5 ms·

Mac app store hacked, how developers can better protect themselves

swivelmaster 16y ago
I would argue that the target audience of the app store isn't tech-savvy enough to do this anyway. Sure, it's easy to HN readers, but to the general public it probably "sounds too hard."
- uptown 16y ago
  The target audience of what? The app store? Each app? In Apple's eyes, their target audience is the entire computing population ... and it's not a stretch to think that an exploit like this will be simplified for the masses now that it's been identified.
- w1ntermute 16y ago
  > I would argue that the target audience of the app store isn't tech-savvy enough to do this anyway. That's what people said about piracy on the iPhone, but I know plenty of non-tech savvy people who use Cydia or whatever to get free apps.
  - lukeschlather 16y ago
    The clunkiness of the iOS store has to play at least a part. Compared to using a music player on your computer, Cydia is a pretty user-friendly and elegant way to install applications.
    - meat-eater 16y ago
      I'm not sure if I misunderstood your comment. But as far as I know most iOS users install apps using the app store built into the device. It's really not much different, if not more polished than the cydia store. I think the real reason for the popularity of cydia is that 1) it has a user friendly UI 2) you can get apps on it that will not make it to the app store and 3) some people are just too cheap to pay for some apps and use it to pirate them
- alex_c 16y ago
  You'd be surprised what lengths people will go to just to get some free stuff.
- jsz0 16y ago
  I'm sure Apple will tighten it up a bit but if it stops casual piracy that's probably good enough. More sophisticated and invasive DRM schemes don't stop people anyway. It's a waste of time to go much further than "keeping the honest people honest" style protections.
- joakin 16y ago
  This is true, but somebody will do a program to automatize and all this non tech-savvy will install it and use it. It always happens the same...
TheCoreh 16y ago
Hardcoding this stuff into your app doesn't make you invulnerable to the attack. One could simply change it using a hex editor.
- seanalltogether 16y ago
  Absolutely, but hunting and pecking for strings in hexedit is a bit different then opening the info.plist in a text editor.
  - blueben 16y ago
    Until somebody writes a tool to automate the process and make it single click capable.
  - jonhendry 16y ago
    Especially if the hardcoded value isn't the strings themselves but a hash derived from them.
    - bad_user 16y ago
      That would still be security by obscurity.
      - pmjordan 16y ago
        The only way to protect code running or content playing on an open system is security by obscurity. As a developer, choose your trade-off on the scale between inconvenient-but-quite-secure and simple-but-easy-to-copy and go with it. Any protection will be broken in time. Adjust based on customer feedback and the amount of cracking going on, but that's pretty much all you can do from a technical perspective. NB: at a low enough level, all systems in the hands of the attacker are open. Hardware DRM is vulnerable to attack by equipment for scraping layers of atoms from the silicon and inspecting it with an electron microscope.
        16y ago
deleted 16y ago
[deleted]
dshjtykyu 16y ago
●---------------------------------------● ●------ http://goo.gl/l5v0b http://goo.gl/l5v0b ------● ●------ http://goo.gl/l5v0b http://goo.gl/l5v0b ------● ●------ http://goo.gl/l5v0b http://goo.gl/l5v0b ------● ●------ http://goo.gl/l5v0b http://goo.gl/l5v0b ------● ●------ http://goo.gl/l5v0b http://goo.gl/l5v0b ------● ●------ http://goo.gl/l5v0b http://goo.gl/l5v0b ------● ●------ http://goo.gl/l5v0b http://goo.gl/l5v0b ------● ●------ http://goo.gl/l5v0b http://goo.gl/l5v0b ------● ●------ http://goo.gl/l5v0b http://goo.gl/l5v0b ------● ●------ http://goo.gl/l5v0b http://goo.gl/l5v0b ------● ●------ http://goo.gl/l5v0b http://goo.gl/l5v0b ------● ●------ http://goo.gl/l5v0b http://goo.gl/l5v0b ------● ●------ http://goo.gl/l5v0b http://goo.gl/l5v0b ------● ●------ http://goo.gl/l5v0b http://goo.gl/l5v0b ------● ●------ http://goo.gl/l5v0b http://goo.gl/l5v0b ------● ●------ http://goo.gl/l5v0b http://goo.gl/l5v0b ------● ●------ http://goo.gl/l5v0b http://goo.gl/l5v0b ------● ●------ http://goo.gl/l5v0b http://goo.gl/l5v0b ------● ●---------------------------------------●
dholowiski 16y ago
Wow, that's... Trivial. Does that really work? It's almost like apple wanted to have this happen.
- ptomato 16y ago
  It works on apps that haven't implemented the DRM correctly, yes. Not on most.
jonhendry 16y ago
Headline is a bit misleading. The Mac App Store wasn't hacked; that implies some tampering with the servers. What's happened is that some developers haven't fully implemented scrupulous receipt checks, which weakens the DRM considerably.

I would argue that the target audience of the app store isn't tech-savvy enough to do this anyway. Sure, it's easy to HN readers, but to the general public it probably "sounds too hard."

uptown 16y ago
The target audience of what? The app store? Each app? In Apple's eyes, their target audience is the entire computing population ... and it's not a stretch to think that an exploit like this will be simplified for the masses now that it's been identified.
w1ntermute 16y ago
> I would argue that the target audience of the app store isn't tech-savvy enough to do this anyway. That's what people said about piracy on the iPhone, but I know plenty of non-tech savvy people who use Cydia or whatever to get free apps.
- lukeschlather 16y ago
  The clunkiness of the iOS store has to play at least a part. Compared to using a music player on your computer, Cydia is a pretty user-friendly and elegant way to install applications.
  - meat-eater 16y ago
    I'm not sure if I misunderstood your comment. But as far as I know most iOS users install apps using the app store built into the device. It's really not much different, if not more polished than the cydia store. I think the real reason for the popularity of cydia is that 1) it has a user friendly UI 2) you can get apps on it that will not make it to the app store and 3) some people are just too cheap to pay for some apps and use it to pirate them
alex_c 16y ago
You'd be surprised what lengths people will go to just to get some free stuff.
jsz0 16y ago
I'm sure Apple will tighten it up a bit but if it stops casual piracy that's probably good enough. More sophisticated and invasive DRM schemes don't stop people anyway. It's a waste of time to go much further than "keeping the honest people honest" style protections.
joakin 16y ago
This is true, but somebody will do a program to automatize and all this non tech-savvy will install it and use it. It always happens the same...

TheCoreh 16y ago

Hardcoding this stuff into your app doesn't make you invulnerable to the attack. One could simply change it using a hex editor.

seanalltogether 16y ago
Absolutely, but hunting and pecking for strings in hexedit is a bit different then opening the info.plist in a text editor.
- blueben 16y ago
  Until somebody writes a tool to automate the process and make it single click capable.
- jonhendry 16y ago
  Especially if the hardcoded value isn't the strings themselves but a hash derived from them.
  - bad_user 16y ago
    That would still be security by obscurity.
    - pmjordan 16y ago
      The only way to protect code running or content playing on an open system is security by obscurity. As a developer, choose your trade-off on the scale between inconvenient-but-quite-secure and simple-but-easy-to-copy and go with it. Any protection will be broken in time. Adjust based on customer feedback and the amount of cracking going on, but that's pretty much all you can do from a technical perspective. NB: at a low enough level, all systems in the hands of the attacker are open. Hardware DRM is vulnerable to attack by equipment for scraping layers of atoms from the silicon and inspecting it with an electron microscope.
      - 16y ago

deleted 16y ago

[deleted]

dshjtykyu 16y ago

●---------------------------------------● ●------ http://goo.gl/l5v0b http://goo.gl/l5v0b ------● ●------ http://goo.gl/l5v0b http://goo.gl/l5v0b ------● ●------ http://goo.gl/l5v0b http://goo.gl/l5v0b ------● ●------ http://goo.gl/l5v0b http://goo.gl/l5v0b ------● ●------ http://goo.gl/l5v0b http://goo.gl/l5v0b ------● ●------ http://goo.gl/l5v0b http://goo.gl/l5v0b ------● ●------ http://goo.gl/l5v0b http://goo.gl/l5v0b ------● ●------ http://goo.gl/l5v0b http://goo.gl/l5v0b ------● ●------ http://goo.gl/l5v0b http://goo.gl/l5v0b ------● ●------ http://goo.gl/l5v0b http://goo.gl/l5v0b ------● ●------ http://goo.gl/l5v0b http://goo.gl/l5v0b ------● ●------ http://goo.gl/l5v0b http://goo.gl/l5v0b ------● ●------ http://goo.gl/l5v0b http://goo.gl/l5v0b ------● ●------ http://goo.gl/l5v0b http://goo.gl/l5v0b ------● ●------ http://goo.gl/l5v0b http://goo.gl/l5v0b ------● ●------ http://goo.gl/l5v0b http://goo.gl/l5v0b ------● ●------ http://goo.gl/l5v0b http://goo.gl/l5v0b ------● ●------ http://goo.gl/l5v0b http://goo.gl/l5v0b ------● ●---------------------------------------●

dholowiski 16y ago

Wow, that's... Trivial. Does that really work? It's almost like apple wanted to have this happen.

ptomato 16y ago
It works on apps that haven't implemented the DRM correctly, yes. Not on most.

jonhendry 16y ago

Headline is a bit misleading. The Mac App Store wasn't hacked; that implies some tampering with the servers. What's happened is that some developers haven't fully implemented scrupulous receipt checks, which weakens the DRM considerably.