Amazon Is Downloading Apps From Google Play and Inspecting Them
blog.rajbala.com
Amazon Is Downloading Apps From Google Play and Inspecting Them
1–10 of 113 posts
Re: Amazon Is Downloading Apps From Google Play and Inspecting Them
#2That's actually kind of awesome. Good on Amazon for taking security seriously.
Re: Amazon Is Downloading Apps From Google Play and Inspecting Them
#3This is probably a good thing and also automated.
Re: Amazon Is Downloading Apps From Google Play and Inspecting Them
#4I hope other developers see this and take action if they aren't properly securing cloud API keys. Data access by an unauthorized party is not something you want to deal with.
Re: Amazon Is Downloading Apps From Google Play and Inspecting Them
#5I wonder if any malicious parties have been doing this as well.
Re: Amazon Is Downloading Apps From Google Play and Inspecting Them
#6This seems to be the natural outcome of Amazon's excellent customer service policy, where they have on numerous occasions[0] refunded costs for hacked instances. When they commit to that policy, they have a huge incentive to limit customer security breaches.
I love examples like that where a company's policies result in incentives that are so well-aligned with those of their users. Does anyone have other good examples to share?
[0] https://securosis.com/blog/my-500-cloud-security-screwup and http://vertis.io/2013/12/17/an-update-on-my-aws-bill.html are two examples.
Re: Amazon Is Downloading Apps From Google Play and Inspecting Them
#7I wonder if any malicious parties have been doing this as well.
[deleted]
Re: Amazon Is Downloading Apps From Google Play and Inspecting Them
#8One of the things that justifies the higher prices.
+1
Re: Amazon Is Downloading Apps From Google Play and Inspecting Them
#9I wonder how they would identify a string that appears to be an API secret, and queries their database for it. For every plausible string in every app? I guess they decompile it and find string literals of the correct length?
Re: Amazon Is Downloading Apps From Google Play and Inspecting Them
#10I wonder how they would identify a string that appears to be an API secret, and queries their database for it. For every plausible string in every app? I guess they decompile it and find string literals of the correct length?
Probably just looked in strings.xml and perhaps for some obvious variable names / validation against string values. There might be some hashing check they can do that means they don't query every valid string in their database.