# H1514 Ability to MiTM Shopify PoS Session to Takeover Communications

Shopify PoS customer-view WebSocket accepted a new receiver public key without validation, letting a same-network attacker MITM the session and alter cart, tip, and customer data.

- Payout: hidden
- Severity: medium
- Program: Shopify
- Found by: teknogeek
- Disclosed: 2019-11-04
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/423467
- Library page: https://bugbountylibrary.com/r/h1%3A423467
- Tags: area:mobile domain:mobile domain:network impact:data-leak impact:integrity kind:bounty platform:hackerone sev:medium tech:android tech:websocket technique:source-review vuln:business-logic vuln:crypto vuln:misconfiguration

**Target:** Shopify PoS customer-view WebSocket protocol (Android apps)
**Root cause:** ClientCryptoProtocol.receiveMessageFromServer() calls setReceiverPublicKey() on any incoming message type without verifying the sender can decrypt an ACK, so the Curve25519 receiver key established from the QR code can be overridden by anyone on the network.
**Steps:**
1. Observe PoS app listens on 0.0.0.0:5000 and QR connection string embeds wifi IP, public key, nonce, schema version.
2. ARP-spoof the local network to MITM the ws:// connection between customer view and PoS.
3. Send a message with a cryptoType that skips the decrypt branch, carrying attacker's publicKeyString.
4. Client executes `setReceiverPublicKey(str)` and `onAckReceived()`, adopting attacker key.
5. Relay/decrypt subsequent traffic to read and inject cart, tip, and customer data.
**How found:** Researcher decompiled the com.shopify.pos and customerview apps, noticed netstat showing 0.0.0.0:5000 listener and getConnectionString() using wifi IP, then traced that start() and receiveMessageFromServer() both call setReceiverPublicKey(), spotting the unvalidated override path.
**Exploitation:** Attacker on same wifi ARP-spoofs the ws:// link, forces the customer view to accept a new receiver public key via the unvalidated message path, then relays and decrypts messages to alter cart contents, tip amounts, and customer email/phone.
**Insight:** When a protocol bootstraps trust from a QR-code key, check every code path that calls the key-setter — a message-type switch that skips decryption before re-keying lets an on-path attacker replace the trust anchor.