Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Critical Vulnerability: AWS Credential Disclosure

blog.trustlook.com

Post reply on HN
Print view View original

1–10 of 45 posts

Re: Critical Vulnerability: AWS Credential Disclosure

#4

Post by gtaylor »

labguy10001 wrote: post #2

The key problem is, Android is a front-end technique. Everything you put in code/resource is transparent. But so many developers treat it like back-end and believe it's save to put sensitive info inside...

This isn't specific to Android, as you can pull symbols out of many kinds of binaries with some work.

Being silly with you credentials can hurt you, regardless of the platform or using a compiled or interpreted environment.

Re: Critical Vulnerability: AWS Credential Disclosure

#5

Post by revelation »

labguy10001 wrote: post #2

The key problem is, Android is a front-end technique. Everything you put in code/resource is transparent. But so many developers treat it like back-end and believe it's save to put sensitive info inside...

The key problem is thinking anything the client does is secure, or even worse, that it may be trusted. A developer that hasn't grasped this very simple fact will inevitably not only screw up the client side (i.e. exposing AWS credentials), but also the server side.

Re: Critical Vulnerability: AWS Credential Disclosure

#6

Post by mantrax4 »

One more example I'll use next time someone asks me "why service oriented architecture".

Interaction with AWS should be wrapped in an app service. So the keys will be on your server. Your web sites or apps talk with that service, not the underlying implementation behind it (i.e. AWS). The API exposed by your app service should be secure by default.

Sometimes some of those apps start as web sites, and they keep a lot of their logic in their controllers, even views. So when time comes to port this to a native phone app for ex., database logins, secret keys and other private implementation details "naturally" end up in application code, since an app consists of the native code version of said controllers and views.

This could've been easily avoided if you automatically split things in secure services from the very start.

Re: Critical Vulnerability: AWS Credential Disclosure

#7

Post by majiaguan »

gtaylor wrote: post #4
labguy10001 wrote: post #2

The key problem is, Android is a front-end technique. Everything you put in code/resource is transparent. But so many developers treat it like back-end and believe it's save to put sensitive info inside...

This isn't specific to Android, as you can pull symbols out of many kinds of binaries with some work. Being silly with you credentials can hurt you, regardless of the platform or using a compiled or interpreted environment.

I believe this vulnerability is existing for IOS apps, too. Trustlook they may only focus on Android

Re: Critical Vulnerability: AWS Credential Disclosure

#9

Post by trustlook »

mantrax4 wrote: post #6

One more example I'll use next time someone asks me "why service oriented architecture". Interaction with AWS should be wrapped in an app service. So the keys will be on your server. Your web sites or apps talk with that service, not the underlying implementation behind it (i.e. AWS). The API exposed by your app service should be secure by default. Sometimes some of those apps start as web sites, and they keep a lot…

Besides AWS, so many SDKs are used client oriented design, like Dropbox and Facebook. The consequence of leaking those keys may not critical as the AWS though.

Re: Critical Vulnerability: AWS Credential Disclosure

#10

Post by yogo »

revelation wrote: post #5
labguy10001 wrote: post #2

The key problem is, Android is a front-end technique. Everything you put in code/resource is transparent. But so many developers treat it like back-end and believe it's save to put sensitive info inside...

The key problem is thinking anything the client does is secure, or even worse, that it may be trusted . A developer that hasn't grasped this very simple fact will inevitably not only screw up the client side (i.e. exposing AWS credentials), but also the server side.

Exactly, rule number 1 is always that client data cannot be trusted.
Post reply on HN