Hacker News Reader

Comment by ge0rg | Hacker News Reader

Ok, the app's web service is rather prone to manipulation:

You just need to HTTP GET the following URL:

    http://www.carrotpop.com/smth/php/save_result.php?id=<UID>&nickname=<NICK>&country=&result=<HEIGHT>&latitude=0&longitude=0

* UID looks like an autoincrement ID

* NICK is what you entered for the highscore

* HEIGHT is the float value of the height in meters, i.e. "1.23"

In the HTTP response, you get a data structure (not sure which encoding it is, but it is straightforward) of the highscore data:

    [[["1.","LIATO","44.19m"],["2.","ROYBOY_91","43.16m"],["3.","YAIR40","35.12m"],["4.","GABRIEL","34.70m"],["5.","KAI","31.10m"],["6.","KAFAC99","21.06m"],["7.","JOSH","20.37m"],["8.","KEANSKI","17.61m"],["9.","EKREM6363","16.10m"],["10.","LORENZO","12.24m"],["2047.","MY BEST TRY","0.71m"],], ...

Edit: just opening the URL http://www.carrotpop.com/smth/php/save_result.php you can see the current stats, encoded as above.

View on HN

How exactly do you prevent something like this? How do you ensure that the stats sent over the internet are coming from an actual approved client?

My instinct tells me the simplest solution would be security by obscurity - adding some validation token that the client generates by some obscure and hard to reverse engineer manner. Is there any better way to 'validate' your client?

I had to deal with this before. Basically we combined several obscuring techniques:

Use SSL for the requests which makes it harder to sniff the API.

Add some sort of tamper token like you suggest.

Use a specific User Agent string and check for that.

Provide no error messages if any of the above fails.

> Use SSL for the requests which makes it harder to sniff the API.

Won't help - it's trivial to setup a proxy to MITM the traffic.

> Use a specific User Agent string and check for that.

Won't help - it's easy to manipulate a User-Agent. Assuming you're manually creating the GET request (via cURL or other means), then it's only one more option to bypass this.

> Provide no error messages if any of the above fails.

Will make debugging a pain. Also, if I'm an attacker, I'm going to try and clone the request as best as I can the first time, then see what I can get away with.

> Add some sort of tamper token like you suggest.

This is the best option. Not quite sure the best way to implement it, but perhaps some sort of CAPTCHA (this would be a pain), or some kind of random request id, etc. might work.

I would add to that: use a self-signed cert for the SSL. If you rely on the OS's PKI its relatively easy for an attacker to add their own CA and read the connection.

With heights in the 50m range, it looks like it's already being manipulated

50m seems to be an artificially set limit.

Can I ask how you discovered the URL the app was making requests to?

I'm guessing Wire Shark.

Correct. I created a tcpdump trace on my OpenWrt router and then opened it in Wireshark. The HTTP request was easy to spot from there.

Decompile the apk with one of a number of tools (apktool, baksmali). Least that would be what I would do.

Set up a proxy setup pointed to a squid or whatnot that logs request. Use tcpdump on the router. If you have a rooted Android device you can use tcpdump there, or instrument the HTTP framework code to log requests, or...

But assuming you have control of your home network and aren't just using a Linksys thing out of the box, just logging into the router and watching traffic is by far the most straightforward.

Fiddler on your desktop machine - http://fiddler2.com/documentation/Configure-Fiddler/Tasks/Co...

Reply on news.ycombinator.com