TLDR Tech / InfoSec
Security Analysis of the Official White House iOS App
Researchers performing static analysis on the official White House iOS app uncovered eight critical security findings: six WebViews execute live, unverified JavaScript from Elfsight, a widget company founded in Russia, via a two-stage loader that allows Elfsight's servers to inject arbitrary scripts at runtime with no Subresource Integrity checks and a ReactNativeWebView.postMessage() bridge to the native layer. The app ships OneSignalLocation.framework with always-on background GPS collection, a provably false privacy manifest declaring zero data collection despite ten analytics frameworks in the binary, OneSignal remote parameters that can silently toggle location tracking without an app update, JavaScript that programmatically strips GDPR and cookie consent banners across all WebViews, and a dormant Expo OTA pipeline that, if enabled, would allow arbitrary JavaScript pushes to all devices bypassing App Store review entirely. The app implements no certificate pinning, jailbreak detection, anti-tampering, or runtime integrity checks, leaving API traffic trivially interceptable via MITM on any shared network.
Read the full story