2

I am blackboxing an android app to write an API for it. Many of the HTTP requests sent include a mysterious header with the name X-Goog-Spatula. If I do not include this structure, the request is not successful due to 'being unauthenticated', however I can find no information on the internet as to what it is or what it does, and I feel uncomfortable about adding the existing values I've recorded so far to the public client API, because I do not want to ship an API that could either expire in the future, or accidentally expose secrets that I shouldn't. Likewise for the same reason I won't be including actual data here (Unless anyone here can provide good arguments as to why it should be included).

Inspection of the structure so far as concluded that it is a base64-encoded protobuf structure, which contains several mystery values, that are as-yet unknown. An outline of the structure is:

{
  "string": {
    <name of app>,
    <20 byte base64-encoded string>
  },
  "string": {
    <32 byte string>,
  },
  "variant": <9 byte number>,
  "variant": <9 byte number>,
  "string": {
    <89 byte string>
  }
}

As I stated earlier, I can find no references on the internet to it, aside from these (all on Github):

  • This reference to it in google client code in Go.

  • A reference in the Request headers section of people's logged HTTP interactions.

Does anyone have any documentation on this, an idea of what it is, or alternatively, what can I do to find out what it is?

Improve this question
3
  • I have seen some references to this header in the Google Services for Android (e.g. available in the OpenGApps pico package) in detail in the GMSCore. Internally it is some times called a "key-less authentication header".
    – Robert
    Feb 8, 2020 at 13:18
  • While in what I suspect was a near-identical situation to yours a little while ago (re app black-boxing) I crashed into this header. I reached the conclusion that its purpose is in distinguishing "real" Android devices from emulators, and presumably then fingerprinting real devices well enough that "rogue" fingerprints can be reliably exiled to Siberia.
    – i336_
    Feb 10, 2020 at 14:01
  • One of the reasons I gave up was the suspicion that the code generating the key is likely similar to the JavaScript-based interstitial pages you sometimes see generated by certain popular CDNs - such JS code is largely script-generated and has an entire team behind keeping it highly entropic. Couple Java, a very good obfuscation team and probably an even bigger security team and... well, my interest was in making an API too, and these considerations kind of scared me off. (+1 for social psych engineering.) Poke me if you like (see profile) and I can share the small amount of progress I made
    – i336_
    Feb 10, 2020 at 14:05

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.