Virtual iPhones: reversing and fooling Apple Push and iPhone activation services

No ratings

Presented at BsidesOdessa 2017 by

Dima

Ticketmaster, the largest ticket sales platform for musical and sports events in North America, replaced CAPTCHAs in its iOS app with an anti-bot mechanism based on Apple Push. This system was in use for a year. This talk will detail the successful bypass of this mechanism, and its two main steps - (a) reversing Apple Push and implementing it in Python; (b) making Apple servers believe we own a gazillion iPhones (with a demo, if we're lucky). Dima is a freelance researcher with over 20 years of experience in reverse engineering of applications and network protocols. As of late, he reverse engineers mobile applications and system components (Android/iOS), analyses Android malware, and successfully finds vulnerabilities in both iOS apps and the iOS itself.