[xsacha]

Info

Hello everyone!
So Blackberry have told me it's not good to distribute files from Blackberry World. However, it is perfectly fine to download them directly from Blackberry's website yourself.
For this reason, I have set up a web site that generates download links to the actual .bar file so you can download it yourself!

So, here it is:
Bar File Downloader

Authorization code

You will need an authorization code to use this generated from your Blackberry ID.

Here's a simple method that doesn't require using your login details:
1. Download Burp Proxy (requires Java)
2. Open the app and go to Proxy->Options. Take note of the 'Interface' in Proxy Listener -- this is your Proxy Server (should be your WiFi IP!) and Port. Then scroll to the bottom and Enable a blank SSL Pass-through.
3. On your phone, go to Settings->Network Connections->Wifi. Hold your active connection and tap 'Edit'. Scroll down to 'Use Proxy' and enable this. Fill in your 'Proxy Server' and 'Port' as seen in previous step. Then press Connect.
Repeat when necessary:
4. Whenever you want to generate an Authorization token: open Blackberry World, swipe down and hit 'Redeem'. Enter any promotion code and OK.
5. Back in Burp, go to the HTTP History tab. At the bottom of the list you will see an appworld.blackberry.com 'POST' Method. Click on this and then copy the 'Authorization' code visible.

FAQ

Q. What is an application ID?
A. It's the ID number you see when browsing Blackberry World online. If you're feeling lazy, just paste the entire link in -- that works too! For example: BBM - BlackBerry World

Q. When I download the file, it downloads it as a .zip file instead of a .bar. How can I make it download with the right filename?
A. There isn't a way in a web browser unfortunately. You'll have to manually rename it to a .bar. My own personal app does not have this problem but I'd prefer not to maintain a native app.

Q. Is this a security exploit? Should we report it to Blackberry?
A. I did report this as an issue but Blackberry do not care. It is not considered an exploit and they do not intend to ever patch it. I provided a quote from Blackberry on the webpage explaining that you should not distribute the resulting downloads.

Q. Can I redistribute the .bar files I download from Blackberry?
A. No

Status

* You can generate your own authorization token on your own device.
* You can download any free app.
* There's no way, yet, to choose OS or device. For now, it is hardcoded to be a Z10 on latest OS.

Security

I do take security at Blackberry very seriously. Here is a listing of my security reports for the month of November, 2014:


Note that Blackberry do not pay me anything for this. If you like my work on security, please donate

[toobs623]

Thanks Sach!

Posted via CB10

[FrankIAm]

xsacha, you are like the BB10 god.

Thanks, once again.

[mrfreeze]

Awesome! Thanks Sacha!

[SteelGreek]

Awesome work!!

Z30STA100-3/10.3.1.1154

Posted via CB10

[toobs623]

xsacha, you are like the BB10 god.

Thanks, once again.

No like, He is a BlackBerry god...

Posted via CB10

[moody]

This is great xsacha!! Thanks so much for all you do for this community!

I am.... Mrs. Peevishlicious .... May he troll in peace. ❤

[3hb78ftg]

Thanks for this Sacha.

I was once abducted by aliens.

[qmendiv]

Thanks Sacha! You rock, man!

Posted via CB10

[FrankIAm]

Inb4 butthurt developer

[Pdinos3]

You're awesome, sacha!


Via CB 10 PassportSQW100-1/10.3.1.1154

[tdyhedge]

Can't wait to try this out! Thanks!

[anon(9208252)]

I don't know you Sacha, lol but i think what you do is fantastic for this CB community.

Thanks for everything

[SteelGreek]

I don't know you Sacha, lol but i think what you do is fantastic for this CB community.

Thanks for everything

Thank you as well good sir

Posted via CB10

[anon(9208252)]

Thank you as well good sir

Posted via CB10

Thank you very much for the kind words, but i don't believe i know you either,

[moody]

I don't know you Sacha, lol but i think what you do is fantastic for this CB community.

Thanks for everything

I just want to know what he looks like....

I am.... Mrs. Peevishlicious .... May he troll in peace. ❤

[QtHelex]

I really hope BlackBerry will close this security hole pretty soon. If you really want to achieve that native developers will completely stop to develop for BlackBerry devices then continue with your work...

[mrfreeze]

I really hope BlackBerry will close this security hole pretty soon. If you really want to achieve that native developers will completely stop to develop for BlackBerry devices then continue with your work...

Here we go...The debate begins (again and again)!

[SteelGreek]

I really hope BlackBerry will close this security hole pretty soon. If you really want to achieve that native developers will completely stop to develop for BlackBerry devices then continue with your work...

BlackBerry itself said this was fine to do

Sent from my Z30 using Tapatalk

[masterscarhead1]

I really hope BlackBerry will close this security hole pretty soon. If you really want to achieve that native developers will completely stop to develop for BlackBerry devices then continue with your work...

You seem pretty clueless for a developer
Did you not understand that only free apps can be downloaded? How is this a security hole?
If it makes you feel happier, this doesn't affect your sales...
I take that back. I'm sure someone will decide not to support you after reading your comments

[QtHelex]

You seem pretty clueless for a developer
Did you not understand that only free apps can be downloaded? How is this a security hole?
If it makes you feel happier, this doesn't affect your sales...
I take that back. I'm sure someone will decide not to support you after reading your comments

Maybe you have no idea what you're talking here. So maybe I could call you a clueless user which has no idea what this means for a developer.

You are by the way not forced to use any of my apps.

[thurask]

*popcorn*

Great work as usual. Although paid apps should, in my opinion, require a BBID check (and hence stay on mobile Sachesi).

Posted via CB10

[pttptppt]

Xsacha how exactly does this work? What is your magic?

Posted via CB10

[mrfreeze]

Xsacha how exactly does this work? What is your magic?

Posted via CB10

It's a secret sauce.

[thurask]

Xsacha how exactly does this work? What is your magic?

Posted via CB10

That would ruin the illusion.

Posted via CB10