iPhone World

A number of “exploits” have surfaced for the iPhone over the last few months, but this is one I would consider of significantly higher risk than say, being remote controlled via SMS. It seems Tapulous (Makes of Tap Tap Revenge, Twinkle, Friendbook, etc), uses UDID’s for authentication, and only UDID’s. What’s a UDID? Well, it’s a Unique Device Identifier. As the name suggest, it is unique to your device, or at least in theory. There is a tool available via Cydia (Anyone who has installed Installous has this tool) that will allow a user to change their UDID. What this means is that anyone who may happen to get ahold of your UDID can potentially change their device to match yours, and effectively gain access to your Tapulous account. If you have it set up with Twitter, Facebook, etc, your accounts have just been compromised.

How would someone get your UDID? It’s actually easier than it sounds. Cydia sends the UDID when communicating with the repo’s. As such someone could easily setup or modify a repo to collect this information. Going a step further, I imagine it will only be a matter of time (if such a thing has not already happened silently) until apps show up in Cydia that appear legitimate but would for example, send your UDID elsewhere when executed. There may be countless other ways of obtaining the UDID that haven’t been thought of yet.

Tapulous is aware of the issue and are working to resolve it, which will likely entail changes to the authentication in all of their apps. My advice at this time, if you have a Tapulous account, cancel it or change your Twitter/Facebook passwords until the issue is resolved.

Now, if you are a Tapulous user but do not have Twinkle or Friendbook, the worst that could happen is someone may mess with your Tap Tap Revenge scores, if those are even stored, I have not played it personally.

It doesn’t appear that Tapulous is publicly acknowledging this vulnerability, (I can’t bring myself to call this an exploit as it is a failure in the design of the authentication system, or lack thereof), but you may want to watch their blog for more news or keep an eye out for updates in the AppStore.