Hackers crack Apple's iTunes gift card algorithm
appleinsider.com
appleinsider.com
Sounds like sloppy design.
Possibly. It looks like they've found a way to accurately 'guess' the codes Apple has already generated and distributed to be sold. The only thing for Apple to do now is recall the cards with the possibly compromised numbers and re-issue new ones with a randomly generated number.
This reminds me of when Vista came out. Someone found a way to get legitimate activation keys to activate their pirated copies, which meant that people buying them off of the shelf couldn't activate because that key was already used.
Perhaps they want the redemption side to not be reliant upon a backend code lookup and validation system (due to uptime, performance, etc...). Perhaps they thought no one would break it, and that would save them from having to build a high availability, low latency, high throughput, lookup system with some amazingly large database tables.
And, uh, redeeming an iTunes gift card ain't much use if the iTunes store is down. Also, I don't see why the system would have to be particularly low latency or high throughput.
Obviously change the algorithm used to generate the codes for a start. And even though the codes themselves are indistinguishable from real codes, you can probably detect patterns in their use (ie, someone from a town in China who's never had an iTunes account before suddenly buys $100 of music) and prevent a subset those codes from being redeemed (with some very small amount of false positives).
What else would you do?
If they reject it, there's now a good chance that they've rejected a redemption request by a legit customer.
There's also probably a chance of collision, considering the volume of iTunes certificates Apple probably sells.
Many gift cards sold at retail have to be "activated" at the register (presumably to cut down on shoplifting); I don't know what this involves but there may already be some communication.
It's by far the better system than using just a algorithm-based genuine check, especially for things that directly translate into money, like gift certificates.
My point is that such keys can now be generated independently of the sale. In other words, key_A is generated by a sale and key_A is generate by the algorithm. When key_A is presented, what do you do?
I'm pretty sure his suggestion is to have the keys generated randomly, so that they cannot be generated independently of the sale. If we are to believe him, this is standard operating procedure for businesses that are not apple.
Many serial number protected commercial applications have had their algorithms for validating a SN cracked and Key Generators spit out any number of valid serials for them.
Why would they use an fixed algorithm like that instead of using a good random generator and maintaining a database of valid codes? Perhaps they want the redemption side to not be reliant upon a backend code lookup and validation system (due to uptime, performance, etc...). Perhaps they thought no one would break it, and that would save them from having to build a high availability, low latency, high throughput, lookup system with some amazingly large database tables.
Do you suppose the hacker spent alot of $$$ on the real gift cards in the first place then go from there?