6 ms·
Amazon Is Downloading Apps From Google Play and Inspecting Them
- justinph 13y agoThat's actually kind of awesome. Good on Amazon for taking security seriously.
- septerr 13y agoThat's exactly how I felt. And they wrote such a detailed email with helpful links and everything.
- gamegoblin 13y agoIf they are really downloading apps to inspect, I suspect the email is an automated template.
- kruk 13y agoBut someone went through the trouble of writing the template. Most companies wouldn't even bother checking apps in the first place.
- goombastic 13y agoThis is probably a good thing and also automated.
- alttab 13y agoIt could have raised alarms and then personally investigated. You Could monitor distribution of AWS connections per client. You could easily determine that accessing the same account from many android devices is probably result of poor security practices.
- travelton 13y agoI hope other developers see this and take action if they aren't properly securing cloud API keys. Data access by an unauthorized party is not something you want to deal with.
- jhgg 13y agoI wonder if any malicious parties have been doing this as well.
- deleted 13y ago[deleted]
- good_guy 13y agoThat's exactly what Amazon trying to prevent.
- BrandonM 13y agoThis seems to be the natural outcome of Amazon's excellent customer service policy, where they have on numerous occasions[0] refunded costs for hacked instances. When they commit to that policy, they have a huge incentive to limit customer security breaches. I love examples like that where a company's policies result in incentives that are so well-aligned with those of their users. Does anyone have other good examples to share? [0] https://securosis.com/blog/my-500-cloud-security-screwup https://securosis.com/blog/my-500-cloud-security-screwup and http://vertis.io/2013/12/17/an-update-on-my-aws-bill.html http://vertis.io/2013/12/17/an-update-on-my-aws-bill.html are two examples.
- iano 13y agoCredit card companies are a good example of the this too. Since they're responsible for fraudulent charges, there's a huge incentive for them to detect them.
- danielweber 13y agoBanks are liable for funds withdrawn from personal (not business!) accounts without your authorization.
- protomyth 13y agoAlthough Walmart in their lawsuit against Visa for fees pointed out that Visa is slowing the adoption of security features in the US. http://www.foxbusiness.com/industries/2014/03/27/wal-mart-files-suit-against-visa-for-m/ http://www.foxbusiness.com/industries/2014/03/27/wal-mart-fi...
- eli 13y agoActually it's usually the merchant who gets screwed.
- FollowSteph3 13y agoThey are not financially responsible. If there's a chargeback, stolen credit card, etc they reverse the charge on the merchant. In other word the merchant pays for the items purchased with stolen credit cards. All the credit car companies need to do is keep theft low enough so that the perception on them is good. Make no mistake the crest card companies do NOT pay for items purchased with stolen credit cards, the merchants do.
- iancarroll 13y agoOne of the things that justifies the higher prices. +1
- orblivion 13y agoI wonder how they would identify a string that appears to be an API secret, and queries their database for it. For every plausible string in every app? I guess they decompile it and find string literals of the correct length?
- jlees 13y agoProbably just looked in strings.xml and perhaps for some obvious variable names / validation against string values. There might be some hashing check they can do that means they don't query every valid string in their database.
- ape4 13y agoOr the strings command. http://unixhelp.ed.ac.uk/CGI/man-cgi?strings http://unixhelp.ed.ac.uk/CGI/man-cgi?strings
- anatari 13y agoYou can build a trie of all the AWS keys and then for each Android binary, traverse each series of bytes until it either terminates at a leaf node or fails to continue. If it fails, you start over again on the next byte. Or in order words, the trie allows you to easily test if a given byte is the start of an AWS key, and so then you just check every possible offset. Believe the run time will only be O(n*k) where n is the size of the binary and k is the size of the AWS key, plus enough memory to store the trie which is probably relatively small; less than 1m AWS accounts?
- ajanuary 13y agoUsing Aho-Corasick [1] the runtime would be about O(n+k+) [1] http://en.m.wikipedia.org/wiki/Aho–Corasick_string_matching_algorithm http://en.m.wikipedia.org/wiki/Aho–Corasick_string_matching_...
- alttab 13y agoAWS knows the clients that are connecting to it. All they have to detect is that a large amount of traffic is coming from a wide distribution of mobile devices. This is indicative they embedded the creds into the APK. If they got the creds from a server during runtime, it would be safer to proxy to AWS through the server itself, and never distribute the sensitive data. This would result in only a few proxies connecting to AWS. Amazon surely has automated this with monitoring. I doubt they ever scan Google Play and download the APKs and scan them. Not only is that extremely wasteful it's most definitely violating the Google Play terms of service.
- Aqueous 13y agoI don't think they are inspecting the app ; they don't need to. They can see that there are a higher-than-average number of API accesses from a given platform, using the AWS Secret Key as the login credential.
- ampersandy 13y agoI think this is a more plausible approach (and likely cheaper resource-wise to implement). Though, if the authentication requests somehow identify the Android app in question, it might be easy for Amazon to then perform a follow-up and download the app to verify their suspicions and avoid false-positives.
- lugg 13y agoI dont think it would be that hard to automate decompilation and fire off an email after looking for secret keys. Either way it's good to see.
- joelhaasnoot 13y agoThis exists as a service - http://apkscan.nviso.be/ http://apkscan.nviso.be/ does a scan of your APK and registers requests to servers, lists hardcoded strings and other possible issues.
- anatari 13y agoBut then how would you automatically identify the app name as shown in his email? I think it's easier to download the app. Only ~1m android applications out there. You can probably crawl the android store with just 1 or 2 servers using the algorithm I described below with a trie. Identifying patterns from random data seems way harder to get right, but maybe that's because I have a CS background rather than a statistics one.
- lern_too_spel 13y agoMost Android http clients put the package name in the user agent header. It's trivial for Amazon to find the app as a result. Also, Amazon would use Aho-Corasick if they were really in the mood for violating the Google Play TOS.
- natch 13y agoAnyone who reads the article can see that the author is drawing conclusions from conjecture. "We were made aware" does not equal "we are downloading apps and inspecting them." If they were doing that, that would be great! But let's not leap to conclusions.
- rajbala 13y agoThey (or someone working with them) would have had to download the app and inspect it. They clearly tell me that they've detected access credentials in the app itself. That's not conjecture.
- magic_haze 13y agoDoes Google Play have a public API for downloading APKs? Does it work for paid apps as well? (I'm not able to construct good keywords for search here: Google thinks I'm looking for an APK for the store app instead)
- kanzure 13y ago> Does Google Play have a public API for downloading APKs? Does it work for paid apps as well? There's no "public API" but have fun: https://github.com/kanzure/googleplay-api https://github.com/kanzure/googleplay-api (because otherwise how does Google Play itself participate in downloading apps?)
- immad 13y agoCouldn't they just look at the user agent and know that the hit to their API is coming from an Android device rather than a server?
- RoboTeddy 13y agohttp://developer.android.com/reference/java/net/HttpURLConnection.html http://developer.android.com/reference/java/net/HttpURLConne... might not have a default User-Agent header that identifies android
- brown9-2 13y agoOf course a developer could change this, but yes the default user-agent string for an Android app using HttpURLConnection identifies it clearly as Android: http://www.gtrifonov.com/2011/04/15/google-android-user-agent-strings-2/ http://www.gtrifonov.com/2011/04/15/google-android-user-agen...
- alttab 13y agoMost probable.
- good_guy 13y agoThis is a bad idea.it's easy to change the user agent to whatever you want.
- Crito 13y agoThere is no reason why it would be a bad idea. False positives (people who are legitimately using AWS credentials from their phone for some reason, or somebody who is legitimately using AWS credentials from their computer but with an incorrect useragent for some reason) would cause an inconvenience as time is wasted to inspect it, but ultimately little harm would be done. False negatives (improperly using AWS credentials but with a useragent that looks reasonable) would not be a deviation from the status quo. You don't need 0% false negative and false positive rates to make this sort of sanity checking worthwhile. Even if you only find a few of the many instances of improperly used credentials, you're better off than if you had done nothing. (Of course there is the issue of correlating misused credentials with the specific application that is misusing them. I don't know how that is done if they are basing their investigation off of useragents.)
- incogmind 13y agoThey did a good thing, title feels slightly misguiding. Could they have figured it out based on API access locations being random?
- rajbala 13y agoWhat's misguiding? No intention to misguide. I think it's completely accurate. They downloaded my app, inspected it, found AWS credentials and emailed me as a result.
- brown9-2 13y agoI think the misguiding part (or at least, what the tone suggests) is that the order of events is 1) Amazon downloading and scanning all apps and then 2) looking for AWS credentials in the code.
- rajbala 13y agoI think that is what's happening. They would have no other way to identify my app and my AWS credentials otherwise.
- alttab 13y agoConjecture, and I guess you're welcome? My guess is if you embedded your Google cloud credentials in your app and it was compromised Google would be happy to bill you, terminate your account, or otherwise provide zero latitude as a customer. At least they dropped their prices, right?
- downandout 13y agoI see nothing wrong here. They are probably doing this now because it in fact a major problem, even with large, professionally developed apps. About 8 months ago I did a brief analysis of the then-current Vine apk and relatively quickly extracted their S3 credentials (they were not stored in plain text, but close enough). Very bad idea.
- rajbala 13y agoI'm not implying that there's anything wrong. Quite the contrary actually.
- MasterScrat 13y agoThe number of valid EC2 keys you can find with a simple GitHub search is mind-blowing (or was, at least, when I tried it a month ago).
- ontoillogical 13y agoI reported this to them over a year ago, and was told they fixed it. Never bothered to check again tho.
- nknighthb 13y agoI understand perfectly how people end up mistakenly pushing credentials into public source repos when releasing server-side stuff. But I don't get how a seemingly sane person develops an application intended for distribution to the public which contains AWS credentials. At what point in your development process do you say "I want this application, which will be distributed to unknown persons, to contain the means to control my AWS account."?
- Kudos 13y agoSome people don't realise their apps can be decompiled, it's not a question of sanity.
- nknighthb 13y agoI don't think I've ever encountered that particular illusion in anyone making a living off writing compiled code, only very new developers and non-engineer managers. It's one of the few securityish things that seems to be successfully beaten into everyone's head pretty early on. (And more often than not, they get there all by themselves -- such people usually appear on my radar asking questions showing they've figured out for themselves that it's a bad idea, they just need help turning that knowledge into practice.)
- saurik 13y agoI give talks at development conferences where I mostly blow people's minds by showing how easy it is to pull information out of binaries (both statically and dynamically); there are always tons of questions from the audience afterwards about "but we do X? doesn't that make us safe?", so I have to sit there shooting down a ton of silly ways of obfuscating their data, showing how each one could be defeated, but it "clicks" for everyone that there is no safe way to do this.
- watwut 13y agoI do not think that anyone ever said that. More likely, they just put keys in string to do quick test right now with intention to fix it later. Then they simply forget about it and later never happen.
- catshirt 13y agogreat for them. i worked for an unnamed company who was shipping AWS credentials in clients for years. worse, they were not clients that required a packaged binary (no need to decompile). it's long since patched but i can't believe no one ever sniffed that out.
- snapclass 13y agoGo on you Amazon.
- 3327 13y agoWas your source obfuscated?
- andrewguenther 13y agoDoes it matter? A constant string is a constant string.
- thaumasiotes 13y agoWell, if you want to obfuscate a constant string in your code, you can, e.g. by generating it dynamically from summing two hardcoded integer arrays. Not to say you should, but you can.
- claudius 13y agoThat sounds an awful lot like DRM with all its failed approaches…
- thaumasiotes 13y agoSounds like? That's what obfuscation is (or more accurately, obfuscation is what DRM is). No one ever claimed, or ever will claim, that obfuscation stops people from seeing what you're doing.
- smilliken 13y agoMixRank analyzes mobiles apps (android and ios) and we often see apps with embedded api secrets, private keys, and passwords. It's really surprising. If you'd like to send an email like this to your users, send me an email (in profile) and I can query our database and check to see if any of them are including their api keys.
- deleted 13y ago[deleted]
- kayoone 13y agoa free security audit of your app, pretty cool ;)
- olalonde 13y agoI'm curious why some apps need API to access to AWS. What's the use case? Surely not to spin up an EC2 instance when the user clicks a button? Save files to S3? I'm not being sarcastic, genuinely curious. And what's the proposed solution suggested by AWS?
- ephess 13y agoIt's hard to say without knowing the app, but my first guess would be for storing files in S3 or pushing a message into a SQS queue. AWS supports temporary access keys, and one of the recommended solutions is to have an API which generates temporary credentials for a specific task that will expire shortly after. Edit: Heres a link http://docs.aws.amazon.com/STS/latest/UsingSTS/CreatingSessionTokens.html http://docs.aws.amazon.com/STS/latest/UsingSTS/CreatingSessi...
- rajbala 13y agoSave files to S3.
- Turing_Machine 13y agoYou can do that with signed forms and similar techniques, though. No need to have the key on the client side (and lots of reasons not to).
- Turing_Machine 13y agoThe flow is roughly this: 1) Client: "Hey, I want to upload a file." 2) Server: "Okay, here's a temporary key good for the next <n> minutes. The file has to be named <blah> and can't be more than <x> MB long" (there are other restrictions you can set, too, IIRC) 3) Client posts the form to S3 including the temporary key as a field. 4) Result.
- anxrn 13y agoJust off the top of my head: - Store/retrieve state in/from DynamoDB or RDS - Pull an object from S3 - Send an SNS notification - Add a message to an SQS queue - Dispatch email via SES
- deleted 13y ago[deleted]
- salvadormrf 13y agoThey also scan for Keys on github. They are proactive in terms of security!
- happywolf 13y agoI will think they inspect apps based on the number of hits generated to AWS. The advantages of doing this are 1) showing Amazon thinks for the customers (well, also for itself) 2) proves it has pro-actively notified the customer and done its due diligence. This step could serve as a solid proof in any dispute on later security issues or/and related costs. Smart, I will say.
- bborud 13y agoKudos to Amazon.
- rrtwo 13y agoWhat are common use cases for AWS in mobile apps? (where the app needs direct connection to AWS)
- rajbala 13y agoReading/writing to S3 was my use case. I'm sure there are others.
- ch0wn 13y agoFacebook does the same thing. I got a notice about an application I published years ago in March: > Security Notice - Your App Secret > We see that your app, XYZ, is embedding the Facebook integration’s App Secret inside the Android Play Store app bundle for your app. This is a serious vulnerability that violates our published recommendations for proper login security. Someone with access to the app secret for your app can act on behalf of the app - this includes changing configurations for the app, accessing some types of information associated with people who have granted permissions to the app, and posting on behalf of those people. > To mitigate this sizable risk, we have reset the app secret for your app. If your app is mobile-only, this should not cause any issues. If it has a server-side component, there is a greater likelihood that it has caused some issues for your app that you will need to address. Going forward, please do not include the app secret in your app bundle, or disclose it publicly. You can read more about app secrets and how to secure your Facebook app here.
- MasterScrat 13y agoNow this is interesting. Could we imagine a service that would be in charge of protecting your customers secrets? You would provide a list of secret strings, and ask to have them monitored on search engines but also from mobile applications, browser extensions, published JARs etc.
- TheLoneWolfling 13y agoNOOOOOOOOOOO But seriously, treat them like passwords. Don't have the service store the secrets, have the service store hashes of the secrets with a regex for prefiltering (because hashing every word everywhere would be prohibitively expensive).
- MasterScrat 13y ago> Don't have the service store the secrets Why not? You can use the service to make sure it doesn't leak its own secrets so it's safe ;-) But seriously yes I really like your approach. You could even provide a second set of API to do the opposite: given a block of text see if there's any sensitive string inside. Google & co could use it before publishing an app in their Store.
- hoboerectus 13y agoSo am I.
- jbert 13y agoI'm being dumb. I can see that it is preferable to embed credentials for a restricted IAM acct, not your root/master AWS account. But how does using a TVM improve the situation? Surely you still need to embed creds which allow the app to use the TVM? In that case, an attacker can extract those creds, and ask the TVM for a time-limited token any time they like. How does using a TVM improve security over embedding the creds of a restricted account?
- rajbala 13y agoI asked myself the same question and don't have an answer yet.
- duncans 13y agoYour token service would authenticate users using their credentials for your system.
- jbert 13y agoStill not sure how that helps. In both cases, we have creds embedded in the app which can be used (and only used) for access to the AWS resource. In one case directly (via an IAM limited account), in another via a token they can request. In both cases, the acct is limited to one specific AWS resource. In both cases, the creds can be revoked centrally. In both cases the creds are embedded in the app. Smart people who build these things (AWS) seem to think a TVM is a better solution. I don't understand why.
- ediblenergy 13y agoOr somebody else found it and notified Amazon.
- mobiplayer 13y agoWell, this is very cool and an approach that some security companies are taking at the moment. "Security outside your network" they call it. I'm myself working (side/pet project so far) in something similar. I don't have any working software at the moment but some "INTEL" and it is incredible how easy anyone would be able to compromise/hurt people and companies just using available information published by themselves. If anyone more technical (I'm looking at you, devs!) wants to team up to create a service like this please get in touch.
- dalek2point3 13y agois decompiling an app legal? does it not break someone's terms of service?
- Fasebook 13y agoUltimately, Web Identity Federation or Federated Identity is the only way to secure apps in walled gardens, which means aligning yourself with a virtual land Barron. I, for one, welcome our new fiefdom overlords. Everything else is just pushing new credentials through temp credentials and obfuscating it with protocol complexity.
- woloski 13y agoWe wrote a blog post that shows how you can authenticate your users and get temporary security credentials from AWS based on the user tokens to avoid putting your keys on the client (both JavaScript apps in the browser or native apps). This technique is using Auth0 so you don't have to deploy a TVM and it works with all the APIs (S3, EC2, SQS, SES, etc.). Behind the scenes what we do is generating a SAML Token based on the user JSON Web Token and exchange that for AWS Temp Credentials using AssumeRoleWithSAML AWS API. http://blog.auth0.com/2014/03/25/consume-aws-apis-from-the-browser-securely/ http://blog.auth0.com/2014/03/25/consume-aws-apis-from-the-b...