2

The native app is sending the UDID to the service provider in order to receive push notifications through APNS. How is it possible to prevent tampered requests (modified UDID) from getting processed by the service provider?

Scenario: an attacker may modify the UDID of the request sent to the service provider, thereby filling the victim device with unnecessary push notifications.

3

Firstly, it's not the UDID that gets sent most of the time, it's an opaque "device token" that's specific to that device's use of the particular push service. You can see that in the documentation for push notifications.

According to this documentation, the connection to Apple is authenticated and encrypted using TLS. It's only if your private key is compromised that someone can register devices or send push notifications on your service's behalf. Also, through some undocumented procedure, Apple's side of the service is monitoring for such misuse.

  • If attacker manipulates the device token(to victim's device token) in notification request sent from attacker device to provider. will spam notification be recieved by the victim? Any copntrols to prevent the same. – wXyz Jan 20 '12 at 8:41
  • @wXyz - The user is unlikely to be notified in a case like you describe. – Ramhound Jan 20 '12 at 19:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.