Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a web application that allows users to add mobile devices to their accounts (using mobile app).

Each device is uniquely referenced by its UUID. Mobile client is developed using PhoneGap, so it uses device.uuid variable for this purpose. An app written in PhoneGap can be run on many systems, but my application targets Android and iOS only.

The question: How my system (both server and mobile client) should react, when it detect, that new user account (new login and pass) is trying to add a device, which UUID already exists in a database and is currently bound to another user account?

Can I assume (in today's world — on iOS and Android) that the UUID of any particular device:

  • is unique without any doubts (two devices can't have the same UUID),
  • is secure (can't be changed or spoofed).

In other words: Can my service automatically "rebind" particular device (UUID) to another user account, in situation described above? Can I assume that there are no two devices with the same UUID and there are no too easy ways on spoofing UUID?

Or should I introduce some "more secure" logic in such situations? Like some kind of device deregister (from first account) and re-register (on new account)? And dissallow user (user account) to add / register new device, if the same UUID is already registered with another user account?

I won't deny, I'm a layman in security subject. So, I would assume, that UUIDs are unique and spoofing-resistant enough to introduce mentioned automatic device (UUID) re-registration in mentioned situation.

share|improve this question

2 Answers 2

up vote 5 down vote accepted

No, UUID can be faked when reporting from a client. Do not assume it proves anything about the identity of a device and do not assume that it is the same device as the last time you saw it. If you really need to verify a device, the best bet is to make a certificate that you can store on the device and ask for that certificate when looking at it.

If they are genuinely reporting, they should be universally unique (what the UU stands for) but it is entirely possible for someone to force it to report a non-unique value of their choice in many (if not most) cases. It can even be done with simple applications available on the app store on Android.

share|improve this answer
    
Thanks! Do you refer to a "typical" certificate, used in similar areas? Or to "certificate" -- any form of for example file or localDB entry on a mobile device, uniquely generated by my system and (at least at the beginning) able to be read only by my mobile application? I'm asking because second option should be fairly easily to handle by a PhoneGap Build application (one code, build once in the cloud for all platforms), while first one would probably require to have separate code set for each platform, and build it locally, as each platform has probably own certificate handling routines. –  trejder Nov 8 '13 at 7:00
2  
@trejder - depends on your scenario. If you don't care about a third party listener being able to impersonate the phone it could be anything, but you should really use a cryptographic certificate that can be used in a challenge/response without exposing the phone's token to the outside world if you want to maintain a higher degree of security. You can do it over an encrypted channel and use a simple value and be ok too though. Really depends on your needs. –  AJ Henderson Nov 8 '13 at 17:20

It is possible to have two devices with the same UUID. I have managed to clone some tv sticks (nandroid backup), with the same application (made with phonegap). Inside the code, the device is asked to provide UUID and thanks to web service comm with server I have proved that all of them have identical UUIDs.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.