Vending machines at my workplace got recently changed and the new ones support an hybrid NFC\BT system to pay through a dedicated application.
Looking for online, I found some articles about this app being cracked and how it was done. Being several months later, I expected some new security measure to have been added so I decided to have a try and see if I could bypass them and repeat the process.
Original crack consisted of manually changing the data stored locally on a DB with a weak password, but since I don't have a rooted phone and I have found traces of HTTPS requests being performed with checks on consistency on the credit, I decided to go another way.
Assumin vending machines do not connect online, I changed all the references to the remote REST endpoint (plain string constants) with a server of my own and I have successfully been able to login (or at least, make the app believe I logged in).
Now, assuming I fill the gaps and will be able to successfully buy stuff, is all this worth sharing with the developer, to have them take further security measures? Is there something serious they could do that would not require completely changing the infrastructure?