Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Amazon Is Downloading Apps From Google Play and Inspecting Them

blog.rajbala.com

Post reply on HN
Print view View original

61–70 of 113 posts

Re: Amazon Is Downloading Apps From Google Play and Inspecting Them

#61

Post by ch0wn »

Facebook does the same thing. I got a notice about an application I published years ago in March:

> Security Notice - Your App Secret

> We see that your app, XYZ, is embedding the Facebook integration’s App Secret inside the Android Play Store app bundle for your app. This is a serious vulnerability that violates our published recommendations for proper login security. Someone with access to the app secret for your app can act on behalf of the app - this includes changing configurations for the app, accessing some types of information associated with people who have granted permissions to the app, and posting on behalf of those people.

> To mitigate this sizable risk, we have reset the app secret for your app. If your app is mobile-only, this should not cause any issues. If it has a server-side component, there is a greater likelihood that it has caused some issues for your app that you will need to address. Going forward, please do not include the app secret in your app bundle, or disclose it publicly. You can read more about app secrets and how to secure your Facebook app here.

Re: Amazon Is Downloading Apps From Google Play and Inspecting Them

#62

Post by MasterScrat »

BrandonM wrote: post #6

This seems to be the natural outcome of Amazon's excellent customer service policy, where they have on numerous occasions[0] refunded costs for hacked instances. When they commit to that policy, they have a huge incentive to limit customer security breaches. I love examples like that where a company's policies result in incentives that are so well-aligned with those of their users. Does anyone have other good example…

> Facebook has concealed the profiles of anyone on the social network who used the same email and password combination as those exposed after the recent Adobe hack

http://www.zdnet.com/facebook-mines-adobe-breach-data-for-re...

Facebook at that point had a huge incentive to avoid those accounts from being taken over by spammers.

Re: Amazon Is Downloading Apps From Google Play and Inspecting Them

#63

Post by protomyth »

iano wrote: post #37
BrandonM wrote: post #6

This seems to be the natural outcome of Amazon's excellent customer service policy, where they have on numerous occasions[0] refunded costs for hacked instances. When they commit to that policy, they have a huge incentive to limit customer security breaches. I love examples like that where a company's policies result in incentives that are so well-aligned with those of their users. Does anyone have other good example…

Credit card companies are a good example of the this too. Since they're responsible for fraudulent charges, there's a huge incentive for them to detect them.

Although Walmart in their lawsuit against Visa for fees pointed out that Visa is slowing the adoption of security features in the US. http://www.foxbusiness.com/industries/2014/03/27/wal-mart-fi...

Re: Amazon Is Downloading Apps From Google Play and Inspecting Them

#64

Post by MasterScrat »

downandout wrote: post #21

I see nothing wrong here. They are probably doing this now because it in fact a major problem, even with large, professionally developed apps. About 8 months ago I did a brief analysis of the then-current Vine apk and relatively quickly extracted their S3 credentials (they were not stored in plain text, but close enough). Very bad idea.

The number of valid EC2 keys you can find with a simple GitHub search is mind-blowing (or was, at least, when I tried it a month ago).

Re: Amazon Is Downloading Apps From Google Play and Inspecting Them

#65

Post by rajbala »

natch wrote: post #12

Anyone who reads the article can see that the author is drawing conclusions from conjecture. "We were made aware" does not equal "we are downloading apps and inspecting them." If they were doing that, that would be great! But let's not leap to conclusions.

They (or someone working with them) would have had to download the app and inspect it. They clearly tell me that they've detected access credentials in the app itself.

That's not conjecture.

Re: Amazon Is Downloading Apps From Google Play and Inspecting Them

#66

Post by MasterScrat »

ch0wn wrote: post #61

Facebook does the same thing. I got a notice about an application I published years ago in March: > Security Notice - Your App Secret > We see that your app, XYZ, is embedding the Facebook integration’s App Secret inside the Android Play Store app bundle for your app. This is a serious vulnerability that violates our published recommendations for proper login security. Someone with access to the app secret for your a…

Now this is interesting. Could we imagine a service that would be in charge of protecting your customers secrets?

You would provide a list of secret strings, and ask to have them monitored on search engines but also from mobile applications, browser extensions, published JARs etc.

Re: Amazon Is Downloading Apps From Google Play and Inspecting Them

#67

Post by rajbala »

olalonde wrote: post #44

I'm curious why some apps need API to access to AWS. What's the use case? Surely not to spin up an EC2 instance when the user clicks a button? Save files to S3? I'm not being sarcastic, genuinely curious. And what's the proposed solution suggested by AWS?

Save files to S3.

Re: Amazon Is Downloading Apps From Google Play and Inspecting Them

#68

Post by rajbala »

incogmind wrote: post #16

They did a good thing, title feels slightly misguiding. Could they have figured it out based on API access locations being random?

What's misguiding?

No intention to misguide. I think it's completely accurate. They downloaded my app, inspected it, found AWS credentials and emailed me as a result.

Re: Amazon Is Downloading Apps From Google Play and Inspecting Them

#70

Post by rajbala »

Aqueous wrote: post #11

I don't think they are inspecting the app ; they don't need to. They can see that there are a higher-than-average number of API accesses from a given platform, using the AWS Secret Key as the login credential.

They clearly say that they've detected my access credentials in the app. There's no way to associate my credentials to my app without downloading the app first and inspecting it.
Post reply on HN