I Reverse Engineered the White House App

· 2 min read

The White House released its official iOS app on March 27th. I saw the announcement on X and did what I always do: downloaded it, unzipped it, and started reading.

I performed both static analysis (decompiling 863,393 lines of Hermes bytecode, dumping symbols from 13 native frameworks, analyzing the privacy manifest and entitlements) and dynamic analysis (intercepting the app’s live HTTPS traffic via MITM proxy to confirm what data actually leaves the device).

The highlights from static analysis:

  • A company originally founded in Tula, Russia (Elfsight) executes live JavaScript inside the app via a two-stage loader across six separate WebViews, each with a native bridge. The Elfsight server controls what scripts get injected. There are no integrity checks.
  • The privacy manifest declares zero data collection while shipping 10 OneSignal analytics frameworks with GPS tracking capability (not enabled, but built in).
  • No certificate pinning, no jailbreak detection, no anti-tampering, no security hardening of any kind. A variable named SSL_PINNING_CONFIG turns out to be a domain whitelist wrapping the standard fetch() API.
  • Expo OTA updates are fully configured but dormant. One native update away from pushing arbitrary JavaScript to every device without App Store review.

The dynamic analysis confirmed:

  • Only 23% of the app’s network requests go to whitehouse.gov. The other 77% go to third parties including Elfsight, OneSignal, YouTube, Google DoubleClick, Facebook, and Twitter.
  • OneSignal receives your IP address, timezone, country, device model, OS version, session count, session duration, and a persistent unique identifier on every app launch. None of this is declared in the privacy manifest.
  • The Elfsight two-stage loader is active: the app contacts core.service.elfsight.com, which responds with JavaScript URLs that are injected and executed without verification.
  • Google DoubleClick ad tracking infrastructure loads inside the app via YouTube embeds.

I wrote up the full static analysis on the Atomic Computer blog and the network traffic analysis in a follow-up post.

Thereallo independently found the same issues on the Android version. Two platforms, same problems.

Findings have been reported to CISA.