Print 22 comment(s) - last by Piiman.. on Dec 29 at 2:41 PM

Microsoft is not going to be happy about this

Justin Angel, an engineer working on Finnish phonemaker Nokia Oyj.'s (HEX:NOK1V) Windows Phone team, has made the curious decision of going public with details of security flaws in partner Microsoft Corp.'s (MSFT) Windows 8, which allow users to pirate games.

Windows 8 users can grab games via Windows Store.  Paid titles typically come with a "Trial" option, which allow users to play a level or two of the game, before being prompted to purchase the title if they want to keep playing.  The trial process is controlled by a Microsoft API.

But Mr. Angel reveals a fatal flaw in the scheme: Microsoft stores the key/hash in plaintext and the algorithm to encrypt/decrypt the data next to the app itself.  In other words, while not for the novice, power users can write small programs to decrypt the program's permissions, write new permissions to make the game look legitimately purchased, and then re-encrypt the permissions.

By exploit the flaws users cannot only get games for free, but they can rid themselves of ads, albeit in a somewhat unethical manner.

But Mr. Angel does not stop there.  He also shows off more security flaws, showing how JavaScript injection attacks can be used to gain access (for free) to in-app purchases.  As an example he uses such an attack to unlock purchasable levels in the popular game Cut The Rope.

Windows Store
Microsoft Windows Store apps are vulnerable to piracy due to poor security implementation. [Image Source: ZDNet]

The flaws are a big deal as they could rob developers of essentially every way to monetize their content on Windows Store. Microsoft has not yet responded on these issues.

Mr. Angel's page has been overloaded with traffic (or maybe yanked after Nokia brass realized what he posted) and is now down.  However, a cached version is available here.  Just remember, readers, every time you pirate a game another kitten dies.

On his Twitter account, responding to criticism about the post he writes, "These are fundamental flaws in the app platform, not individual apps. No secure storage, no wrote protection, etc....  Offline activation & execution mandate secure local storage. That's how apps differ from fully connected web pages."

The issues echo those of Apple, Inc. (AAPL) who experienced rampant piracy in the early days of the Mac App Store, due to poor rights management implementation.  The take-home message is that it's a lot harder to manage apps on a personal computer, where users have full access to the files, versus on a smartphone, where user access to the file system is limited.

Source: Justin Angel [Google Cache]

Comments     Threshold

This article is over a month old, voting and posting comments is disabled

Who cares?
By DT_Reader on 12/11/2012 3:40:13 PM , Rating: 1
The only people I know with Windows phones work at Microsoft. Free games is not enough reason to put up with a Windows phone.

RE: Who cares?
By Argon18 on 12/11/12, Rating: -1
RE: Who cares?
By inighthawki on 12/11/2012 4:38:01 PM , Rating: 1
Is this just a terrible joke about how "Made by Microsoft" somehow translates to "Has a bunchof malware," or are you just really dumb?

RE: Who cares?
By themaster08 on 12/11/2012 5:15:51 PM , Rating: 2
Please tell me one piece of malware for Windows Phone.

You've clearly never used a Windows Phone, or used one for long enough to evolve an informed opinion of the OS. You're just an idiot.

RE: Who cares?
By ArcsinZ on 12/11/2012 7:39:20 PM , Rating: 2

Only AV app ever released for WP was by AVG and it was pulled and not put back. Nice try.

RE: Who cares?
By Ramstark on 12/12/2012 12:48:10 PM , Rating: 2
Umm...are you aware that this article is NOT about Windows Phone? It's mainly a flaw in Windows 8 functionality...Reading comprehension fail...

RE: Who cares?
By chick0n on 12/12/2012 11:24:03 PM , Rating: 2
thats apple fanboy's level, please forgive his stupidity

"It seems as though my state-funded math degree has failed me. Let the lashings commence." -- DailyTech Editor-in-Chief Kristopher Kubicki

Copyright 2015 DailyTech LLC. - RSS Feed | Advertise | About Us | Ethics | FAQ | Terms, Conditions & Privacy Information | Kristopher Kubicki