11–16 of 16 posts
Earlier quoted context omitted.
Public key encryption to sign involves encrypting using my own private key. Which would be on the phone, and so any end user could pull it from the device.
So what can you do ? You can't fight the private key retrieval right ?
Isn't the fact that they are using a simple HMAC-SHA256 hash also a root of the problem? If instead of using the POST data only to create the hash they added another information, like a the hour of the day. Wouldn't it be way harder for a hacker to actually understand what went into signing the request?
Is it still the case that the app only uses HTTPS to create a session and plain HTTP for everything else? I remember that was the case about a year ago after using mitmproxy to sniff traffic, although I don't recall HMAC being used to sign requests then. Anyway, I wondered then why nobody had used firesheep to devastating effect, e.g. a bot sitting on an open wifi and posting NSFW images to any account on the network…
Earlier quoted context omitted.
So what can you do ? You can't fight the private key retrieval right ?
Well, you can lock down the device so that the end user doesn't own it, doesn't have root, and can't inspect your binary/data outside of your exposed interface. Which is exactly what iPhones and many Android vendors attempt to do.
I'm sure there are additional techniques to obfuscate the private key, but relying on locked down devices isn't possible in the Android ecosystem. You don't need a device at all to perform the steps outlined in the article.
Earlier quoted context omitted.
So what can you do ? You can't fight the private key retrieval right ?
Nothing. If this article reminds of anything it's that anyone can patch Android apps (and resign them with a new key) to do anything they want.
Earlier quoted context omitted.
So what can you do ? You can't fight the private key retrieval right ?
Well, you can lock down the device so that the end user doesn't own it, doesn't have root, and can't inspect your binary/data outside of your exposed interface. Which is exactly what iPhones and many Android vendors attempt to do.
Indeed you could personalizes the keys for every user. So you could detect a leaked private key that is widely used and proceed against. Still that wouldn't hinder personal further use of that private key, e.g. for exporting data (similar to breaking DRM).