So, recently, I have been looking through cracked APK (Android applications) repositories, and I have found a rather large amount of cracked AI chat apps that give you pretty much unlimited access to ChatGPT-4. So I decided to install some of these cracked APK files on my rooted phone so that I could analyze the packets with Burp Suite. And I have found that most of their apps do not even use request specific tokens; they simply use a session token that stays the same for as long as the app stays active on the phone (background or foreground). A few of the apps even ditched the middle man and directly sent the API call to OpenAI with the API key in full view. So with a simple Python script, pretty much anyone is able to have full access to GPT-4 without any type of payment.
I have contacted as many developers of these apps as I was able to find in order to alert them of this security vulnerability.
Here is an example that I got from one of the apps that I tested:
Request:
Look at that. You can even add context.
Response:
Mitigation
A good way for developers to solve this issue is to make users register for an account on their platform instead of directly using Google Payments. In my research, I did not find many apps that do this that have been cracked.
Another way that I have previously mentioned in this article is to generate a token for every chat message. This will make it much harder for a bad actor to gain API access because they would need to dissect the actual APK file instead of capturing a single request. This strategy is not foolproof; it will simply remove some less skilled attackers.
Disclaimer: The information provided in this article is for educational and informational purposes only. It is not intended to promote or encourage the use of cracked software, which may be illegal and unethical. The practices described herein can violate the terms of service of many applications and have legal consequences. The author and publisher of this article do not condone piracy or any form of unauthorized software manipulation. Furthermore, this article does not provide instructions or tools for engaging in such activities. Any actions taken by the reader in relation to the contents of this article are strictly at the reader's own risk. The author has taken steps to ensure that no confidential information is disclosed and has followed responsible disclosure guidelines by notifying the affected parties of any vulnerabilities found.