Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Amazon Is Downloading Apps From Google Play and Inspecting Them

blog.rajbala.com

Post reply on HN
Print view View original

91–100 of 113 posts

Re: Amazon Is Downloading Apps From Google Play and Inspecting Them

#91

Post by mobiplayer »

Well, this is very cool and an approach that some security companies are taking at the moment. "Security outside your network" they call it.

I'm myself working (side/pet project so far) in something similar. I don't have any working software at the moment but some "INTEL" and it is incredible how easy anyone would be able to compromise/hurt people and companies just using available information published by themselves.

If anyone more technical (I'm looking at you, devs!) wants to team up to create a service like this please get in touch.

Re: Amazon Is Downloading Apps From Google Play and Inspecting Them

#92

Post by rajbala »

nknighthb wrote: post #89
rajbala wrote: post #88

Earlier quoted context omitted.

I'm not necessarily disagreeing with you, but it's not always practical and perhaps not even possible. For example the push notifications SDK from Urban Airship and app analytics SDK from Flurry depend on having credentials stored in the app. These examples are not unique to them. I don't disagree that it's wrong, but I don't know how to work around this to be candid.

Those are examples of AWS-like facilities. The embedded keys are not secret credentials that allow people to control your account! If you are embedding your account credentials from Urban Airship or Flurry in your app, you are badly misusing their APIs. They provide facilities for generating certificates/keys for each application.

Urban Airship actually instructs you to create a plist file for an iOS app where you specify your production app keys.

http://docs.urbanairship.com/build/ios.html

Re: Amazon Is Downloading Apps From Google Play and Inspecting Them

#93

Post by rajbala »

nknighthb wrote: post #89
rajbala wrote: post #88

Earlier quoted context omitted.

I'm not necessarily disagreeing with you, but it's not always practical and perhaps not even possible. For example the push notifications SDK from Urban Airship and app analytics SDK from Flurry depend on having credentials stored in the app. These examples are not unique to them. I don't disagree that it's wrong, but I don't know how to work around this to be candid.

Those are examples of AWS-like facilities. The embedded keys are not secret credentials that allow people to control your account! If you are embedding your account credentials from Urban Airship or Flurry in your app, you are badly misusing their APIs. They provide facilities for generating certificates/keys for each application.

I'm not embedding account credentials for Flurry and UA in my app. I embedding app keys and while those don't allow someone to take over my account they could certainly wreak havoc with push notifications.

Re: Amazon Is Downloading Apps From Google Play and Inspecting Them

#95

Post by jakirk42 »

rajbala wrote: post #59
Aqueous wrote: post #11

I don't think they are inspecting the app ; they don't need to. They can see that there are a higher-than-average number of API accesses from a given platform, using the AWS Secret Key as the login credential.

I don't think they're looking for higher than average API calls for a given key because my charges were completely expected.

raj, just saw your post on here. I was wondering if you were the same guy Dennis in Delaware was trying to connect us to. We were doing the large scale touchscreen collaboration stuff

Re: Amazon Is Downloading Apps From Google Play and Inspecting Them

#96

Post by ams6110 »

nknighthb wrote: post #22

I understand perfectly how people end up mistakenly pushing credentials into public source repos when releasing server-side stuff. But I don't get how a seemingly sane person develops an application intended for distribution to the public which contains AWS credentials. At what point in your development process do you say "I want this application, which will be distributed to unknown persons, to contain the means to…

I once worked on a website that had a "sql.asp" page where you could enter any arbitrary SQL into a textarea and submit it. The ONLY security it had was the obscurity of its URL.

This was implemented deliberately and with full knowledge of managers and developers.

Stuff like this happens....

Re: Amazon Is Downloading Apps From Google Play and Inspecting Them

#97

Post by Turing_Machine »

rajbala wrote: post #67
olalonde wrote: post #44

I'm curious why some apps need API to access to AWS. What's the use case? Surely not to spin up an EC2 instance when the user clicks a button? Save files to S3? I'm not being sarcastic, genuinely curious. And what's the proposed solution suggested by AWS?

Save files to S3.

You can do that with signed forms and similar techniques, though. No need to have the key on the client side (and lots of reasons not to).

Re: Amazon Is Downloading Apps From Google Play and Inspecting Them

#98

Post by Turing_Machine »

Turing_Machine wrote: post #97
rajbala wrote: post #67

Earlier quoted context omitted.

Save files to S3.

You can do that with signed forms and similar techniques, though. No need to have the key on the client side (and lots of reasons not to).

The flow is roughly this:

1) Client: "Hey, I want to upload a file."

2) Server: "Okay, here's a temporary key good for the next minutes. The file has to be named and can't be more than MB long" (there are other restrictions you can set, too, IIRC)

3) Client posts the form to S3 including the temporary key as a field.

4) Result.

Re: Amazon Is Downloading Apps From Google Play and Inspecting Them

#99

Post by rajbala »

jakirk42 wrote: post #95
rajbala wrote: post #59

Earlier quoted context omitted.

I don't think they're looking for higher than average API calls for a given key because my charges were completely expected.

raj, just saw your post on here. I was wondering if you were the same guy Dennis in Delaware was trying to connect us to. We were doing the large scale touchscreen collaboration stuff

Nope, not I. :)

Re: Amazon Is Downloading Apps From Google Play and Inspecting Them

#100

Post by anxrn »

olalonde wrote: post #44

I'm curious why some apps need API to access to AWS. What's the use case? Surely not to spin up an EC2 instance when the user clicks a button? Save files to S3? I'm not being sarcastic, genuinely curious. And what's the proposed solution suggested by AWS?

Just off the top of my head:

- Store/retrieve state in/from DynamoDB or RDS

- Pull an object from S3

- Send an SNS notification

- Add a message to an SQS queue

- Dispatch email via SES

Post reply on HN