Applidium successfully reaches Apple’s server not via iPhone, but on a computer

Nov 15, 2011 07:44 GMT  ·  By

Remember the group of developers who ported VLC Player to iOS and had their app later banned from the App Store? Well, they thought some revenge was in order (not really), so they reverse engineered Siri and made it work on a computer.

They say they were able to crack open the assistant’s protocol based on which it talks to Apple’s servers to retrieve and serve data.

“Interestingly, Apple explained that Siri works by sending data to a remote server (that’s probably why Siri only works over 3G or WiFi),” they write in a blog entry. “As soon as we could put our hands on the new iPhone 4S, we decided to have a sneak peek at how it really works.”

“Today, we managed to crack open Siri’s protocol. As a result, we are able to use Siri’s recognition engine from any device. Yes, that means anyone could now write an Android app that uses the real Siri! Or use Siri on an iPad! And we’re going to share this know-how with you.”

They made a demo of Siri’s speech-to-text feature “and got a perfect result”. They also posted their recording for download. “This sound sample never went through any iPhone, but nonetheless we got Siri to analyze it for us,” Applidium developers elaborate.

The hackers explain that all they had to do was set up a custom SSL certification authority, add it to their iPhone 4S, and use it to sign their on certificate for a fake address

“And it worked : Siri was sending commands to your own HTTPS sever! Seems like someone at Apple missed something.”

The team explains that without an iPhone 4S, you can’t get Siri to do its thing the way it’s supposed to. The reason? “The iPhone 4S sends identifiers everywhere. So if you want to use Siri on another device, you still need the identfier of at least one iPhone 4S.”

While the team is reluctant to publish theirs, they note that it’s pretty easy to retrieve one using the tools they’ve coded. Apple, however, may blacklist identifiers used ‘illegally’.