Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Amazon Is Downloading Apps From Google Play and Inspecting Them

blog.rajbala.com

Post reply on HN
Print view View original

51–60 of 113 posts

Re: Amazon Is Downloading Apps From Google Play and Inspecting Them

#51

Post by Kudos »

nknighthb wrote: post #22

I understand perfectly how people end up mistakenly pushing credentials into public source repos when releasing server-side stuff. But I don't get how a seemingly sane person develops an application intended for distribution to the public which contains AWS credentials. At what point in your development process do you say "I want this application, which will be distributed to unknown persons, to contain the means to…

Some people don't realise their apps can be decompiled, it's not a question of sanity.

Re: Amazon Is Downloading Apps From Google Play and Inspecting Them

#52

Post by happywolf »

I will think they inspect apps based on the number of hits generated to AWS.

The advantages of doing this are 1) showing Amazon thinks for the customers (well, also for itself) 2) proves it has pro-actively notified the customer and done its due diligence.

This step could serve as a solid proof in any dispute on later security issues or/and related costs.

Smart, I will say.

Re: Amazon Is Downloading Apps From Google Play and Inspecting Them

#53

Post by watwut »

nknighthb wrote: post #22

I understand perfectly how people end up mistakenly pushing credentials into public source repos when releasing server-side stuff. But I don't get how a seemingly sane person develops an application intended for distribution to the public which contains AWS credentials. At what point in your development process do you say "I want this application, which will be distributed to unknown persons, to contain the means to…

I do not think that anyone ever said that. More likely, they just put keys in string to do quick test right now with intention to fix it later. Then they simply forget about it and later never happen.

Re: Amazon Is Downloading Apps From Google Play and Inspecting Them

#54

Post by nknighthb »

Kudos wrote: post #51
nknighthb wrote: post #22

I understand perfectly how people end up mistakenly pushing credentials into public source repos when releasing server-side stuff. But I don't get how a seemingly sane person develops an application intended for distribution to the public which contains AWS credentials. At what point in your development process do you say "I want this application, which will be distributed to unknown persons, to contain the means to…

Some people don't realise their apps can be decompiled, it's not a question of sanity.

I don't think I've ever encountered that particular illusion in anyone making a living off writing compiled code, only very new developers and non-engineer managers. It's one of the few securityish things that seems to be successfully beaten into everyone's head pretty early on.

(And more often than not, they get there all by themselves -- such people usually appear on my radar asking questions showing they've figured out for themselves that it's a bad idea, they just need help turning that knowledge into practice.)

Re: Amazon Is Downloading Apps From Google Play and Inspecting Them

#56

Post by thaumasiotes »

claudius wrote: post #49
thaumasiotes wrote: post #39

Earlier quoted context omitted.

Well, if you want to obfuscate a constant string in your code, you can, e.g. by generating it dynamically from summing two hardcoded integer arrays. Not to say you should, but you can.

That sounds an awful lot like DRM with all its failed approaches…

Sounds like? That's what obfuscation is (or more accurately, obfuscation is what DRM is). No one ever claimed, or ever will claim, that obfuscation stops people from seeing what you're doing.

Re: Amazon Is Downloading Apps From Google Play and Inspecting Them

#57

Post by vvvnnnnvvv »

Aqueous wrote: post #11

I don't think they are inspecting the app ; they don't need to. They can see that there are a higher-than-average number of API accesses from a given platform, using the AWS Secret Key as the login credential.

I received a similar email about AWS keys checked into a public github repo. The email was very specific about this being the issue, so I suspect they were crawling and not merely detecting a strange usage pattern.

Re: Amazon Is Downloading Apps From Google Play and Inspecting Them

#59

Post by rajbala »

Aqueous wrote: post #11

I don't think they are inspecting the app ; they don't need to. They can see that there are a higher-than-average number of API accesses from a given platform, using the AWS Secret Key as the login credential.

I don't think they're looking for higher than average API calls for a given key because my charges were completely expected.

Re: Amazon Is Downloading Apps From Google Play and Inspecting Them

#60

Post by rajbala »

downandout wrote: post #21

I see nothing wrong here. They are probably doing this now because it in fact a major problem, even with large, professionally developed apps. About 8 months ago I did a brief analysis of the then-current Vine apk and relatively quickly extracted their S3 credentials (they were not stored in plain text, but close enough). Very bad idea.

I'm not implying that there's anything wrong. Quite the contrary actually.
Post reply on HN