Viber Communication Security - Bad Request

Experiments Chapter 3
It does nothing more than making sure any value’s format should be 40 characters in total, where
the only allowed characters are the (non-capital) letters ‘a’ through ‘f’ and all numbers. Assuming
the hash in the str2 variable complies with this requirement, it is written to the corresponding
configuration file and from now on used as the udid .
The above theory has been tested to be valid. For example, when Viber is registered in an Android
Virtual Device (avd) , which is nothing more than a way to emulate an Android device on a regular
computer, the default imei of 000000000000000 for any avd is hashed into c02c705e98588f724ca046ac59cafece65501e
1 static
2 {
3 [...]
4 UDID = Pattern . compile ("[a-f0 -9]{40} ");
5 [...]
6 }
Listing 4: UDID pattern in class com.viber.voip.util.Patterns
We found another interesting method regarding the process of registration. This method is named
generateSignature and the corresponding application code is shown in listing 5. Just like the earlier
described method which generated a udid, the method we are describing in this paragraph is also
just a small part of Viber’s entire registration process. The method is part of the generation of a
device key based on an input string passed along to the method. This probably sounds similar to
the udid we earlier described but in fact it is not. Instead, the device key is generated by the Viber
services and not at the client-side. When the registration process of a new Viber account is initiated,
an SSL certificate is retrieved and used to communicate with a web server of the Viber services over
http Secure (https) . The URLs for the registration process are present in the application code,
shown in listing 6.
1 private String generateSignature ( String paramString )
2 throws Exception
3 {
4 SecretKeySpec localSecretKeySpec = new SecretKeySpec ("5
eb6588086b6b2d054af80527b26caf71d165042175e0f9550ea58a8 ". getBytes () , "
HmacSHA256 ");
5 Mac localMac = Mac . getInstance (" HmacSHA256 ");
6 localMac . init ( localSecretKeySpec );
7 byte [] arrayOfByte = localMac . doFinal ( paramString . getBytes ());
8 StringBuffer localStringBuffer = new StringBuffer ();
9 int i = arrayOfByte . length ;
10 for ( int j = 0; ; j ++)
11 {
12 if (j >= i)
13 return localStringBuffer . toString ();
14 localStringBuffer . append ( Integer . toHexString (256 + (0 xFF & arrayOfByte [j])).
substring (1) );
15 }
16 }
Listing 5: Method generateSignature in class
com.viber.voip.registration.GenerateDeviceKeyManager
29