Pokémon Go is finally out in the United States, and as a long time fan of the franchise, I downloaded it as quickly as I could. (I tried the New Zealand App Store this morning, but of course regional stores kept me waiting for a few more hours.)
After setting up my avatar and catching a Charmander, the first thing I did was fire up Charles and started poking around. (Not Poké-ing, poking.) Whenever a popular game comes out on iOS, I try to observe network traffic and inspect the app bundle to get an idea of what goes into the game. I didnt find anything spectacular, but there were a few interesting bits. (I know nothing about Unity, so I might be amused at silliness.)
The app says it made of Unity in one of the splash screens, and the graphics certainly look great. The Google Maps logo is visible in a couple of places, including the Pokédex and the world map, and Charles logs show a couple of connections to Google Cloud APIs and an RPC heartbeat connection to pgorelease.nianticlabs.com. The responses are coming back as chunked gzip data from an nginx server. Pretty cool.
Unsurprisingly, theres also an analytics SDK in there. (Two, actually!) Theyre using Upsights SDK, and uploading information such as your screen dimensions, time zone, and some in game stats. Its also grabbing carrier, connection type (cellular vs wifi) and a few other bits. Niantic is also tracking when you tap on the various in game buttons.
The other analytics library is Crittercism, but its a lot less vocal in the Charles logs, so if you dont look for it, youll miss it.
When you tap on a Pokéstop, it shows up in the RPC heartbeat, along with a partially encoded URL, which points back to Googles hosting API. Charles shows that these requests are the images for the Pokéstops.
Even though I was sitting on my couch the whole time, a few pokemon decided to spawn (in neighboring apartments, so I couldnt get to them) and I could see them on the map. A Staryu appeared, so I looked and saw a URL in the RPC stream that looked like this:
Notice the pm0120 bit? Staryus number is number 120 in the Pokédex. Copying the URL into a browser yields the data blob from the server, but again, I havent yet been able to open it. Trying to change the number fails, because theres some bundle signing going on.
Eventually, the RPC connections start failing more and more frequently and the app finally crashed after about 50 minutes of sitting open connected to Charles. While watching the RPC stream and observing, I decided to look at a few other things
Once I was looking at the Niantic website, I checked out the homepage. It notes that the company was founded by ex-Googlers, which explains the heavy use of Google as a backend.
At this point, I wasnt able to do anything super interesting because of the intercepted datas streaming format, but maybe someone will do something neat with this data some day. I am forward to playing the actual game tomorrow, despite a few subtle visual glitches.
To their credit, Pokémon Go only uses location when the game is running, which is actually kind of interesting when you think about what theyre trying to do. (Its pretty neat that they can augment reality with significant location updates and nothing more.)
Theres a next mission hint which overlays the entire game, and gets in the way of menus and such. (It overs the Settings button in some screens, for example)
Well, you know what the say about fixing bugs in early releases, right? Yes, you do. Shout it with me: Gotta Catch ém All!
Several weeks ago I started to explore the NEO ecosystem, for those who are not aware NEO is a blockchain project that just like Ethereum pretends to create the tools and the platform to execute smart-contracts and create new types of decentralized applications. It has its pros and cons just like any other system, but that is outside of the scope of this blog post.
One of the defining characteristics of this “cryptocurrency” is the ability develop those smart-contracts in programming languages the user already is familiar with (however only a small subset of the language is available).
So I searched for the available SDKs and found the neo-python project, which is a wallet software and also a set of tools to develop using the Python programming language. The project is developed by a community of supporters of the NEO ecosystem called City of Zion.
And now the real topic of the post begins, while learning the features and exploring the codebase I found an urgent security issue with the way the wallets were being encrypted by neo-python.
Long story short, the method used to protect the wallets wasn’t correctly implemented and allowed an attacker with access to the wallet file to decrypt it without the need for the password/pass-phrase (more details here) .
Fortunately it is an actively developed project and the team responsible for it was quick to acknowledge the problem and merge the fix I proposed in a pull request. The fix is now present in the newer versions of the project, and it now forces the users to reset the security features of their wallets (check this video for more details, starting on minute 8 up to 10) .
Now in this post I would like to leave my recommendation about how to proceed after re-encrypting the wallet, because even though the issue is fixed your private keys might have been compromised before you applied the patch. If you are a user and didn’t noticed nothing yet the most probable scenario is that you weren’t compromised, since most immediate thing an attacker could/would do is to steal your funds.
The steps 4 and 5 are necessary because the fix protects your master key but it doesn’t change it and as I previously said if a copy of your vulnerable wallet exists (created by you or by an attacker) your funds are still accessible. So don’t forget to go through them.
Other than this, the project is very interesting and while still immature it has been fun the work with it, so I will keep contributing some improvements in the near future.