A Security Researcher Decompiled The White House App, & What They Found Is Pretty Alarming

The app also injects JavaScript and CSS into every page you visit in the in-app browser. This strips away cookie consent dialogs, GDPR banners, login walls, and paywalls. There’s also leftover dev artifacts in the production build, including a localhost URL to the Metro bundler.

Weirdly, that’s probably what will take it down, avoiding paywalls

They want to be able to serve up pre-selcted articles that push their narrative, but they’re gonna piss off all the places they link to, because the app is also injecting its own ads at that point.

How odd

None of that is surprising.

And it gets even stranger. Apparently, the app is loading JavaScript from a random person’s GitHub site for YouTube embeds. Yes, you read that right, it’s just loading JavaScript from a random GitHub site. So if that account ever gets compromised, arbitrary code could run inside the app’s WebView.

Somebody has the opportunity to do the most hilarious thing.

At least they acknowledge that cookie consent does nothing and paywalls are ridiculous.

My shocked face 😶

I wouldn’t have expected any less.

To the surprise of absolutely nobody….