2

The native app is sending the UDID to the service provider in order to receive push notifications through APNS. How is it possible to prevent tampered requests (modified UDID) from getting processed by the service provider?

Scenario: an attacker may modify the UDID of the request sent to the service provider, thereby filling the victim device with unnecessary push notifications.

Improve this question

1 Answer 1

Reset to default
3

Firstly, it's not the UDID that gets sent most of the time, it's an opaque "device token" that's specific to that device's use of the particular push service. You can see that in the documentation for push notifications.

According to this documentation, the connection to Apple is authenticated and encrypted using TLS. It's only if your private key is compromised that someone can register devices or send push notifications on your service's behalf. Also, through some undocumented procedure, Apple's side of the service is monitoring for such misuse.

Improve this answer
2
  • If attacker manipulates the device token(to victim's device token) in notification request sent from attacker device to provider. will spam notification be recieved by the victim? Any copntrols to prevent the same.
    – wXyz
    Jan 20, 2012 at 8:41
  • @wXyz - The user is unlikely to be notified in a case like you describe.
    – Ramhound
    Jan 20, 2012 at 19:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .