Hitster is a party board game that uses QR-coded cards to launch song clips in a companion app via Spotify or Apple Music; each QR encodes a URL containing a region and a card ID, creating a mapping from Card ID to music track (with multiple regional variants). After extracting an APK from an Android download site and decompiling with jadx, the decompiled resources included a Base64-encoded JSON (gameset_database_4.json). Tracing code revealed an AES-GCM decryption routine: the app decodes Base64, slices out a 12-byte IV, derives a 256-bit AES key by SHA-256 hashing a concatenation of (data length - 28) and a hardcoded string, then decrypts the ciphertext to yield plaintext mappings. Running that process produced a ~31,000-line file mapping card IDs to Spotify/Apple Music tracks, ISRCs, and region-specific variants.
The effort exposed a sloppy security posture: after about 18 hours of reverse engineering and a Rust-based decryptor (with help credited to Mr.Corrupt), the same dataset was discovered unencrypted on the company server at hitster.jumboplay.com/hitster-assets/gameset_database.json. In short, the app contained a working AES-GCM decryption routine but the underlying data was left publicly accessible, turning a non-secret into an avoidable reverse-engineering exercise and demonstrating security through obscurity rather than real protection.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
CVE-2026-111943 involves a compromised intermediate certificate authority, which could undermine the trustworthiness of digital certificates. The vulnerability affects the security infrastructure used for encrypting internet communications. (nvd.nist.gov)
Poland has accused social media companies of acting as 'silent allies' of Russia. The country has threatened to impose fines on these firms over their perceived support for Russia's interests. (reuters.com)
Node.js released security updates for a high-severity flaw (CVE-2026-111497) in its Brotli decoder that could allow memory leaks or arbitrary code execution. Users are advised to upgrade to the latest patched versions, especially if running outside Vercel's managed environments. (vercel.com)
Cable theft in Thurnscoe, UK, led to a broadband outage affecting thousands of Openreach customers. The theft involved damage to critical infrastructure, disrupting internet services in the area. (datacenterdynamics.com)
Vulnerability reports involving AI are valuable and often accurate, and ignoring them risks user safety. Since spring 2026, AI-generated reports have decreased in false information, but they remain overly verbose and imprecise. (daniel.haxx.se)
Tech workers in San Francisco face increased risks of espionage, with foreign spies targeting AI companies and employees. Experts warn that romantic or friendly interactions could be attempts at gathering intelligence, making trust difficult in the industry. (sfstandard.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.