13 ms·

This was the obvious outcome. People were being willfully blind about how this "hack" works. Using an exfiltrated binary they used its blackbox functions to pe

This was the obvious outcome. People were being willfully blind about how this "hack" works. Using an exfiltrated binary they used its blackbox functions to perform a sort of device attestation using ripped Apple device identifiers. Clearly Apple simply needs to blacklist any device attestation that this service uses, which is obviously trivial. These aren't just RNGs they're fabricating, they're sets of legitimate Apple device data that isn't plainly evident to any random user-mode app. Why would they block it? Every service has some sort of gate on who can message or it will be overrun by bad actors and spammers. Signal, Telegram and others make you validate your cell phone number -- there's a finite number of those, and they can blacklist them as necessary. Online services make you validate an email, do bot checks, etc. Beeper, and more importantly the technique they used, offers none of those gates. It was a plainly problematic free for all that was guaranteed to be closed.

asylteltine 3y ago
This is actually a great point I didn’t originally consider. People could easily infiltrate the iMessage fort with spam and other stuff which at the moment requires a genuine Apple device.
- spullara 3y ago
  I'm pretty sure some of the spam I am getting was using this vector. Hopefully it kills it now.
- ysofunny 3y ago
  that's one of the reasons they're doing this but I don't think it's their main reason, if anything I see that argument as convenient posturing which aids in covering the uglier underlying reasons
- singpolyma3 3y ago
  Still need a valid phone number with a SIM that can do the special SMS needed for this, so it's hardly going to produce a big spam farm too fast.
  - boxed 3y ago
    Better to kill it early. I get spam calls on WhatsApp (an app which I absolutely loathe)
  - asylteltine 3y ago
    It’s completely trivial to get a real number for sms these days thanks to scum like twilio. You can use your legitimate Apple device identifiers to run something like a hackintosh and then use iMessage that way, or use the script linked last week.
- grupthink 3y ago
  Wouldn't your iPhone still receive spam SMS text messages with Apple Messages? And isn't Apple Messages commonly exploited by NSO Group (Zero-clicks)? Maybe I'm wrong, but this does not appear to be very fort-like.
  - rezonant 3y ago
    Yes. I believe people are just saying that they assume unknown-contact SMS is spam and that sort of sounds like Apple's SMS spam filtering isn't very good.
    - dwaite 3y ago
      For iPhone there are two tiers - the carrier provided SMS spam filtering, and apps written to provide such filtering[1]. 1: https://developer.apple.com/documentation/sms_and_call_reporting/sms_and_mms_message_filtering/creating_a_message_filter_app_extension https://developer.apple.com/documentation/sms_and_call_repor...
      - rezonant 3y ago
        Oh, so there's no builtin message filtering at all?? This explains some things. Why wouldn't they just add a spam filter. Is there still iCloud email addresses? Do they have spam filtering?
explaininjs 3y ago
This should have been obvious to anyone who saw the code where it simply contained the raw literal string `FAIRPLAY_PRIVATE_KEY = b64decode(“…”)`. I suppose now we’ll see how accurate the commenter’s claim “if this becomes a problem, I know how to generate new keys” is. https://github.com/JJTech0130/pypush/blob/main/albert.py#L16 https://github.com/JJTech0130/pypush/blob/main/albert.py#L16
- jiggawatts 3y ago
  [flagged]
  - vore 3y ago
    Because "private" here is regarding the cryptography and not regarding the disclosure? How are users supposed to obtain this key to use the service without it being published?
    - jiggawatts 3y ago
      “How can people get into my locked door if I don’t tape a key to it for them to use?” If the private key is public, it does nothing by definition and it may as well not exist! Just use plain text, HTTP, or whatever and stop fooling yourself. It’s like calling an open field a “secure facility”. The name is not the thing, the map is not the territory. Private keys are only private if they’re not public.
      - riwsky 3y ago
        This isn't about taping a key to _your_ front door—you're taping a key to Apple's.
        noirbot 3y ago
        Yea, and like anyone who found out that someone taped the key to their door to their door, they changed the locks, and now everyone's mad at them.
yincrash 3y ago
They had a cloud of Apple devices that they already used for their relay service, and could easily generate keys using several devices. From my understanding, the best vector for Apple was to actually block their "BPN", the push server.
pxeboot 3y ago
And Apple didn't even need to block any device identifiers, just the IPs Beeper Mini was using to connect to the APN service. This could have been blocked in minutes. The delay was likely to get approval from Legal.
- lelandbatey 3y ago
  I think you've got Beeper Mini mixed up with other iMessage bridges. The whole thing with Beeper Mini (vs other iMessage bridges) was that it was entirely client side on the phone, no server to block. So the "IPs Beeper Mini was using to connect to the APN service", those IPs were just the IP addresses of every individual phone with Beeper Mini installed on it, no centralized place to block.
  - kaladin-jasnah 3y ago
    No, the BPN server is a server side service that persistently recieves APNs to forward to the phone (that don't contain the message data) since unlike iPhones, Android phones can't persistently check for APNs (at least that's what I understood from the announcement article). AIUI that's what you're paying for. But that wouldn't explain why sending is broken.
    - rezonant 3y ago
      The How It Works article is clear that BPNs is only used to serve push to your phone when the app isn't running. Disabling it would not cause send/receive failures.
  - pxeboot 3y ago
    If you check the How it Works post, they do show the Beeper Push Notification Service running in the cloud [1] to intercept 'new message available' APNs and then notify the Android device a new message is available. [1] https://blog.beeper.com/p/how-beeper-mini-works https://blog.beeper.com/p/how-beeper-mini-works
    - 3y ago
commandersaki 3y ago
Not disagreeing, but I do not think Beeper Mini used the binary method for registering accounts. I think that was the way to do it for non-mobile devices that couldn't receive SMS, but there is also a way to register an account using SMS which I believe Beeper Mini uses.
- winterqt 3y ago
  I believe that you are correct: https://blog.beeper.com/p/how-beeper-mini-works https://blog.beeper.com/p/how-beeper-mini-works
empyrrhicist 3y ago
Yes, totally understandable that this would be blocked within our legal system... but its a proof of concept that it would not be burdensome for apple to enable interoperability. We should be demanding support for open standards for messaging from mono/duopolists like Apple/Google.
- seanp2k2 3y ago
  Yearly reminder that a long time ago, chat services used XMPP and we were on the verge of having GChat interoperability with FB messages and I think Yahoo or something similar at the time. None of them really wanted to do it for business reasons, so they could “add value” (and charge for it)….same reason RSS has fallen out of favor (no good way to inject ads and tracking). IRC and Matrix still exist.
  - verst 3y ago
    On the Google side the XMPP federation got killed when Google Hangouts and Google+ became the core strategy. The company wanted to focus on "social" (but their own social network) and didn't care about other chat. Back then I worked on the App Engine team which had a XMPP Chat API. When GChat killed XMPP Federation that API lost the majority of target users as a result. I tried to make the case for maintaining XMPP support - taking it up with some VP of Engineering. Alas, nobody cared about the opinion of this random guy in developer support (~2012, early days of Google Cloud)
    - kyrra 3y ago
      You forget that Google was worried about other XMPP services stealing user data. If I remember right, some services (maybe it was FB) was not sending out all data to Google in the federation system (I forget if it was names or friends lists or something). So it would allow other services to ingest data Google was sharing, but the sharing wasn't reciprocal.
  - zaik 3y ago
    Can we make XMPP popular again? We really could need an universal internet standard for IM.
rezonant 3y ago
> Signal, Telegram and others make you validate your cell phone number For what it's worth Beeper Mini did support using Apple's iMessage registration system to use your phone number.
thathndude 3y ago
And there was major hubris from the makers. They were arguing that because it was all totally above board Apple wouldn’t be able to block the service without impairing iMessage entirely. Wrong
- ehsankia 3y ago
  > because it was all totally above board What do you mean by above board? What they claimed is that there is no way of telling Beeper Mini clients from an old iPhone, therefore Apple wouldn't be able to block one without blocking the other. Clearly Apple managed to find a way, and who knows if there will be some more cat and mouse happening here. In theory though, I don't see why it wouldn't be possible to have a service that's indistinguishable from an old iPhone. Newer devices can use device attestation, but old iPhones don't have secure enclave.
namdnay 3y ago
Interestingly enough, there are companies out there making a business of doing this with WhatsApp! I have no idea why Meta isn’t cracking down in it, it seems absolutely insane https://www.telemessage.com/mobile-archiver/whatsapp-archiver/ https://www.telemessage.com/mobile-archiver/whatsapp-archive... It’s literally a hacked WhatsApp binary (that logs all your messages) that they sell to corporate clients…
- password4321 3y ago
  https://twitter.com/LiamCottle/status/1406616490783117322 https://twitter.com/LiamCottle/status/1406616490783117322 Snapchat as a service is no more. But there may be other options: https://github.com/rhunk/SnapEnhance https://github.com/rhunk/SnapEnhance
FriedPickles 3y ago
Can you say more about how Beeper is doing device attestation using ripped Apple device identifiers, or where you discovered that? Device attestation can be extremely user hostile, and if this is a true workaround it will be useful in other applications.
1231232131231 3y ago
Why was everyone here acting like Apple suddenly found a way to kill of Beeper? They released a temporary patch that only temporarily stopped Beeper. It's not going to be this easy, especially when people are being paid to reverse engineer iMessage. It's only a matter of time until that "black box" gets manually deobfuscated. Apple should waste less time on this and instead focus on algorithms that detect and stop spammers.

asylteltine 3y ago

This is actually a great point I didn’t originally consider. People could easily infiltrate the iMessage fort with spam and other stuff which at the moment requires a genuine Apple device.

spullara 3y ago
I'm pretty sure some of the spam I am getting was using this vector. Hopefully it kills it now.
ysofunny 3y ago
that's one of the reasons they're doing this but I don't think it's their main reason, if anything I see that argument as convenient posturing which aids in covering the uglier underlying reasons
singpolyma3 3y ago
Still need a valid phone number with a SIM that can do the special SMS needed for this, so it's hardly going to produce a big spam farm too fast.
- boxed 3y ago
  Better to kill it early. I get spam calls on WhatsApp (an app which I absolutely loathe)
- asylteltine 3y ago
  It’s completely trivial to get a real number for sms these days thanks to scum like twilio. You can use your legitimate Apple device identifiers to run something like a hackintosh and then use iMessage that way, or use the script linked last week.
grupthink 3y ago
Wouldn't your iPhone still receive spam SMS text messages with Apple Messages? And isn't Apple Messages commonly exploited by NSO Group (Zero-clicks)? Maybe I'm wrong, but this does not appear to be very fort-like.
- rezonant 3y ago
  Yes. I believe people are just saying that they assume unknown-contact SMS is spam and that sort of sounds like Apple's SMS spam filtering isn't very good.
  - dwaite 3y ago
    For iPhone there are two tiers - the carrier provided SMS spam filtering, and apps written to provide such filtering[1]. 1: https://developer.apple.com/documentation/sms_and_call_reporting/sms_and_mms_message_filtering/creating_a_message_filter_app_extension https://developer.apple.com/documentation/sms_and_call_repor...
    - rezonant 3y ago
      Oh, so there's no builtin message filtering at all?? This explains some things. Why wouldn't they just add a spam filter. Is there still iCloud email addresses? Do they have spam filtering?

explaininjs 3y ago

This should have been obvious to anyone who saw the code where it simply contained the raw literal string `FAIRPLAY_PRIVATE_KEY = b64decode(“…”)`. I suppose now we’ll see how accurate the commenter’s claim “if this becomes a problem, I know how to generate new keys” is. https://github.com/JJTech0130/pypush/blob/main/albert.py#L16 https://github.com/JJTech0130/pypush/blob/main/albert.py#L16

jiggawatts 3y ago
[flagged]
- vore 3y ago
  Because "private" here is regarding the cryptography and not regarding the disclosure? How are users supposed to obtain this key to use the service without it being published?
  - jiggawatts 3y ago
    “How can people get into my locked door if I don’t tape a key to it for them to use?” If the private key is public, it does nothing by definition and it may as well not exist! Just use plain text, HTTP, or whatever and stop fooling yourself. It’s like calling an open field a “secure facility”. The name is not the thing, the map is not the territory. Private keys are only private if they’re not public.
    - riwsky 3y ago
      This isn't about taping a key to _your_ front door—you're taping a key to Apple's.
      - noirbot 3y ago
        Yea, and like anyone who found out that someone taped the key to their door to their door, they changed the locks, and now everyone's mad at them.

yincrash 3y ago

They had a cloud of Apple devices that they already used for their relay service, and could easily generate keys using several devices. From my understanding, the best vector for Apple was to actually block their "BPN", the push server.

pxeboot 3y ago

And Apple didn't even need to block any device identifiers, just the IPs Beeper Mini was using to connect to the APN service. This could have been blocked in minutes. The delay was likely to get approval from Legal.

lelandbatey 3y ago
I think you've got Beeper Mini mixed up with other iMessage bridges. The whole thing with Beeper Mini (vs other iMessage bridges) was that it was entirely client side on the phone, no server to block. So the "IPs Beeper Mini was using to connect to the APN service", those IPs were just the IP addresses of every individual phone with Beeper Mini installed on it, no centralized place to block.
- kaladin-jasnah 3y ago
  No, the BPN server is a server side service that persistently recieves APNs to forward to the phone (that don't contain the message data) since unlike iPhones, Android phones can't persistently check for APNs (at least that's what I understood from the announcement article). AIUI that's what you're paying for. But that wouldn't explain why sending is broken.
  - rezonant 3y ago
    The How It Works article is clear that BPNs is only used to serve push to your phone when the app isn't running. Disabling it would not cause send/receive failures.
- pxeboot 3y ago
  If you check the How it Works post, they do show the Beeper Push Notification Service running in the cloud [1] to intercept 'new message available' APNs and then notify the Android device a new message is available. [1] https://blog.beeper.com/p/how-beeper-mini-works https://blog.beeper.com/p/how-beeper-mini-works
  - 3y ago

commandersaki 3y ago

Not disagreeing, but I do not think Beeper Mini used the binary method for registering accounts. I think that was the way to do it for non-mobile devices that couldn't receive SMS, but there is also a way to register an account using SMS which I believe Beeper Mini uses.

winterqt 3y ago
I believe that you are correct: https://blog.beeper.com/p/how-beeper-mini-works https://blog.beeper.com/p/how-beeper-mini-works

empyrrhicist 3y ago

Yes, totally understandable that this would be blocked within our legal system... but its a proof of concept that it would not be burdensome for apple to enable interoperability. We should be demanding support for open standards for messaging from mono/duopolists like Apple/Google.

seanp2k2 3y ago
Yearly reminder that a long time ago, chat services used XMPP and we were on the verge of having GChat interoperability with FB messages and I think Yahoo or something similar at the time. None of them really wanted to do it for business reasons, so they could “add value” (and charge for it)….same reason RSS has fallen out of favor (no good way to inject ads and tracking). IRC and Matrix still exist.
- verst 3y ago
  On the Google side the XMPP federation got killed when Google Hangouts and Google+ became the core strategy. The company wanted to focus on "social" (but their own social network) and didn't care about other chat. Back then I worked on the App Engine team which had a XMPP Chat API. When GChat killed XMPP Federation that API lost the majority of target users as a result. I tried to make the case for maintaining XMPP support - taking it up with some VP of Engineering. Alas, nobody cared about the opinion of this random guy in developer support (~2012, early days of Google Cloud)
  - kyrra 3y ago
    You forget that Google was worried about other XMPP services stealing user data. If I remember right, some services (maybe it was FB) was not sending out all data to Google in the federation system (I forget if it was names or friends lists or something). So it would allow other services to ingest data Google was sharing, but the sharing wasn't reciprocal.
- zaik 3y ago
  Can we make XMPP popular again? We really could need an universal internet standard for IM.

rezonant 3y ago

> Signal, Telegram and others make you validate your cell phone number For what it's worth Beeper Mini did support using Apple's iMessage registration system to use your phone number.

thathndude 3y ago

And there was major hubris from the makers. They were arguing that because it was all totally above board Apple wouldn’t be able to block the service without impairing iMessage entirely. Wrong

ehsankia 3y ago
> because it was all totally above board What do you mean by above board? What they claimed is that there is no way of telling Beeper Mini clients from an old iPhone, therefore Apple wouldn't be able to block one without blocking the other. Clearly Apple managed to find a way, and who knows if there will be some more cat and mouse happening here. In theory though, I don't see why it wouldn't be possible to have a service that's indistinguishable from an old iPhone. Newer devices can use device attestation, but old iPhones don't have secure enclave.

namdnay 3y ago

Interestingly enough, there are companies out there making a business of doing this with WhatsApp! I have no idea why Meta isn’t cracking down in it, it seems absolutely insane https://www.telemessage.com/mobile-archiver/whatsapp-archiver/ https://www.telemessage.com/mobile-archiver/whatsapp-archive... It’s literally a hacked WhatsApp binary (that logs all your messages) that they sell to corporate clients…

password4321 3y ago
https://twitter.com/LiamCottle/status/1406616490783117322 https://twitter.com/LiamCottle/status/1406616490783117322 Snapchat as a service is no more. But there may be other options: https://github.com/rhunk/SnapEnhance https://github.com/rhunk/SnapEnhance

FriedPickles 3y ago

Can you say more about how Beeper is doing device attestation using ripped Apple device identifiers, or where you discovered that? Device attestation can be extremely user hostile, and if this is a true workaround it will be useful in other applications.

1231232131231 3y ago

Why was everyone here acting like Apple suddenly found a way to kill of Beeper? They released a temporary patch that only temporarily stopped Beeper. It's not going to be this easy, especially when people are being paid to reverse engineer iMessage. It's only a matter of time until that "black box" gets manually deobfuscated. Apple should waste less time on this and instead focus on algorithms that detect and stop spammers.