Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite

The native app is sending the UDID to Provider Service for recieving PUSH Notification thru APNS. How is it possible to prevent tampered request(modified UDID) getting processed at Provider Service?

Scenario : An attacker may modify the UDID of request sent to Service Provider, thereby filling the victim device with unnecessary PUSH notifications.

share|improve this question

1 Answer

up vote 3 down vote

Firstly, it's not the UDID that gets sent most of the time, it's an opaque "device token" that's specific to that device's use of the particular push service. You can see that in the documentation for push notifications.

According to this documentation, the connection to Apple is authenticated and encrypted using TLS. It's only if your private key is compromised that someone can register devices or send push notifications on your service's behalf. Also, through some undocumented procedure, Apple's side of the service is monitoring for such misuse.

share|improve this answer
If attacker manipulates the device token(to victim's device token) in notification request sent from attacker device to provider. will spam notification be recieved by the victim? Any copntrols to prevent the same. – wXyz Jan 20 '12 at 8:41
@wXyz - The user is unlikely to be notified in a case like you describe. – Ramhound Jan 20 '12 at 19:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.