(Mar 21, 2023 07:55 PM)affairsector Wrote:  Yes they 100% use ML algorithms. Browsers will be judged more harshly. You must behave like a regular user and a trust score is assigned based on a combination of factors;

I would guess it would be some sort of score derived from phone carrier, IP address, account reports, number of chats you start in specific time period, time spent reviewing potential match profiles, positive swipes vs rejections, swipe directions/speed, length of chats (message quantity per chat), message variations, bio "flagged" keywords (such as "Snapchat"), account age, account verification, account picture types (using image classification they can detect type of pictures). The further this appears from the large pool of long-lasting user accounts the less trusted your profile will be.

Always ensure you are using legitimate phone carrier in area code near your IP address/submitted location. Always make sure your IP address has a good trust score.

From Android 10, the operating system no longer allows developers to get IMEI or Device ID and only allows them to make use of factory resettable IDs such as Advertising ID or a UUID they code themselves. You require privileged permission that only system apps have access to.

Read more on that here:

• https://developer.android.com/training/articles/user-data-ids
  


• https://stackoverflow.com/questions/75541330/android-device-id-change-while-device-factory-reset
  


• https://source.android.com/docs/core/permissions/immutable-device-ids
  

Chances are [BRAND NAME REMOVED] is detecting you by looking for specific files in the filesystem that are only populated with emulators/rooted devices, so you need to simulate your device to appear like a regular user's stock device.

Avoid using a rooted device or hide the root.

---

I'm not sure what exactly your intentions for using Frida are for, but you would use it to try and hook the function that you want to change the functionality for.

Have you already decompiled the [BRAND NAME REMOVED] APK and found what you want to hook?

This blog has good articles covering Frida use on a real application rather than a practice application like AndroGoat: http://www.giovanni-rocca.com/reverse-engineering-supercell-chapter-9/

---

You should note that a lot of developers are using anti-hooking techniques and anti-automation techniques by using the ports of typical libraries/tools such as Selenium/Appium/Frida. I would recommend you always change the ports being used for live production automation tools.

Research on anti-emulation / anti-virtualization / anti-hooking techniques. Remember that Android is open source, and the developers of applications that need to be compliant with the Google Play Store all have the same restrictions.

---

My recommendation is to do network traffic captures and view what data they are collecting, think of how you would prevent malicious use in your own applications and to look through the restrictions that the operating system has. I won't give away the way my tool works for free but that is a good starting point to understand how any application will feasibly work on the back-end.

Good luck!

(Mar 21, 2023 08:41 PM)nentendo Wrote:  I have been careful with the IP, always changing it, the funny thing is that even without even having almost activity in the profile, hours later is banned!!!, the profile only receives 5 visits and is shadow banned and after some ours completely banned!, without even a single swipe, without even filling in the bio, lol.

I have modified a pixel of the photos to change the MD5 hash to rule out that it is the photos.

The root is hidden and just in case I used an Inotify repository for Android so I can see what files the app is accessing and I haven't noticed anything out of the ordinary.

I will take a look at the ad ID or UUID and read the documentation you have written, that is very helpful! thanks!

Yes I decompiled the APK but I'm not an expert in java/kotlin so I had a hard time reading it, I will have to study the source code for a few days and learn more about frida.

With frida I was trying to do a ssl pinning to see what they are sending to the server and from there maybe give me a clue what data they are capturing from the phone, I was expecting to see a property in the JSON with the android id or IMEI number, maybe this sounds naive but like I said I don't know much about pentesting but I would be willing to read a lot and learn, I don't lack motivation but like the film in time, I'm running out of time.

Thanks for the time you took to write this thread, I have read it and there are several things that are very helpful!

I will read the links you sent me and try again in the name of Darwin!

As a pentester, don't you find it curious that, from a Darwinian perspective, [BRAND NAME REMOVED] could be an organism and android an environment?

The lack of knowledge of the constraints of the environment makes everyone play with disadvantage, it helps to go discarding, this discarding of the IMEI is valuable because there are many myths on the internet that the IMEI is used by apps to ban the android phone for life.

• https://portswigger.net/burp/documentation/desktop/mobile/config-android-device
  


• https://httptoolkit.com/blog/frida-certificate-pinning/
  


• https://redfoxsec.com/blog/ssl-pinning-bypass-android-frida/
  

(Mar 21, 2023 09:05 PM)affairsector Wrote:  Yes, I view almost everything as a system of nested living systems.

You can do SSL pinning with Frida or with Burp Suite by adding in your own Certificate Authority, here are some guides:

• https://portswigger.net/burp/documentation/desktop/mobile/config-android-device
  


• https://httptoolkit.com/blog/frida-certificate-pinning/
  


• https://redfoxsec.com/blog/ssl-pinning-bypass-android-frida/
  

IMEI used to be a valid method that app developers used, it is important to always check the publication date of your sources and ensure the methods you are referencing are up-to-date.

If you are certain the IP address has a good trust/fraud score and your fingerprint appears as a valid user then by process of elimination I would imagine it is the phone number you are using.

Use a non-VoIP phone number from a carrier in the area code of the IP address' location.

If you are spoofing the location it could possibly be that in itself.

Try using different pictures entirely, simply modifying some pixels to change the MD5 is not enough. They have image classification and facial recognition algorithms. There have been instances where people have been banned possibly by their facial fingerprint.

Treat your work environment like a virologist's lab. You should never re-use samples if you want accurate data. Everything should be fresh.