Windows Phone Marketplace Prone To Security Breach

Microsoft has another security problem on its hands after reports emerged that its Windows Phone Marketplace can be cracked.

This news spread around the blogosphere after Windows Phone Central posted a 29 December proof-of-concept video illustrating what some third-party developers have previously suggested.

“A ‘white hat’ developer has provided WPCentral with a proof-of-concept program that can successfully pull any application from the Marketplace, remove the security and deploy to an unlocked Windows Phone with literally a push of a button,” Windows Phone Central’s Daniel Rubino wrote in a 29 December posting. “Neither the app nor the methodology is public, and it will not be released (please don’t ask). It is important to note that this was all done within six hours by one developer.”

White Hat Hack

The four-minute proof-of-concept video shows the program pulling live data from the Marketplace in response to typing in a keyword (such as “Movies”), downloading a fully cracked app, and then installing it on a device via a XAP Installer. Any app can supposedly be downloaded and installed.

“We have heard many complaints from developers about this weakness for months now and it is their right to know about the flaws in the system,” Rubino wrote in his blog posting. “We are confident Microsoft will work hard to implement a stronger DRM system, in part due to this proof-of-concept demonstration.”

When queried by eWEEK, Microsoft officially had no comment.

Microsoft has long viewed a robust apps marketplace as central to its attempts to revive its fortunes in the smartphone market. As part of that effort, the company spent much of the summer encouraging third-party developers to create Windows Phone 7-supported programs. And according to one analyst, the effort could be paying off.

More Apps Than Android

“Released in October, WP7 ends 2010 with over 5,000 apps in its marketplace, a milestone it reached quicker than the Google Android platform, which took almost three times as long to reach the same level,” Al Hilwa of research firm IDC wrote in a 29 December research note. “Of course the circumstances for such comparisons are never identical, and Google followed a more gradual and tentative launch for Android compared to Microsoft’s well-orchestrated big-bang approach.”

Microsoft claims some 1.5 million Windows Phone 7 smartphones sold during the platform’s first six weeks of release. However, that figure represents sales from manufacturers to mobile operators and retailers, not consumers. The company faces substantial competition for the consumer smartphone market from both Google and Apple, which respectively activate hundreds of thousands of devices per day, and boast app marketplaces with hundreds of thousands of offerings.