, each members[i].user object includes sensitive fields such as pin (a 6‑digit login PIN), sealdKey, and timestamps. The general trick is: whenever you see a members or participants🤖 Agent Actions

  Summary:

  • Enhanced the Frida tutorial by documenting a practical workflow for stripping WindowManager.LayoutParams.FLAG_SECURE, including a reusable Frida hook (wrapped in an expandable block), operational guidance, and references to the Freedom Chat case study plus Securify’s original research.
  • Expanded the Web Vulnerabilities Methodology with a new “Contact Discovery & Membership Enumeration APIs” section covering enumeration workflows, batching strategies, token refresh handling, dataset correlation, mitigation guidance, an expandable Python PoC, and associated references.

  Tests: Not run (not applicable for documentation updates).

  ---

  This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

  📚 Repository Maintenance

  • MD files processed: 920
  • MD files fixed: 6

  All .md files have been checked for proper formatting (headers, includes, etc.).

[carlospolop]

🔗 Additional Context

Original Blog Post: https://ericdaigle.ca/posts/super-secure-maga-messaging-app-leaks-everyones-phone-number/

Content Categories: Based on the analysis, this content was categorized under "1) "Mobile Pentesting -> Android Applications Pentesting -> Frida Tutorial" for the FLAG_SECURE bypass trick; 2) "Pentesting Web -> Web Vulnerabilities Methodology" (or a new subsection like "Contact Discovery & Membership Enumeration" / "API Logical Data Leaks") for the membership/participants endpoint abuse, phone-number enumeration, identifier correlation, and large-scale enumeration techniques.".

Repository Maintenance:

• MD Files Formatting: 920 files processed (6 files fixed)

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0