Website API vs Mobile API

The problem

I was building Numby’s core logic. Basically, it’s a ticket aggregator platform, so I needed to link the same events across multiple selling platforms, such as StubHub or Viagogo. The first question was: how can I link an event to multiple different platforms? I would need an infinite database constantly updated with the links, which is simply impossible. So, I decided to rely on the APIs of those selling platforms to send them the user query and fetch all the results, allowing my database to auto-build itself.

Everything seemed fantastic, but the first wall was that these platforms don’t have any public API documentation. So, I had to replicate the HTTP requests with a custom query for every user search. Well, this approach worked well for some websites, but not for StubHub.

In fact, you need to include a dynamically generated Authorization field in the GET request. Example follows:

curl -X GET 'https://www.stubhub.ie/bfx/api/search/suggest/v3?{query}' \
  --header 'Authorization: Hawk id="1773102917.158b4afe8b5bc39f", ts="1773102019", nonce="2Gzy3", mac="E18MsW2+WoCoM0y4MC8sD2+oQvP6Y+/FSgb7LU3G2Ug="'

This approach falls apart immediately, since the Authorization field rotates at every request. I’m relatively new to this level of protection; how was I supposed to reverse-engineer this? I don’t like to waste time, so I had an idea.

Sniffing the mobile StubHub app traffic

I heard apps usually use different endpoints than their web counterparts. So I installed a mitmproxy certificate on my iPhone and started sniffing the traffic. Here is the request I extracted:

curl -X GET 'https://app.stubcloudprod.com/search/suggest/v3/?{query}' \
  --header 'authorization: Bearer OApI0BzLZ_icIQr6ePr325sy6Tca'

Nice. I have a GET request, but still with an authorization field. So what exactly is this Bearer token? I had no idea. I just imported that request into Yaak, hit CTRL+ENTER and it worked. And it worked again, and again, and again. I grabbed a second iOS device to test if that token would change, and discovered that it is entirely static.

I’m happy but…

So now my life is much easier and I can search for anything on StubHub. But this whole situation made me think a lot. Why would a platform implement complex Hawk ID signatures to protect its website, but leave the mobile app completely uncovered?

I recently read similar stories about a primary ticketing platform: brokers bought thousands of tickets just because the company didn’t have Akamai enabled on their mobile endpoints. This is completely hilarious and renders all the effort the website developers put in entirely useless.

Conclusions

System’s security is only as strong as its weakest endpoint. Spending engineering effort locking down the web while leaving the mobile API bare is doing half the job.