11

I have a web application that allows users to add mobile devices to their accounts (using mobile app).

Each device is uniquely referenced by its UUID. Mobile client is developed using PhoneGap, so it uses device.uuid variable for this purpose. An app written in PhoneGap can be run on many systems, but my application targets Android and iOS only.

The question: How my system (both server and mobile client) should react, when it detect, that new user account (new login and pass) is trying to add a device, which UUID already exists in a database and is currently bound to another user account?

Can I assume (in today's world — on iOS and Android) that the UUID of any particular device:

  • is unique without any doubts (two devices can't have the same UUID),
  • is secure (can't be changed or spoofed).

In other words: Can my service automatically "rebind" particular device (UUID) to another user account, in situation described above? Can I assume that there are no two devices with the same UUID and there are no too easy ways on spoofing UUID?

Or should I introduce some "more secure" logic in such situations? Like some kind of device deregister (from first account) and re-register (on new account)? And dissallow user (user account) to add / register new device, if the same UUID is already registered with another user account?

I won't deny, I'm a layman in security subject. So, I would assume, that UUIDs are unique and spoofing-resistant enough to introduce mentioned automatic device (UUID) re-registration in mentioned situation.

Improve this question

2 Answers 2

Reset to default
6

No, UUID can be faked when reporting from a client. Do not assume it proves anything about the identity of a device and do not assume that it is the same device as the last time you saw it. If you really need to verify a device, the best bet is to make a certificate that you can store on the device and ask for that certificate when looking at it.

If they are genuinely reporting, they should be universally unique (what the UU stands for) but it is entirely possible for someone to force it to report a non-unique value of their choice in many (if not most) cases. It can even be done with simple applications available on the app store on Android.

Improve this answer
2
  • Thanks! Do you refer to a "typical" certificate, used in similar areas? Or to "certificate" -- any form of for example file or localDB entry on a mobile device, uniquely generated by my system and (at least at the beginning) able to be read only by my mobile application? I'm asking because second option should be fairly easily to handle by a PhoneGap Build application (one code, build once in the cloud for all platforms), while first one would probably require to have separate code set for each platform, and build it locally, as each platform has probably own certificate handling routines.
    – trejder
    Nov 8, 2013 at 7:00
  • 2
    @trejder - depends on your scenario. If you don't care about a third party listener being able to impersonate the phone it could be anything, but you should really use a cryptographic certificate that can be used in a challenge/response without exposing the phone's token to the outside world if you want to maintain a higher degree of security. You can do it over an encrypted channel and use a simple value and be ok too though. Really depends on your needs.
    – AJ Henderson
    Nov 8, 2013 at 17:20
1

It is possible to have two devices with the same UUID. I have managed to clone some tv sticks (nandroid backup), with the same application (made with phonegap). Inside the code, the device is asked to provide UUID and thanks to web service comm with server I have proved that all of them have identical UUIDs.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .