Researcher says Saudi government app shipped bank key behind password '2'
Zachi says the Saudi National Bank credential, client ID and secret were removed and rotated before his September 8th disclosure.
By Ryan Merket · Published
Primary source: X
Why it matters
Mobile app packages are public artifacts. Shipping a reusable bank credential inside one can expose every privilege attached to that key across millions of copies.
Zachi (@iam_zachi) said a Saudi government mobile app with more than 10 million installs included a private key belonging to Saudi National Bank, protected by the single-character password "2."
The developer and security researcher published his account on September 8th, after saying the credential had been replaced and the exposure fixed. He did not publish the private key itself in the three-post thread.…