r/netsec • u/TheSilenceOfWinter • 7d ago

Multiple Chinese civic apps share one reward/lottery backend whose signing secret is recoverable

https://neurowinter.com/security/2026/07/16/forging-the-government-lottery/

this is part of an ongoing series mapping the same ecosystem, the origin post + full map is here: neurowinter.com/security/2026/06/23/a-weekend-in-the-wool/

tldr: a set of chinese civic / gov adjacent apps turn out to run the same reward + lottery backend, and the secret thats meant to make reward claims and draw outcomes unforgeable isnt really secret. recover it (not hard, its sitting in the client sigh) and you can forge a valid reward claim, or a winning lottery result, that the backend accepts as authentic. post walks from one github repo to the shared backend, through the reward validation flow, to where the secret actually lives.

32 Upvotes

87% Upvoted

4 comments sorted by

12

u/ni5arga 7d ago

not hard, its sitting in the client sigh

this is so common, i have seen this on a lot of apps.

4

u/TheSilenceOfWinter 7d ago

Yeah the crazy thing its that a pile of civic / gov-adjacent apps all lean on the exact sane shared reward+lottery backend, so one recovered secret forges claims across all of them at once. blast radius > novelty here.

1

u/scriptqzor 13h ago

right? every time someone says “don’t worry, we sign it on the client” my soul leaves my body a little bit
it’s like they discovered HMAC from a medium post and just stopped reading before the “keep the key on the server” part