How I removed ads from the Spotify app

In this blog post, I’d like to share my journey on how I managed to remove ads from the Spotify app. Please note that this endeavour was not meant to harm the company but rather to understand the inner workings of apps and their security mechanisms.

Decompiling Spotify: The First Step

My quest began with decompiling the Spotify app using a tool called APKTool. Decompiling allowed me to peek into the app’s source code and make the necessary modifications. One crucial change was inserting XML code into the network_security_config

<base-config cleartextTrafficPermitted="true">
    <trust-anchors>
        <certificates src="system" />
        <certificates src="user" />
    </trust-anchors>
</base-config>

This seemingly minor change was a significant step towards understanding how Spotify’s app communicated with its servers. It enabled me to conduct a “Man-in-the-Middle” (MITM) attack on the app using MITM software. I installed a malicious certificate on my smartphone and enabled the app through the xml change to trust user added certificates to connect through https.

Man in the middle attack (MITM)

Analyzing Encrypted API Requests

Spotify, like most apps, uses HTTPS to encrypt its API requests, making it challenging to decipher the content of these requests. However, with the MITM attack in place, I was able to effectively bypass the encryption and inspect the request bodies. This step allowed me to identify the endpoints responsible for fetching ads within the app and an endpoint used to report crashes or issues like not able to fetch ads from the app.

Example of how a MITM software might look like

Finding the Needle in the Obfuscated Code Haystack

The next hurdle I faced was locating and modifying the code responsible for making API requests. The Spotify app’s codebase was far from straightforward, featuring obfuscated code with cryptic variable names like a, b, x, and y. To make matters more complex, the decompiled code was not in Java but written in Smali, a low-level programming language used for Android apps.

For those unfamiliar with Smali, it’s essential to understand that it’s a human-readable representation of the Dalvik bytecode used by Android applications. Smali code is significantly more challenging to work with than Java, making reverse engineering a demanding task.

Persistence Pays Off: Editing the Smali Code

Despite these challenges, I persevered, dedicating three days to a meticulous search through the Smali code. My breakthrough came in the form of an comment line, hinting at the purpose of a particular section of code. It turned out to be the interceptor layer responsible for API requests.

Here, I edited the Smali code to intercept and inspect a set of URLs used for fetching ads and another URL used for reporting crashes or abnormalities within the app. By selectively blocking these URLs, I was able to successfully bypass the ads on Spotify.

Conclusion

My journey to remove ads from the Spotify app was an eye-opening experience, shedding light on the intricate layers of security and obfuscation that app developers employ to protect their products. It’s important to note that my intentions were never malicious, and I strongly discourage others from attempting similar activities.

If you discover vulnerabilities or issues in apps, I recommend following ethical disclosure practices or reporting them through bug bounty programs, where applicable.

Ultimately, my journey taught me valuable lessons about the inner workings of apps and the importance of responsible exploration in the digital landscape. While my experience might not lead to an ad-free Spotify for everyone, I hope it inspires a greater understanding of the intricacies behind the apps we use every day.