Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cracking Siri

applidium.com

Post reply on HN
Print view View original

81–90 of 105 posts

Re: Cracking Siri

#81

Post by nitrogen »

planb wrote: post #35
pflats wrote: post #28

Earlier quoted context omitted.

Did you read the article? When the proxy failed, they "ressorted (sic) to using tcpdump on a network gateway". They eventually had to "setup a custom SSL certification authority, add it to our iPhone 4S, and use it to sign our very own certificate"

I have read that, but they used tcpdump only to detect what kind of traffic Siri sends after failing to use a normal HTTP proxy. Setting up a custom SSL certification authority is exactly what sshmitm does - but it does not (yet) support transparent proxying. Somehow they have redirected traffic for guzzoni.apple.com to a fake server that acts as a man in the middle (probably simply by using their own DNS), but what…

It's possible to do transparent proxying using iptables on Linux. Also, as ahlatimer mentioned, pointing the phone at your local DNS server and adding records for all the relevant domains would work, too.

Re: Cracking Siri

#82

Post by Volpe »

code_duck wrote: post #66
Volpe wrote: post #54

No one is at all concerned that this is a hack? I know it's interesting stuff, but I'm curious what "rights" Applidium have in publishing this information. With this information, (if I'm not wrong) it wouldn't take long to simply DDoS Siri... Or port Siri to Android (effectively stealing IP). (I have no bias either way, just pointing out, if someone figured out how to reverse engineer dropbox, so you could use their…

> 'No one is at all concerned that this is a hack?' You're asking that on a site called 'Hacker News' if I'm not mistaken. It is indeed a 'hack', a clever and skilled exploration of technology carried out with perfectly good or neutral intent.

That's right, Hacker News is about compromising security and cracking software.... How did I miss that all this time?

My initial post (which has been down voted out of existence) is a valid point.

I don't actually care whether Apple get hacked or not. I was curious what people thought of publishing a 'hack/crack' like this.

Lots of rationalising going on, but to me it still seems wrong. I'd hate people to leverage my work (even for 'personal use') without my permission. Interesting how 'hackers' are happy to hack other peoples stuff, but cry out when it's their own stuff getting hacked.

Re: Cracking Siri

#83

Post by jf »

bodegajed wrote: post #74
modeless wrote: post #57

Earlier quoted context omitted.

Hacks are admired here, not condemned. Reverse engineering should always be allowed. This information doesn't make it possible to DDoS Siri or port it to Android as each request requires a unique iPhone ID; Apple can easily filter out unauthorized requests.

Maybe You admire them. But I don't. Are we going to hack/crack each other's apache servers from now on? Or are we going to build businesses that will solve problems for everyone?

A hacker is "[a] person who delights in having an intimate understanding of the internal workings of a system" and this site is called "Hacker News".

And yes, we are going to help each other improve the security of our systems. If we don't, someone malicious will.

Re: Cracking Siri

#84

Post by philwelch »

zach wrote: post #50
jentulman wrote: post #40

The question that springs to my mind is not 'how can I play with this?' but 'Are Apple bringing Siri to the desktop?', seeing as it appears there's nothing specific to the 4S hardware in how this works. I'd quite like to be able to add calendar entries or tweet without moving to another application.

Apple has clearly had a difficult time keeping up with early demand for Siri services as it is. I think keeping it limited to the 4S looks a lot more like a operational necessity at this time. Given that, If Siri appears on the Mac between major OS releases, I imagine it might be only for new hardware (i.e. a Macbook Air with an exterior Siri button and purple LED) at first as well. Eventually (once they can scale Si…

> an exterior Siri button and purple LED

That's really gross, and exactly the kind of design choice Apple never makes.

Re: Cracking Siri

#85

Post by philwelch »

mkjones wrote: post #75
zach wrote: post #50

Earlier quoted context omitted.

Apple has clearly had a difficult time keeping up with early demand for Siri services as it is. I think keeping it limited to the 4S looks a lot more like a operational necessity at this time. Given that, If Siri appears on the Mac between major OS releases, I imagine it might be only for new hardware (i.e. a Macbook Air with an exterior Siri button and purple LED) at first as well. Eventually (once they can scale Si…

What makes you think thy've had a tough time scaling with early demand? I'd think that this scales horizontally pretty well, given that each request is largely stateless and there's no interaction between users.

> each request is largely stateless

Negative. Siri remembers the context of your conversation.

Re: Cracking Siri

#86

Post by zach »

philwelch wrote: post #84
zach wrote: post #50

Earlier quoted context omitted.

Apple has clearly had a difficult time keeping up with early demand for Siri services as it is. I think keeping it limited to the 4S looks a lot more like a operational necessity at this time. Given that, If Siri appears on the Mac between major OS releases, I imagine it might be only for new hardware (i.e. a Macbook Air with an exterior Siri button and purple LED) at first as well. Eventually (once they can scale Si…

> an exterior Siri button and purple LED That's really gross, and exactly the kind of design choice Apple never makes.

Ha! Very true, I didn't even picture it and indeed I can't. I don't think they would actually put any Siri hardware features on a MacBook in the first place, so I went off the deep end there.

Re: Cracking Siri

#87

Post by zach »

mkjones wrote: post #75
zach wrote: post #50

Earlier quoted context omitted.

Apple has clearly had a difficult time keeping up with early demand for Siri services as it is. I think keeping it limited to the 4S looks a lot more like a operational necessity at this time. Given that, If Siri appears on the Mac between major OS releases, I imagine it might be only for new hardware (i.e. a Macbook Air with an exterior Siri button and purple LED) at first as well. Eventually (once they can scale Si…

What makes you think thy've had a tough time scaling with early demand? I'd think that this scales horizontally pretty well, given that each request is largely stateless and there's no interaction between users.

I'm talking about the Siri outages at peak times, which seem to have subsided for now but indicate that they weren't ready for even the demand they've had.

Re: Cracking Siri

#88

Post by jrockway »

modeless wrote: post #60
Volpe wrote: post #58

Earlier quoted context omitted.

"As a result, we are able to use Siri’s recognition engine from any device. Yes, that means anyone could now write an Android app that uses the real Siri!" Are they just lying then? There demo said they got siri to work with no iphone involved (in the end). Also... DDoS would still be effective, no? (the server still has to 'filter') > Hacks are admired here You sure about that? A lot of China-bashing happens here ba…

They're not lying. Anyone could write an Android app that uses Siri, but it would require the ID from an iPhone to work, so distributing it would be problematic.

Why would that be problematic? You write a server that provides clients with an iPhone ID that hasn't been banned from using Siri yet, and then you make the app contact that server to get the ID.

I'm sure Apple would send a nastygram, but they send nastygrams if you scratch your phone and don't get it repaired quickly enough. There is no law against telling other people your phone's serial number. There is no law against sending an HTTP request to an HTTP server for non-malicious reasons. So really, I don't see much of a legal problem.

Re: Cracking Siri

#89

Post by cstuder »

victoknight wrote: post #5

guess who doesn't verify the root CA. Think of all the fun to be had with a Siri man-in-the-middle

Have a look at the HTTP-proxy software Charles (No affiliation of mine.) In the last question of the FAQ the monitoring of SSL-connections within iPhone-apps is explained: http://www.charlesproxy.com/documentation/faqs/

There is no bug. This is what SSL will do, when you install additional certificates.

(Oh, and it's a fun way to find new web services to play with.) :-)

Re: Cracking Siri

#90

Post by modeless »

jrockway wrote: post #88
modeless wrote: post #60

Earlier quoted context omitted.

They're not lying. Anyone could write an Android app that uses Siri, but it would require the ID from an iPhone to work, so distributing it would be problematic.

Why would that be problematic? You write a server that provides clients with an iPhone ID that hasn't been banned from using Siri yet, and then you make the app contact that server to get the ID. I'm sure Apple would send a nastygram, but they send nastygrams if you scratch your phone and don't get it repaired quickly enough. There is no law against telling other people your phone's serial number. There is no law aga…

Where would you get the valid IDs? You can't share the same ID between very many users, or Apple will ban it. You can't buy an iPhone for every user of your Siri app. iPhone users won't willingly give you their IDs. Are you going to somehow obtain and use the IDs of unsuspecting iPhone users without their permission? That is likely illegal and definitely will get you sued and booted from Android Market.
Post reply on HN