Slashdot Mirror
Nokia Engineer Shows How To Pirate Windows 8 Metro Apps, Bypass In-app Purchases
MrSeb writes "The principal engineer for Nokia's WP7 and WP8 devices, Justin Angel, has demonstrated, in rather frank detail, how to pirate Windows 8 Metro apps, how to bypass in-app purchases, and how to remove in-game ads. These hacks aren't exactly easy, but more worryingly they're not exactly hard either. Angel shows that turning a trial version of a Metro app into the full version — i.e. pirating an app — is scarily simple. It's just a matter of downloading an open-source app and changing an XML attribute from 'Trial' to 'Full.' Likewise, a quick change to a XAML file can remove an app's ads. Bypassing in-app purchases is a little trickier, involving some reverse engineering of some DLLs and and decryption of database files, but Angel still makes it look fairly easy. Angel gives himself one million credits in Soulcraft, an RPG game — something that would cost you over a thousand dollars, if you performed a legitimate in-app purchase. Angel also demonstrates a way to bypass in-app purchases in WinJS (Metro/JavaScript) apps, by injecting scripts into IE10 (the rendering engine for WinJS apps). It's easy to blame Microsoft for this, but isn't this really an issue that is intrinsic to all installed applications? The fact is, Windows 8 Metro apps are stored on your hard drive — and this means that you have access to the code and data. Hex editors, save game editors, bypassing Adobe's 30-day trials by replacing DLL files, pirating Windows 8 apps — these are all just different incarnations of the same attack vectors."
SPIN? Of course you can do these on other platforms! Article is clearly an M$ shill.
Its nothing that hasn't been done for as long as I've used computers.
Yes, you can change code and work around everything.
SecureBoot with a fully trusted chain makes it impossible ... right up until an exploit is found in the chain.
Cracking isn't new, and this isn't particularly impressive. Not that credit isn't do for pointing it out, the guy is the 'First Post' so to speak, but other than that, its just 'meh, I did this when I was 15' and it was harder then as programmers weren't so lazy to store things in easily editable unsigned XML files since MOST people using computers had a bit of a clue.
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
Bruce Schneider just facepalmed. How many times do you people need to be told client side security doesn't work? Of course the Windows 8 store got hacked: No matter how much you try to lock it down, all you're doing is just giving some bored teenagers and underemployed/unemployed programmers something to challenge them. The Playstation 3 had some very advanced client-side security. It still got broken. It took them awhile, but it fell, as all client side security must. If you have physical access to the hardware, you own it. It may take a mod chip, it may take a special program, or technical knowledge, but the problem is one that although the skillset required to hack it may be highly specialized, once that single success happens, everybody reaps the benefits within hours to months. And there are far more bored engineers than there are DRM proponents. All client-side DRM has ever accomplished is frustrating and annoying paying customers.
This isn't news. This isn't even interesting. Hell, let's be honest here -- how many of you work at a company that has plans to migrate to Windows 8? Support it for people who have it at home? How many of you are planning on making it your primary operating system?
I see very few hands. This operating system exploded on the launch pad. It's an attempt to emulate Apple, and they botched it so hard that senior Microsoft executives will be getting handed pink slips by the end of next year -- I'd wager serious money on that. Microsoft lost its ability to innovate awhile ago... now it just follows where the market goes, maintaining a profit margin but never pushing the margins of the technology. The reasons for this are many and beyond the scope of this post...
But don't act surprised when someone cracks a client-side security scheme. No implimentation of it has denied a determined attacker with the resources of a private individual or (at worst) a small company to date. It has a fundamental design flaw that cannot be corrected.
#fuckbeta #iamslashdot #dicemustdie
I did this when I was 15'...
Damn! How tall are you now?
“He’s not deformed, he’s just drunk!”
No, my ability to alter bits on my hardware is not an 'attack' it's proper functioning of a general purpose computer. If people have invested in business models predicated on my inability to modify the bits on my hardware, that is their problem, but it's not an 'attack' it's simply their own short-sightedness and stupidity.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Friends don't let friends enable ecmascript.
Both of them?
[oblig]: Handy fact: "miles-per-gallon" (Imperial gallons mind you) is equivalent to "furlongs-per-pint" :)
I'll get my coat ...
If you don't pray in my school, I won't think in your church.