3 ms·
Ok, the app's web service is rather prone to manipulation: You just need to HTTP GET the following URL: http://www.carrotpop.com/smth/php/save_result.php?
by ge0rg 13y ago
Ok, the app's web service is rather prone to manipulation:
You just need to HTTP GET the following URL:
http://www.carrotpop.com/smth/php/save_result.php?id=<UID>&nickname=<NICK>&country=&result=<HEIGHT>&latitude=0&longitude=0
* UID looks like an autoincrement ID
* NICK is what you entered for the highscore
* HEIGHT is the float value of the height in meters, i.e. "1.23"
In the HTTP response, you get a data structure (not sure which encoding it is, but it is straightforward) of the highscore data:
[[["1.","LIATO","44.19m"],["2.","ROYBOY_91","43.16m"],["3.","YAIR40","35.12m"],["4.","GABRIEL","34.70m"],["5.","KAI","31.10m"],["6.","KAFAC99","21.06m"],["7.","JOSH","20.37m"],["8.","KEANSKI","17.61m"],["9.","EKREM6363","16.10m"],["10.","LORENZO","12.24m"],["2047.","MY BEST TRY","0.71m"],], ...
Edit: just opening the URL http://www.carrotpop.com/smth/php/save_result.php http://www.carrotpop.com/smth/php/save_result.php you can see the current stats, encoded as above.
- muzz 13y agoWith heights in the 50m range, it looks like it's already being manipulated
- nawitus 13y ago50m seems to be an artificially set limit.
- spuz 13y agoCan I ask how you discovered the URL the app was making requests to?
- mlreed328 13y agoI'm guessing Wire Shark.
- ge0rg 13y agoCorrect. I created a tcpdump trace on my OpenWrt router and then opened it in Wireshark. The HTTP request was easy to spot from there.
- yareally 13y agoDecompile the apk with one of a number of tools (apktool, baksmali). Least that would be what I would do.
- ajross 13y agoSet up a proxy setup pointed to a squid or whatnot that logs request. Use tcpdump on the router. If you have a rooted Android device you can use tcpdump there, or instrument the HTTP framework code to log requests, or... But assuming you have control of your home network and aren't just using a Linksys thing out of the box, just logging into the router and watching traffic is by far the most straightforward.
- fitzpasd 13y agoFiddler on your desktop machine - http://fiddler2.com/documentation/Configure-Fiddler/Tasks/ConfigureForAndroid http://fiddler2.com/documentation/Configure-Fiddler/Tasks/Co...
- randyrand 13y agoHow exactly do you prevent something like this? How do you ensure that the stats sent over the internet are coming from an actual approved client? My instinct tells me the simplest solution would be security by obscurity - adding some validation token that the client generates by some obscure and hard to reverse engineer manner. Is there any better way to 'validate' your client?
- jaxn 13y agoI had to deal with this before. Basically we combined several obscuring techniques: Use SSL for the requests which makes it harder to sniff the API. Add some sort of tamper token like you suggest. Use a specific User Agent string and check for that. Provide no error messages if any of the above fails.
- jwcrux 13y ago> Use SSL for the requests which makes it harder to sniff the API. Won't help - it's trivial to setup a proxy to MITM the traffic. > Use a specific User Agent string and check for that. Won't help - it's easy to manipulate a User-Agent. Assuming you're manually creating the GET request (via cURL or other means), then it's only one more option to bypass this. > Provide no error messages if any of the above fails. Will make debugging a pain. Also, if I'm an attacker, I'm going to try and clone the request as best as I can the first time, then see what I can get away with. > Add some sort of tamper token like you suggest. This is the best option. Not quite sure the best way to implement it, but perhaps some sort of CAPTCHA (this would be a pain), or some kind of random request id, etc. might work.
- lann 13y agoI would add to that: use a self-signed cert for the SSL. If you rely on the OS's PKI its relatively easy for an attacker to add their own CA and read the connection.