Thursday, October 31, 2013

Should you encrypt your application preference file ?

Do you know there are websites which provides you with preference file where you can get unlimited coins or premium cash for any games. You don't need to root your iPhone or an Android phone. Only software you need to download is iFunbox. There are many other software's like iFunbox but i have checked with only iFunbox.

What is preference?
Preference is a file where you save most of the data of  game or application in iOS. Most of the game developer don't encrypt the preference which lead to most hackers changing the values thereby increasing the coin or premium cash count.

What does iFunbox do?
iFunbox is a software which reads package contents of App store build and allows you to write certain data too. Its like File manager for Android but the software is for Mac. iFunbox does many things, but i am concentrating only on preference part, just Google to find out more about it.

What does a hacker do with preference?
Hacker just downloads the preference file from library or any other place where the developer has saved the preference file through iFunbox and just changes the value of the preference.

Why is it easy to change the preference ?
Most developers would give names like Coins, Cash, power-up etc strings in preference where even a noob can find out.

As a tester we have to make sure that preference file should be a non editable file. Ask you developer to encrypt the preference file before providing the build to App-store to ensure there wont be any preference hack in your application. Make sure you have this case in your TSP or release checklist.

P.S
I have not provided the link to software nor the websites because its not legal thing to do :/