Complimentary
Install the free app and it hands your phone a set of cloud keys, the same set it hands everyone. They're read-only, but read-only of every guest's contacts, location, and passwords, not just Lambo's. She gave consent. Technically.
easy
To access material, start machines and answer questions login.
Lambo installed the Byte Lotus Wellness app the day she arrived โ it was free, it had great reviews (written by the app, but she didn't check), and it got her a tote bag for saying yes to camera, mic, contacts, and location access. No account needed. No login screen. It justโฆ knows things about you the moment you open it.
That's the whole pitch: โcomplimentaryโ access, no friction, no sign-up. Something still has to be deciding what you're allowed to see, even without a login โ and whatever that something is, it isn't checking very carefully.
Your objective: find out how the app knows anything about you at all, and see what else it's willing to hand over.
"okay wait, the wellness app never once asked me to log in and it STILL knew my name when I opened it ๐ something has to be quietly handing it access behind the scenes... if you find whatever that something is, don't just check what it gives YOU. ask it for more ๐"
What is the flag?
Ready to learn Cyber Security?
TryHackMe provides free online cyber security training to secure jobs & upskill through a fun, interactive learning environment.
Already have an account? Log in