Slashdot Mirror
Siri Protocol Cracked
First time accepted submitter jisom writes with something that will probably not be working come morning. Quoting the source: "Today, we managed to crack open Siri's protocol. As a result, we are able to use Siri's recognition engine from any device. Yes, that means anyone could now write an Android app that uses the real Siri! Or use Siri on an iPad! And we're going to share this know-how with you."
Basically, Siri sends the data to the processing server using non-standard HTTP extensions. Of note is that the audio is encoded using Ogg Speex.
How long until they crack the unique ID generator and create viable clones of existing phones?
Kwisatz Haderach
Sell the spice to CHOAM
This Mahdi took Shaddam's Throne
How long until they crack the unique ID generator and create viable clones of existing phones?
You can probably already buy them on the streets in Shanghai.
A feeling of having made the same mistake before: Deja Foobar
Never, unless they manage to hack into Apple's servers. The ID check is server side.
The quality of the anonymous coward troll posts is declining. I expected more.
To offset political mods, replace Flamebait with Insightful.
I thought it ran on the phone itself.
How long until they figure out how to clone a phone? They already can do this :)
Besides, why would an Android user want to goto the trouble? I'm informed (rabidly and often) that Android phones already have superior features and that Siri is merely a clone with fancy marketing.
Don't blame me, I voted for Baltar.
So the iPhone can't really do the speech recognition and synthesis by itself? That's quite underwhelming.
Circumcision is child abuse.
The iPhone 4S sends identifiers everywhere. So if you want to use Siri on another device, you still need the identfier of at least one iPhone 4S. Of course Apple could blacklist an identifier, but as long as youâ(TM)re keeping it for personal use, that should be allright!
Appears that Xiph came out on top for speech codecs.
This also shortly after apple realized that ALAC was going to fail (at least as a closed source product, they may push it better as an open source project now it can be played by everyone).
They still have the very entrenched AAC though.
> I thought it ran on the phone itself.
Nope, and that is the scam. Basically you are calling a service. Thus they could make Siri available on every iProduct with zero effort. That they decided to hold it as an exclusive feature for the 4S to try and create the 'gotta upgrade' stampede is truly lame. Keeping it to iProducts is ok, they ain't giving away a hefty compute farm after all, who do ya think they are after all, Google? But locking access to the service to one submodel of one product line is a terrible idea.
Democrat delenda est
If Apple is learning anything from Google, it's that customer info is valuable. Siri could easily become an advertising platform that rivals Google. Targeted advertising, where companies pay Apple for premium listings ( eg Asking Siri about a Pizza place returns Pizza Hut who paid the most for that key word).
If that's their angle, they might welcome more traffic to Siri.
If it is correctly implemented, that's easier said than done. It is not necessarily a key-value pair that are cryptographically verified (i.e. there exists a purely arithmetic function f(x,y) that returns true iff (x, y) is a valid pair, and client is allowed access if it supplies correct (x,y) ) This kind of system would be crackable; just find another arithmetic function f' that returns y for some x (one usually exists).
However, if Apple knew what they were doing (and they usually do), it's a GUID database stored on Apple's server. Say, they generate a 128-bit random access code for each manufactured iPhone, and the only way you can use Siri is to supply a valid GUID. Such system is virtually uncrackable, because even for a 128-bit GUID and 200 million iPhone 4S manufactured, it would take a staggering 17 million trillion trillion guesses (i.e. HTTP requests to Apple servers) to guess right ONE correct GUID. If one request took a mere 100 bytes with its TCP/IP headers, you would have to transfer 170 million yottabytes (170 million trillion terabytes) of data to find one valid access key.
Good luck explaining this to your ISP! :)
The difference being that generally MS bought up rivals to kill their products rather than compete with them. This got superior products out of the way so crappy MS stuff could continue to stifle. Apple buys up new and innovative tech to promote and market it. Have a few billion laying around they can do that now.
Maybe that's a good reason not to root your phone and download unverified stuff from warez places?
(rabidly and often)
No doubt. Those users are the worst thing about having an Android phone.
I like my Android phone. It does what I need, it does it fairly smoothly. It's not as slick as my iOS devices, but I'm used to the downsides of Android and for the moment I'd rather deal with them than deal with the downsides of iOS. But the fanbois are just awful.
Sure. But then you'd have to buy an iPhone.
... or eavesdrop on somebody else's iPhone.
I don't care if it's 90,000 hectares. That lake was not my doing.
Sure. But then you'd have to buy an iPhone.
Or write an app that 'leaks' that information to a server you control. I'm sure Apple would have no hesitation in blacklisting a few thousand ID's that were leaked, but what if it was a few million?
There's an awfully big chance the codec was determined and implemented way before Apple even touched the product.
I was promised a flying car. Where is my flying car?
It seems fairly ill-advised for a company whose business is developing iOS apps to post their reverse engineering exploits on the corporate blog.
yeah, Apple never ever did that. ever.
the reason why you can't do this is because Siri communicates in HTTPS, so it is not vulnerable to man-in-the-middle attacks. hence, you cannot eavesdrop on somebody else's iphone
the reason why they could listen to the traffic in the article is because they had access to the root certificate on the iphone itself. you can do this if you have physical access to the phone, but obviously you can't just do this over the air to other people's phones
How long until they crack the unique ID generator and create viable clones of existing phones?
You can probably already buy them on the streets in Shanghai.
Sounds like a lot of work for a little utility, but hey if you need an excuse to prowl around the seedy areas of China, it's as good as any I suppose.
The force that blew the Big Bang continues to accelerate.
This presumes that the guid assignments are done from the 128bit guid space using some garanteed form of true random.
Given the number of phones in existence, and that new phones will have to be whitelisted as time passes, (and that random guesses will run the risk of collision) it is more likely that the guid assignment is performed in some sophisticated pseudo random fashion, and as such, identifiable patterns could be detected given a sufficiently large number of known whitelisted guids.
Once you have that information, and perhaps some other information that apple might use in the guid assignment algorithm (serial number, manufacturing site, date of manufacture, etc...) it should be possible to determine which guids should be valid.
This sounds like an opportunity for a naughty idevice app developer, who should already be able to get such a list by having their app phone home, and request the device uuid as part of a purchase validation mecchanism. (A popular app could quickly get several hundred active unique ids to work with, perhaps more.)
It's not a "pretty useless protection". It's not just checking that the certificate is valid, it's also checking that the certificate authority has a corresponding root certificate installed on the iPhone. It stops anyone who doesn't have access to the phone from eavesdropping or manipulating the data.