BlackBerry App World™ Development

[kalafut]

I recall this question being posed in other thread but never saw an answer:

How do we protect someone from just POSTing a request to our key servers that AppWorld requires for dynamic licensing and getting free keys?  There appears to be no way of authenticating that it's RIM making the request, nor are we given a listed of valid IP addresses to filter on.

Do any of you have some sort of security scheme, or I you just issuing keys to whoever posts are request?

Regards,

Jim

[RLord321 · Accepted solution]

Jim,

The only way you can really do a security check is based off of IP.  So far I've only seen one IP address from AppWorld but they could always add more or change their IP.

You can also put whatever parameters you want in the URL for the dynamic licensing so if you add a parameter of say... secretCode=ThisMustHaveComeFromAppWorld, then you can also check for this value before you issue your key.

[kalafut]

RLord,

I like your idea of the extra parameter in the URL.  That sounds like a simple but reasonably effective added layer of security.  I think I'll do that and then just do periodic scan of the source IPs.  If it looks like there's an issue, I'll worry about more protection then.

Thanks,

Jim

[thm]

this is a really clever idea, I'll be doing the same.

[imho]

How do you add this onto a url with of a php dynamic licensing server? Something like the following doesnt work... The param never gets passed by appworld. http://www.myserver.com/test.php?secretCode=xyz

[RLord321]

That should work.  I would check the code on the server's side.  Try looping through all the parameters and printing them all out to the screen.

[precisionpete]

Adding a Secret Code in an HTTP Get is no more secure than not doing it. Anything in a get will show up in things like firewall and proxy logs. They are easy to get. You can find lots of those logs by just Googling. 

This is why RIM makes the licensing query in the form of a Post. Post data does not generally show up in logs out on the net.

Your only real protection options are to use SSL on the connection and to respond only to known IP addreses of RIM. Then you should be good. 

It would be nice if RIM allowed us to configure a secret key to be included in the Post data... But I would not do it in a URL (HTTP Get).

[meanman]

I agree with the above post. Adding a parameter in the GET request is quite easy to intercept, even with POST if the contents are not encrypted it would be easy to second guess for a hacker.

You can easily obtain the range of IP addresses RIM uses, takes a bit of looking around but as far as I can remember its something along the lines of:

a.b.c.[x-y]

so long as "a.b.c" match RIMs range you should be good

You have to really weigh your security options and see if its actually worth the extra time and hassle. I wouldn't worry about it too much, unless its a really expensive and/or desirable app.

[precisionpete]

To find the addresses of RIM, just look in the headers of their request to get their IP. Then go to ARIN and do a whois lookup on the address to find the network. Allowing any address from that network would be a safe bet...