Mac App Store DRM broken (Here's how) | Hacker News Reader

Mac App Store DRM broken (Here's how)

pastebin.com

95 pointsblueben39 comments

This is a bug in Angry Birds, not the DRM. You're supposed to check the receipt's bundle ID actually matches that of your app, and they didn't. If you try this with other paid-for apps it will fail.

I'm honestly surprised that some people are so desperate to not pay $5 for Angry Birds. I mean, I sort of understand pirating $800 apps like Adobe's suite, but $5 for a bird slingshot game?

For full disclosure's sake, I am an iOS and Mac developer, so I have some skin in the game.

Considering hundreds of thousands, if not millions of people get the same game for free on Android phones/tablets, there's some strangeness to paying for it on other platforms.

It's only free because the Android marketplace hasn't yet matured enough for a paid app. To compensate, the Android version has ads.

It's definitely matured enough, and Rovio initially intended to release a paid app alongside the free one.

However, they still haven't, and given that press release from a month or so ago stating they were on track to earn $1m per month from the "free" version, I'm starting to see why they haven't. I doubt they'd make anywhere near as much ongoing ad revenue if they released the game for a dollar or two.

They get the game with ads. There is no strangeness at all about not paying for a version with ads and paying for a version without them.

I looked over the shoulder of someone playing Angry Birds with ads. The paid version was worth every penny.

There is nothing on this earth more jarring to a game design than having some out-of-context ad pop up on the screen. Particularly when the screen is already half the size of a decent postcard.

Disable 3G and wireless on your Android phone and you won't see any ads :)

I would gladly pay to play Angry Birds ad-free on Android.

Or at least, I would have while I was still playing it.

> Or at least, I would have while I was still playing it.

Ohhh nice burn. ;)

Actually, it's not a burn. The game, like most others, only has so many levels. I've gotten past all of them, and I don't find it fun to try to get 3 stars on them all. So until it updates with more levels, I don't feel any need to play it.

As a friend of mine pointed out when I complained:

http://www.cyrket.com/p/android/com.bigtincan.android.adfree...

I'm not going to comment on the ethics, just noting that there is a "solution." (Also: requires root)

I recently bought an Archos 101 Android tablet and installed Angry Birds (from the included AppsLib).

I never saw any ad...

Bug or feature?

Whoever wrote this clearly thought it would work on other, more expensive apps. Perhaps they didn't have the money to actually test it :)

I think you assume the wrong motivation.

Most indie Mac developers will tell you they don't really concern themselves with app piracy. This is the same thing; someone still has to upload the dmg to some shady website, the pirate has to find it and remove the DRM files, and then do it all over again when there's an update and hope it keeps working. Or, just pay $3 and never worry about it again.

> Most indie Mac developers will tell you they don't really concern themselves with app piracy.

As someone who makes a hobby of cracking apps (I don't release anything, it's just for fun), I can corroborate this. I've never been able to find a trace of DRM in any Objective-C-based app. As far as I can tell, the state of the art for indie Mac developers is to have a method "-(bool)isAppLicenceValid" and another "-(bool)isAppLicenceOnBlacklist". Just hardwire YES and NO to those, and you're good.

That's basically the extent of the copy protection we use. The idea is that pirates probably aren't going to buy your app anyway, and any significant time you spend trying in vain to beat them is time taken away from fixing bugs, writing new features, sales or support of actual customers. Since most of us are one person shops, the tradeoff is pretty obvious.

Have you had a look at Textmate? It uses PGP in an interesting way, http://sigpipe.macromates.com/2004/09/05/using-openssl-for-l...

Don't really see how you can say they don't concern themselves with piracy if they are maintaining a black list of app licenses.

I posted this yesterday, but if this link is true, it'll be a whole lot easier to pirate apps than you suggest.

It'll be as easy as using the normal AppStore, except for spending money part.

http://torrentfreak.com/pirate-apple-app-store-innovates-wit...

"Hackulous admin Dissident "

Oh god, they do think so highly of themselves, don't they.

YEAH! I'M A DISSIDENT! I'M A REVOLUTIONARY! I'M MANDELA! I'M PIRATING $.99 APPS! FUCK YEAH! STICKING IT TO THE MAN! OR AT LEAST A GUY WRITING SOFTWARE AND TRYING TO FEED HIS KIDS! YEAH! DISSIDENT, MOTHERFUCKER! I'M BADASS! DON'T YOU FORGET IT!

Pathetic spoiled dweeb with a galaxy-sized sense of entitlement, more like it.

My feelings exactly. Sure there was always Serial Box or whatever it was called, and [k]racks back in the System 6-9 days, but this new breed and their methods have really taken things to an extreme... I mean a pirate App Store FFS??

I believe the name "dissident" comes from a desire for anonymity (probably a good idea, with what he does). He used to go by "TDDebug", fwiw.

(Insert argument how none of the kids who use Hackulous would ever buy an app anyway, due to lack of funds (or lakc of funds in credit card or iTunes format), or because they are just pirates.)

"I believe the name "dissident" comes from a desire for anonymity"

I'm sure. But it's an absurdly self-flattering and grandiose name. He's not a dissident. He's helping people copy inexpensive apps, that are in no way necessities, that generally cost less than a can of Red Bull, and are mostly from small independent developers.

A more appropriate pseudonym would be Veruca Salt. At least that would capture the pettiness and sense of entitlement.

> I posted this yesterday, but if this link is true, it'll be a whole lot easier to pirate apps than you suggest.

That's always easy on OSX: there is a regularly updated one-stop-shop app for serials, and the vast majority of apps only have a license/serial key.

Just submitted the following link on how devs can protect themselves: http://news.ycombinator.com/item?id=2078103

John Gruber has the following to say on the topic:

  Copy the App Store receipt from any legit Mac App Store download — including from
  any free app — and paste it into a bootleg download of Angry Birds, and it’ll run.

  This isn’t true for all paid Mac App Store apps. For apps that follow Apple’s
  advice on validating App Store receipts, this simple technique will not work.
  But, alas, it appears that many apps don’t perform any validation whatsoever,
  or do so incorrectly, like Angry Birds. (Angry Birds checks for a valid
  receipt, but doesn’t check to see that the bundle ID for the receipt matches
  its own bundle ID.)

  Apple should test for this in the review process, and reject paid apps that are
  susceptible to this simple technique.

  Apple should test for this in the review process, and reject paid apps that are
  susceptible to this simple technique.

That part is just silly. Developers should decide themselves how much time to spend on the validation. For example, the Twitter for Mac app doesn't have any validation (you can run it just fine without having the app store), and it doesn't need to as it's free anyway.

Adding proper validation takes a relative large amount of time, and sometimes it's just not worth it. Hackers can still dynamically link against a custom OpenSSL, or patch your app to not exit() if the code is 173, change Apple's CA in the Keychain or a few other tricks that would work with a large amount of the apps in the app store. You'll probably do better using your time to make your app better than trying to fix the DRM.

Simple obvious holes in their DRM solution, even if it is an implementors fault, damage their branding and the perceived value of their app store to businesses. My take on it is, even if it is the developers fault for failing to program their system correctly, it is in Apples best interest to perform some basic validation to prevent the DRM being perceived as useless (even though that's not the case).

Lastly, if the DRM scheme is so dependent on a the 3rd party app to function correctly, it seems like a failed system design.

So they didn't bother to try here or on iOS. Honestly, not particularly surprising: any DRM will be broken eventually (even their own heavily-obfuscated iTunes FairPlay DRM).

(Edit: apparently this is the fault of Angry Birds. I bet it's going to be very simple to actually crack, though, so my point still stands.)

Without record labels forcing DRM, it's just a lot of effort for something that will be cracked, and only prevents the pirates who probably wouldn't pay anyway from using the apps.

However, with this weak DRM, and expressly disallowing additional DRM, they have shown that the Mac App Store is not about much of the existing Mac software. You're never going to get Microsoft, Autodesk, or Adobe in that kind environment, at least for their flagship products.

> You're never going to get Microsoft, Autodesk, or Adobe in that kind environment, at least for their flagship products.

Indeed, although it's maddening. Haven't MS/Adobe noticed that their flagship products are on piratebay already, so there's no point forcing DRM on legal users only?

There's also the 30% to Apple that is going to keep them out of the App Store.

What's the cut taken by Apple Stores? (brick'n'mortar and online one, both stocking MS/Adobe products)

Probably similar to the cut taken by Best Buy or Amazon.

But MS/Adobe also sell directly, and they deal directly with large institutional clients like big corporations and universities, cutting discounted deals, site licenses, etc.

Wouldn't Apple be able to check this and then just ban your Apple account?

"We see that you've pirated an application. We're now going to block you from buying it legally."

Sounds like a plan.

Surprisingly unsatisfying. Bummer. :-(

Guess version 2 of the game will be called Very Angry Birds with pirates as targets. Or pirates are really pigs?

Reply on news.ycombinator.com