So am I.
Amazon Is Downloading Apps From Google Play and Inspecting Them
71–80 of 113 posts
Re: Amazon Is Downloading Apps From Google Play and Inspecting Them
#72I'm being dumb. I can see that it is preferable to embed credentials for a restricted IAM acct, not your root/master AWS account.
But how does using a TVM improve the situation? Surely you still need to embed creds which allow the app to use the TVM? In that case, an attacker can extract those creds, and ask the TVM for a time-limited token any time they like.
How does using a TVM improve security over embedding the creds of a restricted account?
Re: Amazon Is Downloading Apps From Google Play and Inspecting Them
#73Facebook does the same thing. I got a notice about an application I published years ago in March: > Security Notice - Your App Secret > We see that your app, XYZ, is embedding the Facebook integration’s App Secret inside the Android Play Store app bundle for your app. This is a serious vulnerability that violates our published recommendations for proper login security. Someone with access to the app secret for your a…
Now this is interesting. Could we imagine a service that would be in charge of protecting your customers secrets? You would provide a list of secret strings, and ask to have them monitored on search engines but also from mobile applications, browser extensions, published JARs etc.
NOOOOOOOOOOO
But seriously, treat them like passwords.
Don't have the service store the secrets, have the service store hashes of the secrets with a regex for prefiltering (because hashing every word everywhere would be prohibitively expensive).
Re: Amazon Is Downloading Apps From Google Play and Inspecting Them
#74I wonder how they would identify a string that appears to be an API secret, and queries their database for it. For every plausible string in every app? I guess they decompile it and find string literals of the correct length?
You can build a trie of all the AWS keys and then for each Android binary, traverse each series of bytes until it either terminates at a leaf node or fails to continue. If it fails, you start over again on the next byte. Or in order words, the trie allows you to easily test if a given byte is the start of an AWS key, and so then you just check every possible offset. Believe the run time will only be O(n*k) where n is…
Using Aho-Corasick [1] the runtime would be about O(n+k+)
[1] http://en.m.wikipedia.org/wiki/Aho–Corasick_string_matching_...
Re: Amazon Is Downloading Apps From Google Play and Inspecting Them
#75This seems to be the natural outcome of Amazon's excellent customer service policy, where they have on numerous occasions[0] refunded costs for hacked instances. When they commit to that policy, they have a huge incentive to limit customer security breaches. I love examples like that where a company's policies result in incentives that are so well-aligned with those of their users. Does anyone have other good example…
Credit card companies are a good example of the this too. Since they're responsible for fraudulent charges, there's a huge incentive for them to detect them.
Banks are liable for funds withdrawn from personal (not business!) accounts without your authorization.
Re: Amazon Is Downloading Apps From Google Play and Inspecting Them
#76Earlier quoted context omitted.
Now this is interesting. Could we imagine a service that would be in charge of protecting your customers secrets? You would provide a list of secret strings, and ask to have them monitored on search engines but also from mobile applications, browser extensions, published JARs etc.
NOOOOOOOOOOO But seriously, treat them like passwords. Don't have the service store the secrets, have the service store hashes of the secrets with a regex for prefiltering (because hashing every word everywhere would be prohibitively expensive).
> Don't have the service store the secrets
Why not? You can use the service to make sure it doesn't leak its own secrets so it's safe ;-)
But seriously yes I really like your approach.
You could even provide a second set of API to do the opposite: given a block of text see if there's any sensitive string inside. Google & co could use it before publishing an app in their Store.
Re: Amazon Is Downloading Apps From Google Play and Inspecting Them
#77I see nothing wrong here. They are probably doing this now because it in fact a major problem, even with large, professionally developed apps. About 8 months ago I did a brief analysis of the then-current Vine apk and relatively quickly extracted their S3 credentials (they were not stored in plain text, but close enough). Very bad idea.
I reported this to them over a year ago, and was told they fixed it. Never bothered to check again tho.
Re: Amazon Is Downloading Apps From Google Play and Inspecting Them
#78I'm being dumb. I can see that it is preferable to embed credentials for a restricted IAM acct, not your root/master AWS account. But how does using a TVM improve the situation? Surely you still need to embed creds which allow the app to use the TVM? In that case, an attacker can extract those creds, and ask the TVM for a time-limited token any time they like. How does using a TVM improve security over embedding the…
I asked myself the same question and don't have an answer yet.
Re: Amazon Is Downloading Apps From Google Play and Inspecting Them
#79I don't think they are inspecting the app ; they don't need to. They can see that there are a higher-than-average number of API accesses from a given platform, using the AWS Secret Key as the login credential.
I don't think they're looking for higher than average API calls for a given key because my charges were completely expected.
API calls from different IP Addresses plus any other information that gets through in the request packet.
Re: Amazon Is Downloading Apps From Google Play and Inspecting Them
#80I don't think they are inspecting the app ; they don't need to. They can see that there are a higher-than-average number of API accesses from a given platform, using the AWS Secret Key as the login credential.
They clearly say that they've detected my access credentials in the app. There's no way to associate my credentials to my app without downloading the app first and inspecting it.
Perhaps, but the assumed order of events here might not be what you think. I doubt that Amazon is scanning every app in the Android app store to find unsecured AWS credentials.
It's more likely that they have an alert when the secret key is used to access an account from many different IP addresses, and looking at the user-agent string in the HTTP headers probably pointed them towards an Android app.
It wouldn't be too hard for them to then look to see who owns the AWS account and then search for that person's name in the Android app store.