Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Amazon Is Downloading Apps From Google Play and Inspecting Them

blog.rajbala.com

Post reply on HN
Print view View original

31–40 of 113 posts

Re: Amazon Is Downloading Apps From Google Play and Inspecting Them

#32

Post by kruk »

gamegoblin wrote: post #29
septerr wrote: post #19

Earlier quoted context omitted.

That's exactly how I felt. And they wrote such a detailed email with helpful links and everything.

If they are really downloading apps to inspect, I suspect the email is an automated template.

But someone went through the trouble of writing the template. Most companies wouldn't even bother checking apps in the first place.

Re: Amazon Is Downloading Apps From Google Play and Inspecting Them

#34

Post by smilliken »

MixRank analyzes mobiles apps (android and ios) and we often see apps with embedded api secrets, private keys, and passwords. It's really surprising.

If you'd like to send an email like this to your users, send me an email (in profile) and I can query our database and check to see if any of them are including their api keys.

Re: Amazon Is Downloading Apps From Google Play and Inspecting Them

#35

Post by Crito »

good_guy wrote: post #27
immad wrote: post #14

Couldn't they just look at the user agent and know that the hit to their API is coming from an Android device rather than a server?

This is a bad idea.it's easy to change the user agent to whatever you want.

There is no reason why it would be a bad idea.

False positives (people who are legitimately using AWS credentials from their phone for some reason, or somebody who is legitimately using AWS credentials from their computer but with an incorrect useragent for some reason) would cause an inconvenience as time is wasted to inspect it, but ultimately little harm would be done.

False negatives (improperly using AWS credentials but with a useragent that looks reasonable) would not be a deviation from the status quo.

You don't need 0% false negative and false positive rates to make this sort of sanity checking worthwhile. Even if you only find a few of the many instances of improperly used credentials, you're better off than if you had done nothing.

(Of course there is the issue of correlating misused credentials with the specific application that is misusing them. I don't know how that is done if they are basing their investigation off of useragents.)

Re: Amazon Is Downloading Apps From Google Play and Inspecting Them

#37

Post by iano »

BrandonM wrote: post #6

This seems to be the natural outcome of Amazon's excellent customer service policy, where they have on numerous occasions[0] refunded costs for hacked instances. When they commit to that policy, they have a huge incentive to limit customer security breaches. I love examples like that where a company's policies result in incentives that are so well-aligned with those of their users. Does anyone have other good example…

Credit card companies are a good example of the this too. Since they're responsible for fraudulent charges, there's a huge incentive for them to detect them.

Re: Amazon Is Downloading Apps From Google Play and Inspecting Them

#38

Post by lugg »

ampersandy wrote: post #25
Aqueous wrote: post #11

I don't think they are inspecting the app ; they don't need to. They can see that there are a higher-than-average number of API accesses from a given platform, using the AWS Secret Key as the login credential.

I think this is a more plausible approach (and likely cheaper resource-wise to implement). Though, if the authentication requests somehow identify the Android app in question, it might be easy for Amazon to then perform a follow-up and download the app to verify their suspicions and avoid false-positives.

I dont think it would be that hard to automate decompilation and fire off an email after looking for secret keys. Either way it's good to see.

Re: Amazon Is Downloading Apps From Google Play and Inspecting Them

#39

Post by thaumasiotes »

andrewguenther wrote: post #36
3327 wrote: post #33

Was your source obfuscated?

Does it matter? A constant string is a constant string.

Well, if you want to obfuscate a constant string in your code, you can, e.g. by generating it dynamically from summing two hardcoded integer arrays. Not to say you should, but you can.

Re: Amazon Is Downloading Apps From Google Play and Inspecting Them

#40

Post by kanzure »

magic_haze wrote: post #13

Does Google Play have a public API for downloading APKs? Does it work for paid apps as well? (I'm not able to construct good keywords for search here: Google thinks I'm looking for an APK for the store app instead)

> Does Google Play have a public API for downloading APKs? Does it work for paid apps as well?

There's no "public API" but have fun: https://github.com/kanzure/googleplay-api

(because otherwise how does Google Play itself participate in downloading apps?)

Post reply on HN