Viber Communication Security - Bad Request

Experiments Chapter 3
1 private class ProdServerConfig extends ServerConfig . IServerConfig
2 {
3 public ProdServerConfig ()
4 {
5 super ();
6 this . url_activation_request = " https :// secure . viber . com / viber / viber . php ?
function = ActivateUser ";
7 this . url_registration_request = " https :// secure . viber . com / viber / viber . php ?
function = RegisterUser ";
8 this . url_country_request = " https :// secure . viber . com / viber / viber . php ? function =
GetDefaultCountry ";
9 this . url_deactivation_request = " https :// secure . viber . com / viber / viber . php ?
function = DeActivate ";
10 this . url_generate_device_key = " https :// secure . viber . com / viber / viber . php ?
function = GenerateDeviceKey ";
11 this . url_generate_device_key_done = " https :// secure . viber . com / viber / viber . php ?
function = GenerateDeviceKeyDone ";
12 this . url_update_phone_request = " https :// secure . viber . com / viber / viber . php ?
function = UpdatePhone ";
13 this . url_voip_host = " aloha . viber . com ";
14 }
15 }
Listing 6: ProdServerConfig URL’s in class com.viber.voip.ServerConfig
One could easily see that the generateSignature method uses a Hash-based Message Authentication
Code (hmac) based on sha -256, and a statically configured secret key with the value 5eb6588086b6b2d054af80527b
We suspect that before the method is executed, an xml -based request is built by other application
code and then passed onto the generateSignature method which outputs a signature of that input.
Once this is transmitted along with the xml -based request, it provides integrity of the contents of
the request.
Lastly, we have selected some interesting methods regarding sending/receiving messages. First,
the code of the sendNewMessage method shown in listing 7. This method takes two parameters:
the recipient’s number, the text of the message, and the current time in milliseconds, respectively.
Amongst other things, it then passes these parameters on to the method insertNewMessage along
with nine other static values.
1 public void sendNewMessage ( String paramString1 , String paramString2 )
2 {
3 log (" sendNewMessage ␣ toNumber :" + paramString1 + ",text :" + paramString2 );
4 insertNewMessage (null , paramString1 , paramString2 , System . currentTimeMillis () , 1,
0, 1, 0, 0, 3, " text ", false );
5 sendPendingMessages ();
6 }
Listing 7: Method sendNewMessage in com.viber.voip.messages.MessagesManager
Since the actual insertNewMessage method is long and not very interesting, we decided to show
the code of the createMessageValues method instead, see listing 8. The reason is that this method
clearly shows the meaning of almost all the different parameters passed to the insertNewMessage
method.
30