Multiple bash files were present in the application's private directory.
Bash files can be used on their own, by an attacker that has already
full access to…
A valid set of credentials in a .js file and a static token for
communication were obtained from the decompiled IPA. An attacker could
use the information to…
Hard-coded credentials were included as part of the application binary.
These credentials served as part of the application authentication flow
and communica…