I see nothing wrong here. They are probably doing this now because it in fact a major problem, even with large, professionally developed apps. About 8 months ago I did a brief analysis of the then-current Vine apk and relatively quickly extracted their S3 credentials (they were not stored in plain text, but close enough). Very bad idea.
Amazon Is Downloading Apps From Google Play and Inspecting Them
21–30 of 113 posts
Re: Amazon Is Downloading Apps From Google Play and Inspecting Them
#22I understand perfectly how people end up mistakenly pushing credentials into public source repos when releasing server-side stuff. But I don't get how a seemingly sane person develops an application intended for distribution to the public which contains AWS credentials.
At what point in your development process do you say "I want this application, which will be distributed to unknown persons, to contain the means to control my AWS account."?
Re: Amazon Is Downloading Apps From Google Play and Inspecting Them
#23I wonder how they would identify a string that appears to be an API secret, and queries their database for it. For every plausible string in every app? I guess they decompile it and find string literals of the correct length?
AWS knows the clients that are connecting to it. All they have to detect is that a large amount of traffic is coming from a wide distribution of mobile devices. This is indicative they embedded the creds into the APK. If they got the creds from a server during runtime, it would be safer to proxy to AWS through the server itself, and never distribute the sensitive data. This would result in only a few proxies connecting to AWS.
Amazon surely has automated this with monitoring. I doubt they ever scan Google Play and download the APKs and scan them. Not only is that extremely wasteful it's most definitely violating the Google Play terms of service.
Re: Amazon Is Downloading Apps From Google Play and Inspecting Them
#24Couldn't they just look at the user agent and know that the hit to their API is coming from an Android device rather than a server?
Most probable.
Re: Amazon Is Downloading Apps From Google Play and Inspecting Them
#25I don't think they are inspecting the app ; they don't need to. They can see that there are a higher-than-average number of API accesses from a given platform, using the AWS Secret Key as the login credential.
I think this is a more plausible approach (and likely cheaper resource-wise to implement). Though, if the authentication requests somehow identify the Android app in question, it might be easy for Amazon to then perform a follow-up and download the app to verify their suspicions and avoid false-positives.
Re: Amazon Is Downloading Apps From Google Play and Inspecting Them
#26great for them. i worked for an unnamed company who was shipping AWS credentials in clients for years. worse, they were not clients that required a packaged binary (no need to decompile). it's long since patched but i can't believe no one ever sniffed that out.
Re: Amazon Is Downloading Apps From Google Play and Inspecting Them
#27Couldn't they just look at the user agent and know that the hit to their API is coming from an Android device rather than a server?
This is a bad idea.it's easy to change the user agent to whatever you want.
Re: Amazon Is Downloading Apps From Google Play and Inspecting Them
#28I wonder if any malicious parties have been doing this as well.
That's exactly what Amazon trying to prevent.
Re: Amazon Is Downloading Apps From Google Play and Inspecting Them
#29Re: Amazon Is Downloading Apps From Google Play and Inspecting Them
#30I don't think they are inspecting the app ; they don't need to. They can see that there are a higher-than-average number of API accesses from a given platform, using the AWS Secret Key as the login credential.
But then how would you automatically identify the app name as shown in his email? I think it's easier to download the app. Only ~1m android applications out there. You can probably crawl the android store with just 1 or 2 servers using the algorithm I described below with a trie. Identifying patterns from random data seems way harder to get right, but maybe that's because I have a CS background rather than a statistics one.