Eichhoernchen/SiriServer- — Issue #3: Decryption of SessionValidationData
Author: cale250
Created: 2012-01-24 16:10:55+00:00
State: open

I know that since you are responding to GetSessionCertificate in your server, chpwn believes that this data is probably AES-pubkey-encrypted using those certificates. Since we can provide our own certificates, we may be able to find out exactly what is in the SessionValidationData. The trick then becomes figuring out the server response.

On the other hand, we may have to get some of the big-name guys to do some analysis if they're interested on the client side; we may be able to write a MobileSubstrate add-on that simply ignores the validation data if it speaks to any other server other than guzzoni.apple.com.

Also, I noticed you didn't leave any contact information. I'm interested in talking with you, so if you're on Freenode or Twitter, my username is cale250.