Didn't take hackers very long to reverse engineer the WH android app.
"The official White House Android app has a cookie/paywall bypass injector, tracks your GPS every 4.5 minutes, and loads JavaScript from some guy's GitHub Pages."
Aside from doing some shady things, it also has several vulnerabilities.
64 comments · 99% upvoted · source · other discussions
How does reverse engineering compiled code work?
Start at the bottom after you uncompile and carefully format the code.
Android apps can often be decompiled into human readable java source code (they contain enough information that allows decompilation, compared to other fully compiled programs - see Dalvik bytecode)
iOS is more difficult and would require dissasembly into machine code. The program is just 1s and 0s that form opcodes (CPU instructions). You convert those instructions into an assembly language. You then analyze this low level code to figure out what the program is doing.
Dex2jar for android, iOS compiles to something harder to reverse but you can still use frida potentially or whatever to mess with the code as it runs. Android decompiles much more easily because it's based on java more or less.
Jadx is a good start: https://github.com/skylot/jadx
There are wrappers that can make things more painful, depends on the app.
I'm really curious who wrote the app, was it a contracted dev team or from an a branch of the Govt. or ...
Google forty-five-press
Thanks for the reference - if their site they have is 45press then guess they have a GSA contract, and they must have been passed enough of a vetting to get that. Makes me feel a little better that it isn't just some offshoot of a DOGE effort.
I appreciate your optimism.
After seeing how it was made, I truly hope (and feel like) it was contracted
Because if that’s the quality of employees there now, holy shit no system will be trustable once these scumbags are gone
Given the caliber of the tools that Snowden exposed, and this I want to believe this was contracted and not built by any of the agencies. But then that makes me wonder if contracted was the malicious code requested or just provided by dev house with their own ideas.
Would be easy for me to believe the current White House staff could be tech illiterate and unaware of what they approved, or that they are savvy enough to planned this for data collection. But I have a hard time finding a mid-point.
Nice work. Thanks for the detailed explanations on each section.
Hi I would like to write an article on this would you be willing to share proof of work so I can show people an exploded view of how it operates and educate non technical people on hardening their devices?
FeriQueen [OP] 10 points · Mar 2026
I’m not the one who did the hacking; I just posted the news. But the hacker who is author of the original article showed some of their work.
I cross posted this to r/hacking, where there are more experts who might be able to demonstrate it all for you.