7 ms·

New services bypass Apple DRM to allow pirated installs without jailbreaking

87 points by kmfrk 14y ago

chubs 14y ago
Sounds like they haven't really broken apple's DRM - Zeusmos relies on getting a developer profile for your phone's UDID and re-signing the apps under that dev profile, which means the apps will expire in a year or so. And Kuaiyong relies on an enterprise profile by the looks of it, and i believe apple can remotely nuke enterprise profiles.
- pudquick 14y ago
  > Sounds like they haven't really broken apple's DRM Yes and no. No, in the sense that they are abusing the pay-for Apple developer services in order to get the software pushed to non-jailbroken devices. As such, they are still playing within the DRM system. But in the case of Zeusmos, yes, Apple's DRM (FairPlay) is broken in that "re-signing" involves signing a copy of the (App Store published) commercial app that had its original DRM removed. See here: https://github.com/stefanesser/dumpdecrypted https://github.com/stefanesser/dumpdecrypted These techniques were how tools like Crackulous worked, which allowed for the stealing of iOS App Store apps in the first place.
robryan 14y ago
For the most part, it seems to be people going to a lot of trouble to save a dollar or 2 on app purchases, the type of people that were unlikely to buy anyway. People still aren't able to make arbitrary in app purchases for free? If that is the case piracy might end up making the developer more in the long run.
- ben1040 14y ago
  >the type of people that were unlikely to buy anyway. As someone whose Android app has wound up on some pirate sites, it's not so much the lost revenue I'm worried about. It's the possibility that the version of my app on some Chinese pirate site has been repacked with malware.
  - geofft 14y ago
    Is it time to go back to the early-'90s-shareware model of annoy screens? Release two versions of your app to the app store, one free with a ten second long "you're a bad person" loading screen, and one that costs a bit.
    - Dove 14y ago
      As a consumer, I prefer this style of monetization to in-app purchasing. At least I know what I'm getting and what the reviews mean. Oddly, though, the market doesn't seem to agree with me. Demo/shareware apps just don't seem to do well. Obviously the average consumer and I just don't see eye to eye about something. I have no idea what, though.
    - mikeash 14y ago
      This is extremely common, except that instead of a plain "you should buy this" nag, they put up paid advertisements in the free version.
  - ams6110 14y ago
    I think anyone downloading apps from a Chinese pirate site can expect to get malware sooner or later. I wouldn't be too concerned about it if I were you.
    - Semaphor 14y ago
      Only they don't. People with little knowledge about tech still like to pirate but don't necessarily have a clue what they are doing.
deleted 14y ago
[deleted]
Benferhat 14y ago
As predicted, the Hackulo.us shutdown simply spurred the adoption of more effective software piracy tools. Between Aptoide on Android, which somehow is available via the official app store and also doesn't require rooting/jailbreaking [1], and these new iPhone piracy services, I wonder if we'll start to see changes in the way we approach software monetization. Requiring in-app purchases, for example, is quite effective. [1] https://play.google.com/store/apps/details?id=com.bazaar.installer https://play.google.com/store/apps/details?id=com.bazaar.ins...
- ihuman 14y ago
  Zeusmos has been around before the shutdown, but articles like this are just giving them publicity and pushing them into the light. Zeusmos runs on the apptrackr API, which has also been shutdown, so the shutdown also hurts them.
  - Benferhat 14y ago
    Thanks for the clarity, I'll update my post.
- mtgx 14y ago
  Most apps on both platforms are already free, and the percentage is increasing. Also on both platforms, the highest grossing apps are the free ones (with ads and in-app purchases).
- yareally 14y ago
  Perhaps I am missing something here (correct me if I am), but Android has never needed root privileges to run 3rd party apps. Just have to check off the "unknown sources" box under application settings and any sort of app can be side loaded. I'm just guessing this app is just a way to easily facilitate the download of such apps? If so, then users can install them, but they don't get updates to them on the market (it'll just say invalid license or "you don't own it"). The Android Market is also rather slow to take things down. I've seen MP3 downloader apps that just link to gray area music at best and blatant ripoffs of well known games (such as cut the rope and plants versus zombies) stay listed for months. Eventually they seem to disappear, but then another app pops up in its place.
contingencies 14y ago
Background: 1. Loads of people have iDevices in China. 2. It's hard to get a credit card in China.
- fwr 14y ago
  I'd like to point out that a method of resigning applications for piracy purposes has been around since early 2010, and that Apple doesn't have a history of taking action against services offering adding UDIDs to developer profiles for money.
  - objclxt 14y ago
    > "Apple doesn't have a history of taking action against services offering adding UDIDs to developer profiles for money" They do! I blogged about this a while back, so the links below are for iOS 5, but they have definitely done it in the past. http://appadvice.com/appnn/2011/08/apple-takes-steps-against-developers-selling-ios-5-access-what-you-need-to-know http://appadvice.com/appnn/2011/08/apple-takes-steps-against... http://thenextweb.com/apple/2011/08/05/apple-closes-developer-accounts-for-selling-ios-5-beta-slots/ http://thenextweb.com/apple/2011/08/05/apple-closes-develope... http://osxdaily.com/2011/08/05/udid-activation-and-ios-5-beta-sellers-targeted-by-apple/ http://osxdaily.com/2011/08/05/udid-activation-and-ios-5-bet...
- cynix 14y ago
  > It's hard to get a credit card in China. Are you sure? A lot of "credit cards" in China are actually debit cards, where you must deposit money in your account up-front before you can spend. I don't see any reason why banks would make it hard for people to get these, since there's virtually no risk of bad debt.
  - contingencies 14y ago
    It's probably largely just historical inertia. However, there are also potentially strong reasons to avoid it. 1. China dissuades capital exodus. (They actually have a whole government bureau for this, the Foreign Exchange Management Bureau or 'waihuiguanliju') 2. My recent travels about Southeast Asia suggest that the government-run centralized interbank settlement network 'China Union Pay', is being supported by the government as a regional alternative to the de-facto global defaults Cirrus/Maestro (Mastercard) and Visa (Bank of America). Anyway, the why doesn't matter. It's really the situation.
beedogs 14y ago
DRM is such an utter and absolute waste of effort and money. Think of the millions of man-hours that have so far been misallocated on trying to "secure" digital content. It's just sad.
- arrrg 14y ago
  Eh, I think DRM has been pretty effective for Apple so far, still is, even with this. Pirating iOS apps is very uncomfortable, uncomfortable enough that those who can (i.e. those who have a credit card and are not completely broke) will in general buy, not pirate. I mean, even their gift card distribution is now so effective (you can buy them everywhere you go) that even without a credit card, the app store is pretty damn comfortable – so even kids are not necessarily forced to pirate.
  - bo1024 14y ago
    But the fact that pirating is uncomfortable does not constitute an argument that Apple has been better off with DRM than it would be without.
    - arrrg 14y ago
      The DRM makes pirating less comfortable. If you could just go to some website and download the app and drag it into iTunes to get it on your device (that’s what dropping DRM entails) pirating on iOS would be very comfortable, probably on a level with using the App Store.
      - bo1024 14y ago
        Go on?
        arrrg 14y ago
        Consequently, people pirate less. That’s speculation, sure, but I haven’t heard anyone offer anything better.
seanalltogether 14y ago
Maybe its time Apple and Google start providing receipts that devs can validate themselves. Apple already provides this on OSX and it makes it hard to mass pirate all apps.
mikeash 14y ago
It makes me sad that these get used for piracy. They could be extremely useful by allowing widespread installation of apps that Apple won't accept in their store, but instead we get another lame piracy service that people will point to as evidence that Apple's walled garden approach is a good thing.
- duairc 14y ago
  But piracy is a feature. It's good thing. Paying for stuff sucks. From a user's point of view, if Apple's walled garden approach prevents piracy, then that's just another reason their walled garden approach is bad. Edit: I'm not even playing devil's advocate here, this is just honestly what I think, and I think what most people honestly think. Stuff is better when you don't have to pay for it.
  - cynicalkane 14y ago
    From a user's point of view, if walled gardens help support app devs making more apps, and those apps are worth more than the $1.99 or however much they cost, this is a net gain.
  - artursapek 14y ago
    I'm guessing you're not a developer for a living.
    - duairc 14y ago
      No. I have developed (free) software in the past, and I've contributed to larger projects as well, but I don't have as much time for programming anymore. I "make" a living through a combination of squatting, dumpster diving and occasionally theft (only from bad people though).
      - artursapek 14y ago
        From what you're writing in this thread it sounds like you were born in the wrong millenium.
kgarten 14y ago
Sorry, but am I the only one who dislikes the picture they used for the post. The flag of the pirate party has nothing to do with iPhone software piracy websites ...
- Semaphor 14y ago
  Random stock image for an article that calls piracy stealing. They do know how to lower the expections for their article.
- Semaphor 14y ago
  They changed it now. Still has "stealing" though, maybe someone should send them a dictionary.
chj 14y ago
On one hand this could be a great alternative distribution channel, on the other hand developers get nothing and another risk is Apple can shut their accounts down at any time.
fabm 14y ago
The Zeusmos site is "currently undergoing some maintenance". Looks like someone is getting shut down.
saurik 14y ago
I think it should be made very clear, in the context of Hacker News, that one of the primary reasons that these sites have been operating as long as they have is because of support from Stripe, who handled their payment processing. The developer of this program keeps opening PayPal accounts, and PayPal keeps shutting them down. In just December, this developer got two PayPal accounts shut down; the latest one was only used for four days before it was whacked. Dec 24: "PayPal is back online for http://zeusmos.com http://zeusmos.com and http://uhelios.com http://uhelios.com – Happy Holidays everybody!" -- https://twitter.com/uhelios/status/283260362919395328 https://twitter.com/uhelios/status/283260362919395328 Dec 28: "I'm absolutely done with PayPal. This is ridiculous." -- https://twitter.com/uhelios/status/284654128339243009 https://twitter.com/uhelios/status/284654128339243009 However, despite careful and detailed explanations to Stripe--and despite them saying they would look into the matter--this website has been operating and taking payments using their payment processing system for months. Also, while the developer of Zeusmos claims in the "update" to the article that his application was never supposed to encourage piracy, it came by default with its search results coming from a website called AppTrackr, a large repository of cracked applications. In the last few months, the developer decided he wanted to "stray away from AppTrackr", but the result was not to move further from piracy: it was to become less reliant on that one piracy site and instead use another one called AppCake. Meanwhile, the developer has often compared his service to Installous, saying on his Twitter account that "its somewhat like Installous, but better"[1] and that it "has many features that Installous does not excel at very well"[2]. [1]: https://twitter.com/uhelios/status/274859392812318720 https://twitter.com/uhelios/status/274859392812318720 [2]: https://twitter.com/uhelios/status/239863143793324032 https://twitter.com/uhelios/status/239863143793324032
- nathanhammond 14y ago
  With your rather unique experience of running the Cydia Store on jailbroken iOS devices can you provide more information on the process loopholes these approaches (Zeusmos and Kuaiyong) are exploiting?
  - saurik 14y ago
    In order to deploy code (without jailbreaking), you need to have it signed by a certificate that is valid for the device you are using. With a normal developer account, you can provision certificates for up to 100 devices. Signing an application is fairly simple (I implement most of the intricate pieces in an open-source program called ldid, but do not do the official signature parts). Putting this together: you simply get paid developer accounts from Apple (you will need to keep getting more of these, as you will run up against the 100 device limit), ignore the part of the contract you sign that states that you are not allowed to redistribute the certificates they give you, and instead automate a process to log in to Apple's portal, add a UDID to your account, and download an updated provisioning certificate. Connect this up with a payment processor that is willing to look the other way and an app that is capable of doing the signature process for apps locally for the user, and you are done. The device is already capable of installing certificates and applications that are signed by them from websites (see Test Flight for a commonly-used legitimate example), so the final steps are easy. (With an Enterprise account, you don't have to worry about the number of devices; however, the contract terms are much stricter, the system has more mechanisms for Apple to turn you off, and Apple will probably care more if you attempt to abuse it. In essence, an app signed by an Enterprise certificate can be installed on any device, anywhere, at any time until the certificate's three-year expiration date hits.)
Permit 14y ago
Wow, it's certainly interesting to see how the consensus on Piracy changes on HackerNews when it's iOS apps and not music/media that's being downloaded. The article even goes so far as to call it stealing and not one person has piped up to point out that they're merely copying bytes, not removing utility from anyone else. The PirateBay receives a lot of support when it's mentioned here. I imagine if I opened a "PirateBayForApps" on which I carried both legitimately free apps and pirated apps, I might not receive the same support.

87 points by kmfrk 14y ago

chubs 14y ago

Sounds like they haven't really broken apple's DRM - Zeusmos relies on getting a developer profile for your phone's UDID and re-signing the apps under that dev profile, which means the apps will expire in a year or so. And Kuaiyong relies on an enterprise profile by the looks of it, and i believe apple can remotely nuke enterprise profiles.

pudquick 14y ago
> Sounds like they haven't really broken apple's DRM Yes and no. No, in the sense that they are abusing the pay-for Apple developer services in order to get the software pushed to non-jailbroken devices. As such, they are still playing within the DRM system. But in the case of Zeusmos, yes, Apple's DRM (FairPlay) is broken in that "re-signing" involves signing a copy of the (App Store published) commercial app that had its original DRM removed. See here: https://github.com/stefanesser/dumpdecrypted https://github.com/stefanesser/dumpdecrypted These techniques were how tools like Crackulous worked, which allowed for the stealing of iOS App Store apps in the first place.

robryan 14y ago

For the most part, it seems to be people going to a lot of trouble to save a dollar or 2 on app purchases, the type of people that were unlikely to buy anyway. People still aren't able to make arbitrary in app purchases for free? If that is the case piracy might end up making the developer more in the long run.

ben1040 14y ago
>the type of people that were unlikely to buy anyway. As someone whose Android app has wound up on some pirate sites, it's not so much the lost revenue I'm worried about. It's the possibility that the version of my app on some Chinese pirate site has been repacked with malware.
- geofft 14y ago
  Is it time to go back to the early-'90s-shareware model of annoy screens? Release two versions of your app to the app store, one free with a ten second long "you're a bad person" loading screen, and one that costs a bit.
  - Dove 14y ago
    As a consumer, I prefer this style of monetization to in-app purchasing. At least I know what I'm getting and what the reviews mean. Oddly, though, the market doesn't seem to agree with me. Demo/shareware apps just don't seem to do well. Obviously the average consumer and I just don't see eye to eye about something. I have no idea what, though.
  - mikeash 14y ago
    This is extremely common, except that instead of a plain "you should buy this" nag, they put up paid advertisements in the free version.
- ams6110 14y ago
  I think anyone downloading apps from a Chinese pirate site can expect to get malware sooner or later. I wouldn't be too concerned about it if I were you.
  - Semaphor 14y ago
    Only they don't. People with little knowledge about tech still like to pirate but don't necessarily have a clue what they are doing.

deleted 14y ago

[deleted]

Benferhat 14y ago

As predicted, the Hackulo.us shutdown simply spurred the adoption of more effective software piracy tools. Between Aptoide on Android, which somehow is available via the official app store and also doesn't require rooting/jailbreaking [1], and these new iPhone piracy services, I wonder if we'll start to see changes in the way we approach software monetization. Requiring in-app purchases, for example, is quite effective. [1] https://play.google.com/store/apps/details?id=com.bazaar.installer https://play.google.com/store/apps/details?id=com.bazaar.ins...

ihuman 14y ago
Zeusmos has been around before the shutdown, but articles like this are just giving them publicity and pushing them into the light. Zeusmos runs on the apptrackr API, which has also been shutdown, so the shutdown also hurts them.
- Benferhat 14y ago
  Thanks for the clarity, I'll update my post.
mtgx 14y ago
Most apps on both platforms are already free, and the percentage is increasing. Also on both platforms, the highest grossing apps are the free ones (with ads and in-app purchases).
yareally 14y ago
Perhaps I am missing something here (correct me if I am), but Android has never needed root privileges to run 3rd party apps. Just have to check off the "unknown sources" box under application settings and any sort of app can be side loaded. I'm just guessing this app is just a way to easily facilitate the download of such apps? If so, then users can install them, but they don't get updates to them on the market (it'll just say invalid license or "you don't own it"). The Android Market is also rather slow to take things down. I've seen MP3 downloader apps that just link to gray area music at best and blatant ripoffs of well known games (such as cut the rope and plants versus zombies) stay listed for months. Eventually they seem to disappear, but then another app pops up in its place.

contingencies 14y ago

Background: 1. Loads of people have iDevices in China. 2. It's hard to get a credit card in China.

fwr 14y ago
I'd like to point out that a method of resigning applications for piracy purposes has been around since early 2010, and that Apple doesn't have a history of taking action against services offering adding UDIDs to developer profiles for money.
- objclxt 14y ago
  > "Apple doesn't have a history of taking action against services offering adding UDIDs to developer profiles for money" They do! I blogged about this a while back, so the links below are for iOS 5, but they have definitely done it in the past. http://appadvice.com/appnn/2011/08/apple-takes-steps-against-developers-selling-ios-5-access-what-you-need-to-know http://appadvice.com/appnn/2011/08/apple-takes-steps-against... http://thenextweb.com/apple/2011/08/05/apple-closes-developer-accounts-for-selling-ios-5-beta-slots/ http://thenextweb.com/apple/2011/08/05/apple-closes-develope... http://osxdaily.com/2011/08/05/udid-activation-and-ios-5-beta-sellers-targeted-by-apple/ http://osxdaily.com/2011/08/05/udid-activation-and-ios-5-bet...
cynix 14y ago
> It's hard to get a credit card in China. Are you sure? A lot of "credit cards" in China are actually debit cards, where you must deposit money in your account up-front before you can spend. I don't see any reason why banks would make it hard for people to get these, since there's virtually no risk of bad debt.
- contingencies 14y ago
  It's probably largely just historical inertia. However, there are also potentially strong reasons to avoid it. 1. China dissuades capital exodus. (They actually have a whole government bureau for this, the Foreign Exchange Management Bureau or 'waihuiguanliju') 2. My recent travels about Southeast Asia suggest that the government-run centralized interbank settlement network 'China Union Pay', is being supported by the government as a regional alternative to the de-facto global defaults Cirrus/Maestro (Mastercard) and Visa (Bank of America). Anyway, the why doesn't matter. It's really the situation.

beedogs 14y ago

DRM is such an utter and absolute waste of effort and money. Think of the millions of man-hours that have so far been misallocated on trying to "secure" digital content. It's just sad.

arrrg 14y ago
Eh, I think DRM has been pretty effective for Apple so far, still is, even with this. Pirating iOS apps is very uncomfortable, uncomfortable enough that those who can (i.e. those who have a credit card and are not completely broke) will in general buy, not pirate. I mean, even their gift card distribution is now so effective (you can buy them everywhere you go) that even without a credit card, the app store is pretty damn comfortable – so even kids are not necessarily forced to pirate.
- bo1024 14y ago
  But the fact that pirating is uncomfortable does not constitute an argument that Apple has been better off with DRM than it would be without.
  - arrrg 14y ago
    The DRM makes pirating less comfortable. If you could just go to some website and download the app and drag it into iTunes to get it on your device (that’s what dropping DRM entails) pirating on iOS would be very comfortable, probably on a level with using the App Store.
    - bo1024 14y ago
      Go on?
      - arrrg 14y ago
        Consequently, people pirate less. That’s speculation, sure, but I haven’t heard anyone offer anything better.

seanalltogether 14y ago

Maybe its time Apple and Google start providing receipts that devs can validate themselves. Apple already provides this on OSX and it makes it hard to mass pirate all apps.

mikeash 14y ago

It makes me sad that these get used for piracy. They could be extremely useful by allowing widespread installation of apps that Apple won't accept in their store, but instead we get another lame piracy service that people will point to as evidence that Apple's walled garden approach is a good thing.

duairc 14y ago
But piracy is a feature. It's good thing. Paying for stuff sucks. From a user's point of view, if Apple's walled garden approach prevents piracy, then that's just another reason their walled garden approach is bad. Edit: I'm not even playing devil's advocate here, this is just honestly what I think, and I think what most people honestly think. Stuff is better when you don't have to pay for it.
- cynicalkane 14y ago
  From a user's point of view, if walled gardens help support app devs making more apps, and those apps are worth more than the $1.99 or however much they cost, this is a net gain.
- artursapek 14y ago
  I'm guessing you're not a developer for a living.
  - duairc 14y ago
    No. I have developed (free) software in the past, and I've contributed to larger projects as well, but I don't have as much time for programming anymore. I "make" a living through a combination of squatting, dumpster diving and occasionally theft (only from bad people though).
    - artursapek 14y ago
      From what you're writing in this thread it sounds like you were born in the wrong millenium.

kgarten 14y ago

Sorry, but am I the only one who dislikes the picture they used for the post. The flag of the pirate party has nothing to do with iPhone software piracy websites ...

Semaphor 14y ago
Random stock image for an article that calls piracy stealing. They do know how to lower the expections for their article.
Semaphor 14y ago
They changed it now. Still has "stealing" though, maybe someone should send them a dictionary.

chj 14y ago

On one hand this could be a great alternative distribution channel, on the other hand developers get nothing and another risk is Apple can shut their accounts down at any time.

fabm 14y ago

The Zeusmos site is "currently undergoing some maintenance". Looks like someone is getting shut down.

saurik 14y ago

I think it should be made very clear, in the context of Hacker News, that one of the primary reasons that these sites have been operating as long as they have is because of support from Stripe, who handled their payment processing. The developer of this program keeps opening PayPal accounts, and PayPal keeps shutting them down. In just December, this developer got two PayPal accounts shut down; the latest one was only used for four days before it was whacked. Dec 24: "PayPal is back online for http://zeusmos.com http://zeusmos.com and http://uhelios.com http://uhelios.com – Happy Holidays everybody!" -- https://twitter.com/uhelios/status/283260362919395328 https://twitter.com/uhelios/status/283260362919395328 Dec 28: "I'm absolutely done with PayPal. This is ridiculous." -- https://twitter.com/uhelios/status/284654128339243009 https://twitter.com/uhelios/status/284654128339243009 However, despite careful and detailed explanations to Stripe--and despite them saying they would look into the matter--this website has been operating and taking payments using their payment processing system for months. Also, while the developer of Zeusmos claims in the "update" to the article that his application was never supposed to encourage piracy, it came by default with its search results coming from a website called AppTrackr, a large repository of cracked applications. In the last few months, the developer decided he wanted to "stray away from AppTrackr", but the result was not to move further from piracy: it was to become less reliant on that one piracy site and instead use another one called AppCake. Meanwhile, the developer has often compared his service to Installous, saying on his Twitter account that "its somewhat like Installous, but better"[1] and that it "has many features that Installous does not excel at very well"[2]. [1]: https://twitter.com/uhelios/status/274859392812318720 https://twitter.com/uhelios/status/274859392812318720 [2]: https://twitter.com/uhelios/status/239863143793324032 https://twitter.com/uhelios/status/239863143793324032

nathanhammond 14y ago
With your rather unique experience of running the Cydia Store on jailbroken iOS devices can you provide more information on the process loopholes these approaches (Zeusmos and Kuaiyong) are exploiting?
- saurik 14y ago
  In order to deploy code (without jailbreaking), you need to have it signed by a certificate that is valid for the device you are using. With a normal developer account, you can provision certificates for up to 100 devices. Signing an application is fairly simple (I implement most of the intricate pieces in an open-source program called ldid, but do not do the official signature parts). Putting this together: you simply get paid developer accounts from Apple (you will need to keep getting more of these, as you will run up against the 100 device limit), ignore the part of the contract you sign that states that you are not allowed to redistribute the certificates they give you, and instead automate a process to log in to Apple's portal, add a UDID to your account, and download an updated provisioning certificate. Connect this up with a payment processor that is willing to look the other way and an app that is capable of doing the signature process for apps locally for the user, and you are done. The device is already capable of installing certificates and applications that are signed by them from websites (see Test Flight for a commonly-used legitimate example), so the final steps are easy. (With an Enterprise account, you don't have to worry about the number of devices; however, the contract terms are much stricter, the system has more mechanisms for Apple to turn you off, and Apple will probably care more if you attempt to abuse it. In essence, an app signed by an Enterprise certificate can be installed on any device, anywhere, at any time until the certificate's three-year expiration date hits.)

Permit 14y ago

Wow, it's certainly interesting to see how the consensus on Piracy changes on HackerNews when it's iOS apps and not music/media that's being downloaded. The article even goes so far as to call it stealing and not one person has piped up to point out that they're merely copying bytes, not removing utility from anyone else. The PirateBay receives a lot of support when it's mentioned here. I imagine if I opened a "PirateBayForApps" on which I carried both legitimately free apps and pirated apps, I might not receive the same support.