Though I have been critical of LLMs in general, I have to give them credit for being really good digging out stuff that me as a human would find tedious. As such, I have my own LOCAL clanker that I use for two things: as a rubber duck and dump an apk with apktool inside a locked up container and let it go nuts. I've done it on numerous popular apps and it has found countless hardcoded credentials and keys in them. Just about all apps really, so far I think there's only been one that hasn't had THIS particular problem(it did have countless others though).
As the person who had to rush out an update to MyFordMobile because some enterprising windows phone nerd ganked the hardcoded creds out of their Android app to build a winphone app that allowed you to authenticate against their backend and remotely start/unlock your car, which they _really_ did not like...
Many such cases. And no, I was not the one who did that in the first place
The developers have probably surrendered their identities and the apps got reviewed, verified, and can be distributed to end users via official stores, so it can't be so bad because they keep users safe.
Funny that the verification step doesn't include scanning for hard coded credentials though. How do they detect malware if they don't decompile?
Hardcoded credentials and other issues in Tata Motors App
(cert-in.org.in)80 points by qtqtqt 14 hours ago | 17 comments
Comments
Many such cases. And no, I was not the one who did that in the first place
Funny that the verification step doesn't include scanning for hard coded credentials though. How do they detect malware if they don't decompile?
https://eaton-works.com/2025/10/28/tata-motors-hack/