There are two passwords in this APK, what are they?
Can you change them?
Can you make them longer?
Can you remove the need for each password completely, so it will accept any password?
Provide a modified APK that implements any of your findings.
What can be done prevent these types of attacks?