3 ms·
Hardcoding this stuff into your app doesn't make you invulnerable to the attack. One could simply change it using a hex editor.
by TheCoreh 16y ago
Hardcoding this stuff into your app doesn't make you invulnerable to the attack. One could simply change it using a hex editor.
- seanalltogether 16y agoAbsolutely, but hunting and pecking for strings in hexedit is a bit different then opening the info.plist in a text editor.
- blueben 16y agoUntil somebody writes a tool to automate the process and make it single click capable.
- jonhendry 16y agoEspecially if the hardcoded value isn't the strings themselves but a hash derived from them.
- bad_user 16y agoThat would still be security by obscurity.
- pmjordan 16y agoThe only way to protect code running or content playing on an open system is security by obscurity. As a developer, choose your trade-off on the scale between inconvenient-but-quite-secure and simple-but-easy-to-copy and go with it. Any protection will be broken in time. Adjust based on customer feedback and the amount of cracking going on, but that's pretty much all you can do from a technical perspective. NB: at a low enough level, all systems in the hands of the attacker are open. Hardware DRM is vulnerable to attack by equipment for scraping layers of atoms from the silicon and inspecting it with an electron microscope.
- bad_user 16y agoNot all systems, not if you're doing server authentication (itunes account?) / code download every time the app starts (e.g. webapps). That's why DRM is broken by design. All it takes is one skilled individual to develop an easy-to-use method for cracking the thing, start a torrent and that's it, millions of people have access to it instantly.
- pmjordan 16y agoSurely, if the system is server side, then it's not in the hands of the attacker? For webapps, etc. it's not the client side code that's protected, but the server code and data.
- m_eiman 16y agoWould that work with signed binaries?