We intercepted the White House app's network traffic
This is a follow-up to our static analysis of the White House iOS app . In that post, we decompiled the app and documented what the code could do. Critics fairly pointed out that compiled code doesn’t mean active code.
So we set up a MITM proxy and watched what the app actually sends.
We installed mitmproxy on a Mac, configured an iPhone to route traffic through it, and installed the mitmproxy CA certificate on the device. Then we opened the White House app (v47.0.4, build 81) and browsed every tab: Home, News, Live, Social, and Explore.
All HTTPS traffic was decrypted and logged. No modifications were made to the traffic. The app was used as any normal user would use it.
On a single browsing session across all tabs, the app made requests to 31 unique hosts (excluding iOS system traffic):
Of the 206 app-initiated requests captured (excluding iOS system traffic), only 48 (23%) went to whitehouse.gov. The other 158 (77%) went to third-party services including Elfsight, OneSignal, YouTube, Google DoubleClick, Facebook, and Twitter.