Nokia engineer Justin Angel has found exploits within Windows 8 that allow games to be downloaded for free. However shortly after his tweet of the news the page seems to have gone offline. We don’t know whether the content has been too popular or too edgy. His intention was to publicise these hacking instructions in the name of exposing security flaws which could hurt the developer community.
According to VentureBeat writer John Koetsier, who used of the Google cache to probe further, Angel showed five different ways in which users could hack Windows 8 games to:
1. get free in-app purchases by modifying encrypted IsoStore files
2. crack trial apps and get paid versions for free
3. remove in-app ads from free games
4. reduce the cost of in-game paid items
5. unlock paid levels by script-injection techniques
As well as detailing the hacks Angel described his own testing of the exploits which enabled him to do such things as gifting himself over $1,000 worth of in-app purchases within Soulcraft THD.
Mr Angel said his focus was upon games because “they account for 51%+ of developer revenue on every mobile developer platform”. Also “official Microsoft statistics show that 64% of app purchases on Windows Phone 7 are for games”. It’s obviously an important and lucrative sector of the app market.
The summary of Mr Angel’s blog post said that most of the ways that developers can make money on the Windows 8 platform aren’t secure by default. In all variety of apps constructed with a wide range of programming tools (C++, C# , XAML , Direct3D , HTML & WinJS apps) he could successfully use exploits to get something for nothing. A lot of the security bypasses were due to data being stored on the local Windows machine. Mr Angel does try and suggest possible fixes and improvements that Microsoft could implement to tighten up each of the loopholes. He concludes that “if Microsoft doesn’t take it upon itself to fix these security attack vectors it’s not because it couldn’t, it’s because it chooses not to.”
Though the original hack instructions blog post is down, you can read the full thing on Scribd.
