Google Marketplace DRM broken
Androids can be pirates too
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
Android applications secured by Google's Library aren't as secure as they should be, with only a byte or two preventing applications being copied freely.
The bytes in question are contained within the selected application but clearly identifiable once the app has been disassembled, as demonstrated by Justin Case, whose write up on Android Police suggests that the process could easily be automated.
Android applications exist in byte-code, as do Java apps, and can thus be disassembled back to something very close to the original source with surprising ease. All the pirate has to do is disassemble the application, change how it responds when told that there isn't a valid licence, then recompile it and Bob's your pirate.
Applications protected by Google's License Verification Library (LVL) communicate with the Marketplace application on the phone, which connects to Google's Marketplace Server to confirm the application is licensed. The Marketplace application returns a "1" if the application isn't allowed to run, so on receiving a "1" the application displays some information to that effect and quits. But that decision tree can be changed so an application receiving a "1" decides instead to go ahead and run, as demonstrated in this video:
Not all developers use LVL - there are many alternatives - but LVL is easy to implement and locks applications to a Google cloud identity, allowing users to take applications with them when upgrading handsets.
Developers might also implement a less obvious decision tree - Java developers regularly use obfuscation tools to make their disassembled code hard to read (changing object and variable names, for example). That would make the task harder, but not impossible.
Occasional piracy can't be avoided - the idea is to make it sufficiently difficult to make most users opt for the paid alternative. Case reckons the process he demonstrates could easily be batched with a script, allowing a nefarious pirate to provide unlocked applications that could be installed by anyone without technical knowledge - at which point it becomes a more serious issue.
Fixing this problem won't be easy - it's up to developers to process the response from the Marketplace application, which remains secure. Android code will always be open to disassembly, thanks to its use of the Java model. A lot will depend on how effective obfuscation turns out to be, and how many developers take the time to apply it. ®
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
COMMENTS
@Old Tom
What if the DRM itself is crap? Surly that's a legitimate excuse.
Believe it or not, in the US, copyright is a two way street.
Consumers have the right to make backup copies. We have the right to play our media in private on any machine we want without limit. We're even explicitly allowed to legally copy arbitrary pieces for public discussion (though not entire works).
Make no mistake, DRM is becoming more and more about controlling what consumers can do with their own property rather than protecting copyrighted works from illegal copying. As usual, DRM hurts legitimate users but does very little to stop the serious infringer.
@Ian Michael Gumby
"DRM" of this sort is impossible to accomplish.
Any app which must decode/verify itself before running is intrinsically vulnerable regardless of how much verification is done within the app.
Like the skype client (notorious for obfuscation), reverse engineers will always be able to break that "DRM" since it's not truly cryptographically secure (the keys are obviously present in the app).
This is different from say the PS3 or XBOX (and I suspect the iphone), where the operating system checks the cryptographic signature on an application before running it. No amount of reverse engineering on the application will defeat OS based DRM.
Furthermore, if the OS is rooted (as I suspect is common with android users), then the user could simply disable the OS based DRM.
All this was well known to microsoft when they had their paladium hardware initiative a few years back. It was unpopular because PC users hate handing ms the keys to their own hardware (more than they already do).
So I disagree about there being any fix, much less an obvious one that isn't a cat & mouse game. As long as android is an open os on open hardware, there is no DRM google can add which users cannot remove.
IP owners selling crap by hiding that fact before sale
"3) It's not a lost sale, I wouldn't have bought it anyway
- Don't install it then."
Bad excuse. How do you know it's crap before you've installed it? Or actually, is it crap or not?
If I buy a car, I can have a test drive, for free, before buying, no strings attached.
But that's a opportunity software, music or film makers _don't want you to have_. Tell us why?
To me it's obvious that they knowingly sell crap and "try before buy" would kill the sales. That also explains a major whining about "piracy": "Pirated" products are not lost sales as such, but they show what the company is _really selling_ and that reality kills the sale.
Actually, many sales as the friends, who also saw what was on sale, won't buy either.
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
Data control in the cloud
