yashsingh1/xdaforums huggingface dataset:
[General Topics] neobigd:
lol, first thing i thought of when i saw this posts title...

http://my.starstream.net/neobigd/htc_peep.jpg
[General Topics] cajunflavoredbob:
HTC finally release the Peep security update for the Rhodium, Topaz, Leo, and Photon. I've attached the files to this post, but they can also be had at HTC's website at the link below.

HTC Peep security update

EDIT: These updates do not work with custom ROMs, it seems. The *.exe needs to be copied to your device and run from there. I'm working on extracting them and making proper *.cabs now.
[General Topics] cajunflavoredbob:
Peep Update *.cabs

EDIT: DO NOT PM ME ABOUT THIS FIX. IT DOES NOT WORK.​

Please do not PM me about this security fix. It has nothing to do with the current Twitter outage as of the beginning of May 2011.

After pulling them apart and recompiling them, with the help of JVH3, here are the HTC Peep Update *.cabs. These are for Windows Mobile users with version 6.5 or higher. It should work, in theory with version 6.1, but I didn't feel like testing it out. Obviously, you'll need Sense 2.5 as well. There are four versions, but they all seem to be exactly the same. I didn't notice any differences other than the dates they were packaged. The Rhodium version seemed to have a slightly smaller TwitterApp.exe file, but I still don't think it was different.

Disclaimer: I take no responsibility for anything you do to your devices. These are posted for informational purposes. If you choose to install the application update, then any side effects (of which there should not be) are on you.

Changes

​

This update changes the way the Twitter Tab (HTC Peep) authenticates your user account. Before this update, your account information is sent via unencrypted http headers upon login which reveal both the username and password to anyone who happens to be eavesdropping on the connection, whether it is by cellular data or wifi as seen below.

authenticity_token=c8b5abaf53f223e827d9258ddfef4285a816db5f&
oauth_token=I4FK956n1foaHjayLKXJT2IaBpsmoo0amKyPhebc&
session%5B[B]username_or_email%5D=USERNAME&session%5Bpassword%5D=PASSWORD[/B]

Also, when sending tweets or receiving them, their is a continuous authenticate request sent which exposes the username and password again as illustrated below.

GET /statuses/friends_timeline.json?count=50&page=1 HTTP/1.1
Accept: text/xml, application/xml;q=0.9, */*;q=0
[B]Authorization: Basic BASE64("USERNAME:PASSWORD")[/B]
User-Agent: TwitterEngine
Host: twitter.com

I haven't been able to confirm the status of the current update yet with traffic monitoring, but according to HTC, this update sets the Peep application to use OAuth to establish a connection with https to encrypt the username and password instead of leaving it exposed for all the world to see.

EDIT: This is not a 100% fix. It seems that while the initial session is now being sent over https using TCP port 443 (sending against the api.twitter.com domain), during the rest of the session, Peep switches back to HTTP basic. This still leaves the whole session after the initial login vulnerable to hijacking based on the Twitter's session ID through cookies. I suggest using a different Twitter client, as neither HTC nor Twitter care for our aging devices.

EDIT: DO NOT PM ME ABOUT THIS FIX. IT DOES NOT WORK.​
[General Topics] squaloforte:
i dont like to install os on sd card
[General Topics] JVH3:
What relevance does your post have to anything related to this thread?

Nothing about this thread has anything to do with installling an os or anything to your sd card.

It is about the twitter tab security flaw and the recent patch by HTC.

A patch could only be installed to the device, since patches need to replace files on the device.
[General Topics] ramonguthrie:
Still getting login error!

I'm still getting login error problem on my HTC HD2 o2 uk phone, this update and the HTC HD2 Peep Security update on the HTC website http://www.htc.com/europe/SupportViewNews.aspx?dl_id=1085&news_id=866 doesn't work :(

Is anyone else getting this problem?
[General Topics] JVH3:
Please try to keep up.

This fix has nothing to do with login errors.

This fixes a security vulnerablity.

Without the fix, user name and password are sent in plain text through http.

With the fix, oauth is used instead, so each request does not send this information. And when it initially is sent to authenticate, https is used.

The twitter tab works for just about everybody. And the fact that no one else is reporting problems since applying the fix indicates that the fix does not have a problem.

Things to check:

Do you have a twitter acount?

Are you entering your twitter user name and password correctly?

Is your twitter account locked by twitter? (try using it with your computer)

Do you have a data plan?

Do you have a strong cell signal with Edge or 3G service?

Have you tried soft resetting your device?

Are you in the UK?

If not, does the country you are in block access to twitter?

Can you browse web pages with your phone?

No need to reply to this reply to your post since your post was not on topic for this thread.
[General Topics] ramonguthrie:
My Peep app stop working in January, there are no problems with my twitter account, all I'm looking for is a solution or fix!

Do you know where i can get a Peep.cab?
[General Topics] JVH3:
As I previously said, this thread is dedicated to the HTC Security Patch for the twitter tab.

I suggest either looking for a thread dedicated to the twitter tab not working or creating your own thread in the question and answer section.

http://xdaforums.com/forumdisplay.php?f=456

This thread is not the appropriate place for your question.
[General Topics] KenDB3:
My HTC Peep stopped working on my Rhodium after installing this update. Peep worked right up until I installed the HTTPS Fix.

Verizon TP2, using the Custom ROM --> Verizon MR2 Fixed by Mr. X

(ROM Found here)

http://forum.ppcgeeks.com/cdma-tp2-...zon-mr2-fixed-mr-x-boots-unlocked-device.html

I see the "Tap Here to Authenticate" Screen

I type in Username/Password (which works when logging into the website)

HTC Peep tries to log in, but I get an error --> "You entered an incorrect username or password."

I cleaned out the Temp folder to try and get a fresh start, but no luck.

I tried to uninstall, but I am unable to uninstall properly.

I tried to Re-install, but no luck.

I shut down Sense, re-installed, and rebooted and turned on Sense, no luck.

So, minus doing a brand new ROM flash it looks like this .CAB tanked the Twitter tab for me. I didn't really want to keep using it unsecured, but it sucks that the update stopped it from working altogether.
[General Topics] cajunflavoredbob:
Did you log out of the service before installing the update? If not, that may be why. Other than that, you could go to the Settings tab, then Data services, and then log out of Twitter and back in again using the toggle switch. This is where the service will be updated into the registry.
[General Topics] KenDB3:
I was Sooooo hoping that would be the fix. Gave it a shot, and when I got to the Data Services, I saw that the toggle switch was Off. I turned it back on, it asked for User/Pass again, but it did not go through. Same error that username or password is incorrect.
[General Topics] JVH3:
When I first installed it, I needed to soft reset 3 times.

I soft reset.

Tried to authenticate. It failed.

I soft reset.

Tried to authenticate. It failed.

I soft reset.

Tried to authenticate. It succeeded.

Might also try going into airplane mode. Then soft reset. Then turn data back on and try.

When I install it right after flashing a ROM, it works on the first try.
[General Topics] KenDB3:
Thanks JVH3,

No luck so far. I've tried what you suggested and no change at all. But I do remember this happening the first time I ever cleared out my TwitEng folder in the Temp folder (in root). It took several resets and some patience. This is taking considerably more, but I won't count it as a loss just yet.

I'll report back if it starts working.
[General Topics] snowboard:
the official twitter app is so much better than peep
[General Topics] cajunflavoredbob:
There is no official Twitter App for Windows Mobile. This was an update to the Windows Mobile application, not the Android one.
[General Topics] Laurentius26:
Thanks for this security update. :)

I confirm the cab in post # 13 work on my HD2.

Grtz, :)
[General Topics] luzhuwang:
this is very useful!!
[General Topics] Ajatshatru_Patni:
@cajunflavoredbob: You're awesome dude. I downloaded the LEO_S01236.exe file from HTC's website and tried to install it from my device. I got the error that patch is not compatible for my T-Mobile HTC HD2. What happened after was that my HTC Peep started giving me errors.......couldn't update tweets.

I installed your CAB files and everything is restored back to normal........you did an awesome job. Keep up the awesome work. It is because of XDA guys that I still keep my HTC HD2 with WM6.5 with me..........or else the phone is way under designed as compared to what it is capable of doing.

Thanks a bunch!!

AJ
[General Topics] geoponer:
I am currently using kwbr HD v5.7 w/Sense (based on Leo ROM) on my HTC Blackstone and I started having issues when I tried to tweet through the HTC Peep app... in fact my account was "forbidden to access the server".

I was lucky enough to find the solution to this issue in this thread! I just installed the Rhodium .cab in my Blackstone, rebooted and now it works like a charm!

Thank you!
[General Topics] sarah72:
A big thanks to the very clever people at XDA for the Leo cab!

Rebooted once .... Twitter worked, but no other data

Rebooted again ... Data connection back up but not email

Rebooted again ... Everything back to normal!

Never thought I would have missed Twitter so much ... :)
[General Topics] irs2k3:
Excellent Job dude. I had access denied to twitter servers and now everything works well.
[General Topics] JamieKitson:
Thanks, this has fixed my "forbidden" message which cropped up the other day too.
[General Topics] mutoh:
Using Tilt 2 -- logged out of Twitter on the phone, then installed cab.

Phone asks to reboot. After reboot, log back in and Twitter works. No more "Forbidden" screen.

Thanks :D
[General Topics] master415:
hello helllo helo hello
[General Topics] gobbet:
CAB's work

CAB's working very well on Simplicity November 15 custom ROM. Big thanx, dude
[General Topics] cajunflavoredbob:
If you update to the latest beta builds from seeM_ZA, this patch is cooked in, I believe. Most WM chefs have this cooked in to builds subsequent to the beginning March.
[General Topics] amrizal:
:)

A big thanks too to the very clever people at XDA for the Leo cab!
[General Topics] prblake@hotmail.com:
Great work your cab fixed my HD2 in Australia now working.
[General Topics] Z80-Man:
It actually works very well on Energy ROMs.

But the strange thing is NRGZ included the fix in all his recent ROMs, but Peep suddenly stopped being able to login by half April 2011...

And once again, the official HTC fix did the job. ;)

It still doesn't explain why the cooked-in fixed Peep stopped working, though... :p

I'm keeping your CAB handy just in case the problem repeats after flashing another ROM... ;) Thank for the great job ! :cool:

I prefer to know what a patch really does, instead of those "black boxes" HTC provides... :p
[General Topics] cajunflavoredbob:
The first set of fixes were not compatible with custom ROMs because the ROM had to pass a device ID check. If it failed, the so did the update. That's why I made cabs out of the files. The cabs in the next post will work on any device ROM since their is no check for the installation to pass.

The problem with Twitter should be resolved already. All you should have had to do was log out and back in again. Twitter was the problem, not the ROM. They made several posts about it, but claim it is fixed now. The problems (this time) happened when you would flash a new ROM, which would sign you out of the service. When attempting to log back in upon a new flash, the request was denied. The details of this latest problem were not documented as far as I could find. I'm not sure why it happened this time, but it was a global issue. Energy ROMs were not the only ones affected.

I hope this gives you enough detail about it. That's the best explanation I have at the moment.
[General Topics] JVH3:
Just an update on this. Twitter is still working the issue:

http://status.twitter.com/post/5084616143/elevated-error-rates

Not sure if that means everything is still an issue, or just part of it, but I have not been able to log into the twitter tab since flashing.

I was logged in with Rhodium April 26 Cookie 2.0 Energy ROM 29020

Flashed the same flavor, but April 29th. I could not log in.

Flashed back to April 26th. I could not log in.

Since I was originally able to log in with the April 26th ROM, I know the problem is not with the ROM, but with Twitter.com.

From my computer, I've sent them a few tweets. They don't respond.

Personal opinion. Side Rant.

I really think it is time a new company made a competing service to Twitter. It would need to be a company with some strong financials.

Maybe Google and M$ could partner on something.

Twitter did the same thing to clients back in August. When an update fails, you roll it back and analyse the problem and fix it. Then redeploy.

You don't leave a problem in production when it was a newly introduced problem. They obviously don't care about the impact to users using anything but the newest devices or applications.
[General Topics] j_bs:
tweet fix

it seem thr no fix on tis....goin mia on my twit...:(:(:(:(
[General Topics] JVH3:
Twitter has claimed to resolve the issue, but it is not resolved for anyone that has flashed a new ROM or Hard Reset.
[General Topics] dontjudgemekk:
Pretty serious matter, good article!
[General Topics] FABRI68:
The only solution is to ask a new fix to HTC
[General Topics] Nayfuslis:
What is peep for?
[General Topics] cajunflavoredbob:
Not for you.

While Android users running Sense UI do have a Peep application, this applies only to the Windows Mobile version of the application.
[General Topics] preclik:
So, still no news? Flashed new Energy ROM yesterday and I'm getting the "incorrect username" message :/
[General Topics] cajunflavoredbob:
What do you mean "still no news?" Did you read what this fix was for? It has absolutely nothing to do with the current Twitter outage. This is a security fix for Peep, nothing more.
[General Topics] Z80-Man:
I'm urging people around to backup their registry and \Temp\TwitEng folder.

The web Twitter interface is changing too. They apparently decided to go full https very soon.

While it's obviously a good idea, we can fear Peep won't be updated immediately, and BTW I'm not sure HTC will make new efforts towards no longer built devices (though the HD2 wasn't the only WM device with included Peep tab, so maybe)...
[General Topics] cajunflavoredbob:
Stop PMing me, please.

Look, guys, I'm all for helping the community, but seriously, please do a bit of reading before asking for help. I'm getting tired of logging in to find several PMs asking why this fix doesn't let you log into the Twitter tab. Allow me to make it perfectly clear:

This has nothing at all to do with the current Twitter outage within Peep.​

You simply need to either use another Twitter client, which I highly recommend anyway, or pester HTC until they fix it again.

Also, to everyone else who has used this security update for Peep:

This is not a 100% fix. It seems that the initial session is now being sent over https using TCP port 443 (sending against the api.twitter.com domain). This is a good thing.

However, during the rest of the session, Peep switches back to HTTP basic. This is a bad thing. This still leaves the whole session after the initial login vulnerable to hijacking based on the Twitter session ID through cookies. I suggest using a different Twitter client, as neither HTC nor Twitter seem to care for our aging devices.

Post 13 containing the cabs was updated to include this information.
[General Topics] procter:
Has anyone got problems uninstalling JVH3's peep security fix? I always got this msg when trying, "can't be completely removed, do you want to remove it out of the installed programs list?" I clicked yes, but the patch is still listed. Also if I tried to reinstall the patch, the OS would not allow me, saying "already installed and cannot be removed before install the new version". Is there a way to solve this? Thanks.
[General Topics] Z80-Man:
It won't be easy this way.

Since it's not a CAB but an EXE, doing unknown things BTW, you can't just manually remove files and regsitry keys as we just don't know which ones are involved, nor you can't just uninstall it the usual way.

So if there's a CAB form for this patch, then use it preferably.

The first thing to try, though, is closing Peep if it's running in the background, as you obviously won't be able to delete the patch if the program is running. Use your task manager for that, and try to locate and close Peep's running processes.

Anyway, your login problems don't come from having installed the patch, so you could leave it alone as well.

With or without patch, Peep isn't able to generate an acceptable authentification key anymore. You can still log in if you had saved your data previously, and can't if you did not, that's all.

Just use MoTweets or any other client instead.
[General Topics] tirumal:
htc really lags behind. need to improve
[General Topics] cajunflavoredbob:
Uninstall Peep security update

Please read this whole post before trying anything that you are not familiar with.

To uninstall the Peep security fix, you should simply need to stop Sense and then uninstall the fix. It will not uninstall while the Peep service is running in Sense. If it does not uninstall, then you may be able to manually do so. Either method will leave you without use of the tab, however, as they both remove the executable assigned to the Twitter Tab.

Proceed at your own risk. I have warned you. It isn't my fault if you don't know what you're doing.

If stopping Sense and uninstalling doesn't work, then you can manually uninstall it by removing the files and registry values created during the installation. The cabs install four files into the /Windows directory. They are:

HttpClient.dll
MicroBlogUtil.dll
TwitterApp.exe
TwitterCore.dll

It also adds one binary key and four strings to the registry as illustrated below:

HKCU\Software\HTC\TwitterApp
name="dwURLShortHosts"
value="Aw=="
datatype="binary"

HKLM\Drivers\BuiltIn\Hotfix
name="Manila_Twitter_version"
value="20110209-00"
datatype="string"
name="Social_Network_Engine_version"
value="20110209-00"
datatype="string"

HKLM\Software\HTC\HTCAccountManager
name="TwitterPassword"
value=""
datatype="string"
name="TwitterUsername"
value=""
datatype="string"

Removing these will uninstall the fix. These items have previously overwritten the ROM files that were cooked in, and will not repopulate the ROM once deleted.
[General Topics] calli:
Same problem in South Africa.

Pity HTC is not proactive!
[General Topics] reuuin88:
:) thx for this post
[General Topics] cajunflavoredbob:
I'm very tempted to just pull down the security fixes. These aren't going to help anyone anymore. The current Peep outage has nothing to do with these cabs.
[General Topics] Xa0c:
lost connection

very strange indeed - after applying the fix I lost internet connection via activeSync (or wi-fi as far as I can tell, will confirm that tonight) - anyone else hit that wall?

Anyone has any thought on that matter?
[General Topics] cajunflavoredbob:
This has nothing to do with your connection. It only replaces the Twitter.exe file as well as a couple of other things for the application to work properly.

IT WILL NOT ALLOW YOU TO LOG INTO TWITTER ANY LONGER! THIS "FIX" IS NO LONGER USEFUL.

It has been explained several times before. I'm going to remove the cabs from my post as soon as I get home. I'm tired of people not reading about what this does, even though I post about it every few posts.
[General Topics] Xa0c:
Hey man, no reason to shout :) I've installed the security update and *then* lost internet connection via active sync - I'm not trying to login in twitter. I'm trying to have internet connection at all...
[General Topics] cajunflavoredbob:
I wasn't shouting at you. Only the first part was a reply to your post. I seem to have to repeat myself every few posts because people don't read. The caps are just there for others to hopefully take advantage of.

In any case, I lised the files that changed several posts back.
[General Topics] cajunflavoredbob:
*.cabs removed

Due to the high number of posts about this not working as well as the number of people PMing me about it, I have decided to remove the *.cab files from the download post. I have tried to keep everyone up to date on this, but it seems the good have to suffer for the bad.

If you're wondering why I would take down a security fix right now, then you haven't read enough to need it anyway. I'll say it one final time. This fix only applied to the Twitter security update that happened in February. It has nothing at all to do with the outage that is currently going on since the beginning of May.

The current problem is that Twitter put out new regulations on the security measures being implemented on its site. HTC should have updated Peep to use the new measures, but it did not. Our aging devices mean very little to them.

As it stands, anyway, the update I removed only fixed part of the problem. It secured the initial login attempt over https, but failed to do so during the subsequent requests for information. All other requests were done over unencrypted http, meaning that your username and password were still sent in plain text for anyone sniffing packets to read.

The bottom line is that everyone needs to get used to the idea that you'll need to use another client from now on. I have used moTweets for a long while with success.
[General Topics] ltaylor23:
whats is the htc peep
[General Topics] illi:
I use Azurea which is as good:D
[General Topics] cajunflavoredbob:
It's a Twitter client for Sense. This thread deals specifically with the Windows Mobile version. You seem to use Android on a G1, so this doesn't apply to you.
[General Topics] cajunflavoredbob:
I used that for a while too. It didn't support multiple usernames when I tried it, so I started using moTweets. Otherwise, it was a nice and simple client.
[General Topics] joviichow:
solution for the htc twitter problem.
[General Topics] cajunflavoredbob:
Yep. It's users like that other guy that caused me to take it down. I'm still getting PMs about it telling me they get login errors and want it. I'm going to ask that this thread be closed.
[General Topics] JimmyMcGee:
As this states here, this Fix is no longer valid. Please do not try to use this fix!

Thread Closed.(per Request)
[XPERIA X10 General] pedrocel85:
Hi,

Im having one idea for this to be more interesting for our developers to focus on this cracking.

The rules is simple

******

The first one to get the bootloader cracked and able to be able to sign files and flash them in phone via bootloader mode and this files work in a stable way won all money promissed here.​

Be aware we are all gentlemans and be compromised to donate the money you promised and the job is done.

I will start this.

I promisse to donate US$20,00 for the first who broke the bootloader and were able to flash unsigned files into x10.

PLZ DONT POST nothing diferent than the Value you Promise to donate

This Thread is not for discussion

its for ACTION!

MONEY GATHERED FROM OUR MEMBERS SO FAR:

US$ 350,00

EURO €95,00

POUNDS £40,00

​
[XPERIA X10 General] ferratini:
€10 from me.
[XPERIA X10 General] FabricioGS:
US$30,00 from me, but I expect a small flame war here as usual...
[XPERIA X10 General] CROrION:
nice one, 20 USD from me.
[XPERIA X10 General] dlpatter:
Already quacked, parts all over the floor, now if I can only find that bootloader. It's gotta be here somewhere. Oh, here's a piece, yep seems quacked up to me. SE, pleeeseeee give the dev the code, pleeeeseee
[XPERIA X10 General] sinkster:
£20 from me