420 code solution #171
Comments
|
I read somewhere that perhaps cheap Chinese android phones may be able to generate some default certificates without play store ? Im sorry if that sounds vague, Im on IOS. Maybe the solution lies there. |
I think amazon would figure out what kind of phone it is from the user agent and ban all certificates generated this way. I think there should be a way to generate the certificates yourself. |
|
does anyone have any clue about how the commercial signature providers are able to do it ? I dont use one but Im curious to know what details you need to send them to be able to produce a signature. Maybe thats a place to start ? |
|
What I have so far. And then got a response: I tried looking at the certificate using the command: openssl x509 -in cert1.pem -text -noout and what can I see: ozSGSaxdQrh1VsOyXikrzk== is my nonce that I got from: https://prod.us-east-1.api.app-attestation.last-mile.amazon.dev/v1/nonce/id/ |
They don't work with a single users, only with commercial bots. So we don't know |
|
thats the 1st time ive seen one of the certs from a genuine request What happens if you substitute our own pub key in cert1 ? |
I'm using an android emulator to see these certificates. Here's what cert3 looks like: |
|
So first of all we need to find what valid certificates look like |
|
The cert2 and cert3 are always the same, as I see in my emulator, only cert1 changes. I think we need to find what a working cert1 looks like and try to generate the same one |
|
And also we need learn how to decode this. That's a lot of work for us to do heh. I need help here |
|
I managed to decode 1.3.6.1.4.1.11129.2.1.17. It wasn't too hard, if you google "1.3.6.1.4.1.11129.2.1.17" you will find all the necessary information. Here's the information inside this extension: |
|
Youve been busy. Is this from a rooted phone ? |
Yes, its Android Studio emulator with Magisk |
|
So I guess the next step is to find an emulator that can pass the root checks/playstore. I’m sorry if that’s not the right terminology I’m an iPhone man |
|
Yeah, that's the hardest part |
|
That’s why i think the focus should be on IOS. I think the iPhone gets its private key and keyid on install of the flex app and it’s stays through the life of xflexinstanceid. There’s no attestation traffic I’ve ever seen while the app is running. Plus IOS requests are easily intercepted with MITM without requiring the phone to be jailbroken. |
|
Hi guys, I haven't figure out myself how they bypass it. But few guys in previous thread shared hint that it possible to get keys from some Android devices. Couldn't amazon app save some certs in keystore. Can we just export those from keystore and provide for aws attestation? And we can generate multiple of those but reinstalling app or so? ( sorry I am not really into mobile tech) I'll start to ding into it soon. I have few Android specialists in friend list they may help. If you don't want to continue discussion here write me in telegram:@hoqua or email meat159@gmail.com |
Please discuss it here. Everyone will be grateful for your solutions |
I have a rooted android physical phone with play store. Let me know if you need some help. |
|
We're one step away from finding a solution. All we need is to find a way to see what certificates the flex app sends to app-attestation to get keyId. |
|
I think that can be captured using charles proxy
…On Sat, Mar 16, 2024 at 12:38 PM julio03451 ***@***.***> wrote:
We're one step away from finding a solution. All we need is to find a way
to see what certificates the flex app sends to app-attestation to get keyId.
—
Reply to this email directly, view it on GitHub
<#171 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/A6V47KYULLFU343CZPK5J7DYYRYPBAVCNFSM6AAAAABEQNSMV2VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMBSGA2DANJSG4>
.
You are receiving this because you are subscribed to this thread.Message
ID: ***@***.***>
|
|
Can anyone please tell us what exactly the 420 error means? It's not captcha at least in my case. Im sending the post request as exactly the real app send it, only change its of course the 'offer id' in the boy, and the 'X-Amz-Date' in the Header, first I was receiving 400 code {"errorCode":null,"message":null}, now I got 420 {"errorCode":null,"message":null}. Can somebody guide us where the problem is, so we can try to fix it. Thanks. |
because those are the intermediate certs. Amazon needs the whole chain to verify the key:
The root and intermediate are generally "static", they won't change unless expired or revoked for some reason. With that knowledge, all it takes for attestation to work is:
|
That's our main problem right now. We don't know how to retrieve these certificates. |
|
rsyccd as I understand, you were able to get a valid certificate chain from the app. Can you share one such chain so we can see how it should look like? |
|
Finally found a certificate chain in one of the repositories on github and was able to get a valid keyId. I am now 100% sure that there are some interested developers at Amazon. They left an incredible backdoor in the Key Attestation implementation. That couldn't have been left by accident. So don’t worry, there will always be "solutions". |
Wow, thats awesome, are you saying that the certificate chain you found will work for any device ? |
Yes, they don't verify this chain as it is written in Google best practices https://developer.android.com/privacy-and-security/security-key-attestation . It's insane haha |
|
I understand you may be reluctant to post the solution on here, there is the private telegram group if you feel more comfortable |
Hi, please email me at 08better.gamiest@icloud.com |
|
Friends, does anyone know where I can find the Amazon Flex I can’t promise anything as I’m completely noob here, but above making this right I feel the urge of understanding how to put it all together. Thanks! |
|
@grosn89 check it out, archived and uploaded here: https://file.io/0aQVp2Hydfjg |
|
@Sudo989 could you please send me a copy? |
Onlynewone5656@gmail.com |
Why you not answering? Write me on email from bio |
How about you keep it shut, since all you can do is moaning like "Plz do not discloz publicly Amazon Fleks flaaaw" and "Write me on email from bio?". I am reviewing @julio03451 and I gotta say the guy is a genius. I don’t understand everything and although I’ve spend the whole day pulling my hair on how to make things right, I got some questions for the guys interested (in order for me to be in the right direction). What have you understood, so far, about Julio’s piece of work? What is your solution to get a valid attestation from Amazon Flex? On my side, I didn’t provide any certificate yet I was able to claim a keyID, but this always let to a 420 error. So now I’m digging deeper into these certificate issues. It would be great if you shared your way of claiming valid attestations so I can share my potential deductions before trying things that would lead to nowhere. Oh, and btw, 🖕 Amazon Flex. 😃 Best. |
|
|
Okay champs. I’m writing things up before getting some rest. I’m not sure about the fact that there are interested people in Amazon Flex leaving a backdoor. I’d rather say they made a lazy solution just to prevent most of the bots from working, until they enforce the right security measures to mitigate “botting”. From what I’m hearing there are still some people who are able to make things work out there. The question is: for how long? Because as long as best practices will be enforced, it will be pointless to extract a certificate chain from a random device as you’ll have to make your own certificate be signed from it’s parent, which secret keys lies in a Trusted Execution Environment most of the time (and, unless you’re an actual genius, you won’t be able to recover the secret key… Or you’d be working at the NSA already, maybe?!). And regarding the Android emulators, the intermediate certificate’s private key is… Well… Public! And Amazon denied emulators way before. So this option is pointless. I even get kicked with an emulator without having patched the app. There must be a way and I’m digging into this. But the more I’m digging, the more I feel like satisfying my knowledge rather than playing cat and mouse w/ Amazon Flex. Anyway: it’s all like falling down the rabbit hole. Good night! |
it won't be the end of anything. The whole attestation thing is targeting a "loophole" that most bots don't even use - hijacking the actual Flex app. So yes, with proper attestation you won't be able to modify, spoof, or run the official app in an untrusted environment (vms and emulators) but we already don't do that, and there's nothing Amazon can do about us interacting with their APIs as long as 1. they are publicly exposed and 2. we have control over the client. Most they can ever do is increase detection capabilities and ban/block bot users. |
|
But playintegrity is needed for keyid
keyid and privatekey is needed for signing requests.
Of course it’s the end for now until playintegrity is hacked.
On 13 Jun 2024, at 17:19, RS ***@***.***> wrote:
if Amazon guys implemented real key attestation as written in google's best practices, this should be the end.
it won't be the end of anything. The whole attestation thing is targeting a "loophole" that most bots don't even use - hijacking the actual Flex app.
So yes, with proper attestation you won't be able to modify, spoof, or run the official app in an untrusted environment (vms and emulators) but we already don't do that, and there's nothing Amazon can do about us interacting with their APIs as long as 1. they are publicly exposed and 2. we have control over the client. Most they can ever do is increase detection capabilities and ban/block bot users.
—
Reply to this email directly, view it on GitHub<#171 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AOTJPDELBCHL2T74SHMESILZHHBBJAVCNFSM6AAAAABEQNSMV2VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDCNRWGE2DENRTHA>.
You are receiving this because you were mentioned.Message ID: ***@***.***>
|
|
@Vasa211 send me an email lpqssq@gmx.com |
|
please like or dislike my comment if you received a solution from @Vasa211 |
I have nothing to do with it. I don't have a solution for you! |
@MY20-PHEV no one needs to hack play integrity, just like no one had to "crack the android keystore" as people were fixated on in the other thread, despite my best attempts of explaining otherwise. The END has already (again) been postponed for a later date, plenty of folks have their code up and running (including the commercial bots). |
Sincerely hope your right mate |
|
May I please have a copy. Thank you On Jun 8, 2024, at 6:26 PM, nemo03 ***@***.***> wrote:
I have the solution. The repository won't be made public this time. Email me for a copy.
If you're able to share the code with me, I would greatly appreciate it. my email is ***@***.***
—Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>
|
|
***@***.*** Jun 8, 2024, at 7:57 PM, Gustavo Biaobock ***@***.***> wrote:
***@***.***
Thank you!
—Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>
|
|
I think that several people have the solution but they don't share it for commercial reasons. I have asked on Telegram and nobody answers, meaning that those who are there have found it and don't want to share it. For this reason, I have decided to make public my progress on the work I have done and I think I am close enough to achieve it. |
|
I managed to capture the parameters sent from a non-rooted Android device. These are the parameters sent from the register-attestation: Using You can see that before the package was: Compared to the previous version there are some changes in the Key Description. The most notable is the attestationApplicationId. I have made the changes in I have changed the private key generation to The certificate generated is identical to the one generated from an Android device, but for some reason I keep getting the 201. If anyone wants to give me any insight into what I'm missing or missing, let me know. Thanks |
|
@jaimbox , Sounds Good. Would you share me How to capture the parameters sent from a non-rooted Android device? My Phone is Pixel 4a that is on Android 13. |
decompile the APK, prepare it for HTTPS inspection and rebuild it, you can use APKLab in VS Code |
|
@jaimbox How are you able to get the certificates from the device ? |
|
@jaimbox I got past the 201 error by copying an old config files keys as I noticed the new config file wasn't updating and it caused the 201 error, or at least it fixed it. Just got a new refresh token. After getting past the 201 error I ended up getting ErrorType: missing 1 required positional argument: 'cert_chain' Then I think I fixed that Error type but then got an AttributeError, and I couldn't fix that. I was supposed to attribute the cert chain to something but maybe you can tell, I have absolutely no idea what I'm doing, just barely enough to get by. |
|
I have successfully rooted a
I noticed that the |
|
@jaimbox before the last update, there was only 3 certs in the keyAttestation. If we could figure out how cert4 is generated, it might solve our problem. I tried modifying the APK and recompiling it, but no luck. do you have any insights on where cert4 comes from? |
cert4 certificate is a part of the response from the Play Integrity API. The process begins by creating a request that includes a nonce (a unique, random string). This nonce is crucial because it ensures that each request is unique and prevents replay attacks. cert4 is included in certification chain. Basically client generates a random string, referred to as a nonce. The docs recommend nonce to be comprised a combination of random data or session-specific information from client device. We need to try combination of all the headers and see which works. |
|
How annoying you are! |
|
Please email me, if you are signature service |
and others
Let's find the solution here
The text was updated successfully, but these errors were encountered: