I don't think they are inspecting the app ; they don't need to. They can see that there are a higher-than-average number of API accesses from a given platform, using the AWS Secret Key as the login credential.
Amazon Is Downloading Apps From Google Play and Inspecting Them
11–20 of 113 posts
Re: Amazon Is Downloading Apps From Google Play and Inspecting Them
#12Anyone who reads the article can see that the author is drawing conclusions from conjecture.
"We were made aware" does not equal "we are downloading apps and inspecting them."
If they were doing that, that would be great! But let's not leap to conclusions.
Re: Amazon Is Downloading Apps From Google Play and Inspecting Them
#13Does Google Play have a public API for downloading APKs? Does it work for paid apps as well? (I'm not able to construct good keywords for search here: Google thinks I'm looking for an APK for the store app instead)
Re: Amazon Is Downloading Apps From Google Play and Inspecting Them
#14Couldn't they just look at the user agent and know that the hit to their API is coming from an Android device rather than a server?
Re: Amazon Is Downloading Apps From Google Play and Inspecting Them
#15I wonder how they would identify a string that appears to be an API secret, and queries their database for it. For every plausible string in every app? I guess they decompile it and find string literals of the correct length?
You can build a trie of all the AWS keys and then for each Android binary, traverse each series of bytes until it either terminates at a leaf node or fails to continue. If it fails, you start over again on the next byte. Or in order words, the trie allows you to easily test if a given byte is the start of an AWS key, and so then you just check every possible offset. Believe the run time will only be O(n*k) where n is the size of the binary and k is the size of the AWS key, plus enough memory to store the trie which is probably relatively small; less than 1m AWS accounts?
Re: Amazon Is Downloading Apps From Google Play and Inspecting Them
#16They did a good thing, title feels slightly misguiding. Could they have figured it out based on API access locations being random?
Re: Amazon Is Downloading Apps From Google Play and Inspecting Them
#17Conjecture, and I guess you're welcome? My guess is if you embedded your Google cloud credentials in your app and it was compromised Google would be happy to bill you, terminate your account, or otherwise provide zero latitude as a customer. At least they dropped their prices, right?
Re: Amazon Is Downloading Apps From Google Play and Inspecting Them
#18Couldn't they just look at the user agent and know that the hit to their API is coming from an Android device rather than a server?
http://developer.android.com/reference/java/net/HttpURLConne... might not have a default User-Agent header that identifies android
Re: Amazon Is Downloading Apps From Google Play and Inspecting Them
#19That's actually kind of awesome. Good on Amazon for taking security seriously.
That's exactly how I felt. And they wrote such a detailed email with helpful links and everything.
Re: Amazon Is Downloading Apps From Google Play and Inspecting Them
#20This is probably a good thing and also automated.
It could have raised alarms and then personally investigated. You Could monitor distribution of AWS connections per client. You could easily determine that accessing the same account from many android devices is probably result of poor security practices.