6 ms·
Hackers crack Apple's iTunes gift card algorithm
- mhb 18y agoIs it possible that Apple might not mind so much if this encourages people to buy more iPods at the expense of music sales? Depends on the relative margins, I guess.
- mlinsey 18y agoA $200 gift card going for the equivalent of $2.60 (and zero of that 2.60 going to Apple)? I would expect that right there is higher than the profit margin of an iPod.
- lukifer 18y agoSince Apple has to turn around and pay 70% of that $200 to the copyright holders of the purchased content, I'm sure they stand to lose quite a lot more than they could possibly gain.
- aneesh 18y agoDoubtful. If there was truly money to be made that way, Apple marketing would have already thought of it and be giving away iTunes gift certificates.
- zyb09 18y agoI'm really surprised they don't store all sold gift keys in some kind of database and rely solely on an algorithm.
- anamax 18y agoWhat do you think that Apple should do when it detects someone trying to redeem a "bogus" gift key? If they reject it, there's now a good chance that they've rejected a redemption request by a legit customer.
- zyb09 18y agoWhat? No, just store every key that you officially sell in an internal database. Now if someone enters a key you check if it's in your DB, therefore if the key has been legitimately issued. Everything else gets rejected and your now 100% counterfeit safe, unless someone hacks your database, which is unlikely. Don't wanna pick on apple, but that's pretty much how things like that are done.
- whughes 18y agoWhat's your definition of 'sell'? Should Best Buy report back to Apple whenever a card is sold? Or are we just talking about shipping to retail? There's also probably a chance of collision, considering the volume of iTunes certificates Apple probably sells.
- wmf 18y agoShould Best Buy report back to Apple whenever a card is sold? Many gift cards sold at retail have to be "activated" at the register (presumably to cut down on shoplifting); I don't know what this involves but there may already be some communication.
- zyb09 18y agoWell, in case of retail cards the keys are registered before shipping. You give the manufacture a set of registered keys, which are then printed on the cards. If done right you won't have any issues - that's exactly what people are doing with CD-Keys or Prepaid-Cards. However, if you mess up (can't always avoid mistakes) and have shipped invalid keys or may be the key-printer didn't work right, you have the customer send you the certificate card and you can refund him. It's by far the better system than using just a algorithm-based genuine check, especially for things that directly translate into money, like gift certificates.
- anamax 18y ago> No, just store every key that you officially sell in an internal database. My point is that such keys can now be generated independently of the sale. In other words, key_A is generated by a sale and key_A is generate by the algorithm. When key_A is presented, what do you do?
- aneesh 18y agoSuppose you're running the team at Apple that works on the iTunes gift codes. What do you do here to cut your losses? Obviously change the algorithm used to generate the codes for a start. And even though the codes themselves are indistinguishable from real codes, you can probably detect patterns in their use (ie, someone from a town in China who's never had an iTunes account before suddenly buys $100 of music) and prevent a subset those codes from being redeemed (with some very small amount of false positives). What else would you do?
- huhtenberg 18y agoIt might've been not the algorithm that got broken, but, say, a private (RSA) signing key was recovered. It all really depends on how exactly the whole thing is designed.
- eli 18y agoWhy does this need an algorithm at all? Why not make them all random numbers? People have to connect to your server to redeem them anyway. Sounds like sloppy design.
- dkokelley 18y agoSounds like sloppy design. Possibly. It looks like they've found a way to accurately 'guess' the codes Apple has already generated and distributed to be sold. The only thing for Apple to do now is recall the cards with the possibly compromised numbers and re-issue new ones with a randomly generated number. This reminds me of when Vista came out. Someone found a way to get legitimate activation keys to activate their pirated copies, which meant that people buying them off of the shelf couldn't activate because that key was already used.
- eli 18y agoWell, if they're actually random, that would be impossible beyond, perhaps, brute forcing the validation server.
- aneesh 18y agoOne advantage of, say, a hash function over (pseudo)random numbers is that the same input guarantees the same output. It doesn't seem that important in the case of gift cards, though.
- eli 18y agoI suspect it has more to do with the limitations of point of sale systems.
- modoc 18y agoI'm actually working on a project involving large numbers of unique codes. While we're actually going with the random system and a web service to do lookups for the end point system, that approach can introduce a lot of cost and risk. Perhaps they want the redemption side to not be reliant upon a backend code lookup and validation system (due to uptime, performance, etc...). Perhaps they thought no one would break it, and that would save them from having to build a high availability, low latency, high throughput, lookup system with some amazingly large database tables.
- rscott 18y agoI saw this story earlier today and I must say I'm still very skeptical about the truth behind it. I don't really buy it, sorry.
- modoc 18y agoWhat don't you buy? Many serial number protected commercial applications have had their algorithms for validating a SN cracked and Key Generators spit out any number of valid serials for them. Why would they use an fixed algorithm like that instead of using a good random generator and maintaining a database of valid codes? Perhaps they want the redemption side to not be reliant upon a backend code lookup and validation system (due to uptime, performance, etc...). Perhaps they thought no one would break it, and that would save them from having to build a high availability, low latency, high throughput, lookup system with some amazingly large database tables.
- rscott 18y agoI don't buy it because I don't think that these iTunes gift cards are activated until you purchase them.
- fatbat 18y agoI am more curious as to how the hacker even start on cracking the algorithm. Do you suppose the hacker spent alot of $$$ on the real gift cards in the first place then go from there?