Mobile Security Testing for a Live-Event Ticketing App
A ticket-cloning flaw fixed three weeks before the season’s largest on-sale.
Client name withheld by agreement- Client
- Live-event ticketing app, 7M users
- Region
- Los Angeles, California
- Year
- 2025
- Duration
- 5 weeks
- Scope
- iOS, Android, rotating-barcode service and 96 APIs
- Practice
- Offensive Security & Resilience
The challenge
What was at stake.
A live-event ticketing app with seven million users relies on rotating barcodes to stop screenshots and resale fraud. Venues had begun reporting duplicate tickets at the gate for high-demand shows.
The season’s largest on-sale was three weeks away. A working cloning method in the wrong hands would mean turned-away fans and a public loss of trust.
What we did
The approach, step by step.
- 01
Barcode service attacked directly
We reverse-engineered the iOS and Android apps and found the seed behind the rotating barcode could be extracted from a jailbroken or rooted device.
- 02
APIs tested end to end
96 APIs were tested for authorization flaws, transfer abuse and bot-friendly endpoints using the OWASP MASVS and API Security Top 10.
- 03
Fix designed with engineering
Seeds moved to hardware-backed key storage with device attestation, and the gate scanner now rejects barcodes from untrusted devices.
- 04
Retest before the on-sale
Every fix was verified on both platforms before release, and the cloning method no longer worked.
Outcomes
What changed, in numbers.
- 1
- ticket-cloning method closed before the on-sale
- 96
- APIs tested
- 7M
- users protected
- 3
- weeks of margin before peak demand
They found the exact flaw the resellers were using and helped us close it before our biggest week of the year.
Services delivered
Related engagements
More work in Offensive Security & Resilience.
-
Irving, Texas · 7 weeks
Offensive Security & Resilience · 2026Digital Ordering Penetration Test for a Restaurant FranchisorA loyalty-points fraud path worth millions closed before the national rewards relaunch.
-
Phoenix, Arizona · 18 weeks
Offensive Security & Resilience · 2025Ransomware Recovery Readiness for a Water AuthorityBilling, SCADA historians and plant engineering restored from clean copies in under 30 hours during a live drill.
-
Charlotte, North Carolina · 26 weeks
Offensive Security & Resilience · 2026 · OngoingUnified Controls and Audit Program for a Wealth-Tech Platform612 overlapping requirements folded into 148 owned controls, and one evidence cycle for four audits.
Let’s talk about your version of this.
Share what you are up against. A senior practitioner who has delivered this kind of work will reply within one business day.