VeroCafe insecure mobile application.

Tech details

VeroCafe Android application based on DeliveryMobile.ru platform contains multiple vulnerabilities. Also, the platform service is provided and hosted by a russian federation owned company which is a big reputational risk.

About Vero Cafe

VeroCafe is a network of coffee shops in Lithuania (operated by "UAB Ex prompto", company ID 301127637). Last year VeroCafe released a mobile application which is used as a loyalty card, allowing users to register and get discounts.

Backend service - deliverymobile.ru

The app's UI is made on the Xamarin framework. The backend communication is done over https://servereu.deliverymobile.ru, ex:


Google Play identifies the developer of the app as "DELIVERYmobile, LLC" and "RISElogic". Listing other apps of the same developer shows a list of a hundred other food delivery applications mostly in russia, but also some in Lithuania.

Service provided by a state sponsor of terrorism

In 2014 russian federation invaded Ukraine, annexed part of its territory and continued supporting hybrid attack. In 2022 it invaded Ukraine and started a full scale war. And the war is still ongoing killing thousands of people.

During the 2022 russian invasion of Ukraine, russian authorities and armed forces committed multiple war crimes in the form of deliberate attacks against civilian targets, massacres of civilians, torture and rape of women and children, and indiscriminate attacks in densely populated areas:


EU declared russian federation a state sponsor of terrorism:


FullDisclosure team and our partners support Ukraine. We are not going to report any vulnerabilities found to DeliveryMobile. We also encourage Lithuanian coffee lovers to stop using VeroCafe because of their ties with a state sponsor of terrorism.

Service credentials leaked

Here are some credentials that VeroCafe app leaked:

      "email": "order@deliverymobile.ru",
      "user": "order@deliverymobile.ru",
      "pass": "XdSaBuv6891Idog5ScHidik36CedThu9",
      "host": "mail.deliverymobile.ru",
      "port": 10025,
      "ssl": false
      "email": "deliverymobile.order@gmail.com",
      "user": "deliverymobile.order@gmail.com",
      "pass": "krbxtxuxvcsaqrwz",
      "host": "smtp.gmail.com",
      "port": 587,
      "ssl": true
      "email": "deliverymobile.order@yandex.ru",
      "user": "deliverymobile.order@yandex.ru",
      "pass": "btgmurqznoqickwf",
      "host": "smtp.yandex.ru",
      "port": 587,
      "ssl": true
      "email": "deliverymobile.order@mail.ru",
      "user": "deliverymobile.order@mail.ru",
      "pass": "socucifddlhgoedb",
      "host": "smtp.mail.ru",
      "port": 587,
      "ssl": true
      "email": "deliverymobile.order@hotmail.com",
      "user": "deliverymobile.order@hotmail.com",
      "pass": "wiqfsatyfgrgasfz",
      "host": "smtp-mail.outlook.com",
      "port": 587,
      "ssl": true


2022-11-23 - initial research
2022-11-29 - contacted Verocafe regarding the findings. No response
2023-01-26 - full disclosure