Viber Communication Security - Bad Request

Experiments Chapter 3
1 String GetDeviceUDID ( Context paramContext )
2 {
3 log (" GetDeviceUDID ");
4 SharedPreferences localSharedPreferences = PreferenceManager .
getDefaultSharedPreferences ( paramContext );
5 Object localObject = localSharedPreferences . getString (" viber_udid ", "");
6 log (" UDID ␣in␣ preferences :" + ( String ) localObject );
7 if ((( String ) localObject ). equals (""))
8 {
9 log (" UDID ␣ not ␣ found ␣in␣ preferences ,␣ generate ");
10 String str1 = (( TelephonyManager ) paramContext . getSystemService (" phone ")).
getDeviceId ();
11 if (( TextUtils . isEmpty ( str1 )) || ( str1 == null ))
12 {
13 SecureRandom localSecureRandom = new SecureRandom ();
14 str1 = localSecureRandom . nextLong () + localSecureRandom . nextLong ();
15 }
16 try
17 {
18 String str2 = Convert . getSha1 ( str1 );
19 localObject = str2 ;
20 if (! Patterns . UDID . matcher (( CharSequence ) localObject ). matches ())
21 throw new IllegalStateException (" error ␣ generating ␣ UDID ␣-␣ pattern ␣ doesn ’t␣
match !");
22 }
23 catch ( NoSuchAlgorithmException localNoSuchAlgorithmException )
24 {
25 throw new IllegalStateException (" error ␣ generating ␣ UDID ");
26 }
27 localSharedPreferences . edit (). putString (" viber_udid ", ( String ) localObject ).
commit ();
28 }
29 log (" UDID ␣is␣" + ( String ) localObject );
30 return ( String ) localObject ;
31 }
Listing 3: Method GetDeviceUDID in class
com.viber.voip.registration.HardwareParametersImpl
This above piece of code is actually responsible for the generation of an Unique Device Identifier
(udid) . Basically, it first looks in the corresponding locally stored configuration file of Viber to see
if a udid is already established. If it is, it simply returns the udid as a string. Otherwise, it calls the
getDeviceId method in the Android framework and stores the result in the str1 variable. Normally
the getDeviceId method returns the International Mobile Equipment Identity (imei) number (for
Global System for Mobile Communications (gsm) -based Android devices).[36]
If it does not return anything, a “a pseudo-random uniformly distributed long” is generated by the
method nextLong of the SecureRandom class and stored in the str1 variable.[37] The content of the
str1 variable (either the imei or random number) is then hashed with Secure Hash Algorithm (sha) -
1. The resulting hash is stored in the str2 variable and compared to a pattern to verify its format
is correct. The code of this pattern is shown in listing 4.
28