A Hardened App's One Fatal Flaw: Token Verification Anchored to a Spoofable android_id
How a heavily hardened app's VIP token fell apart: its server-side verification was anchored to a spoofable android_id, so rotating the device ID mints unlimited fresh tokens.