4 ms·

I wonder how they would identify a string that appears to be an API secret, and queries their database for it. For every plausible string in every app? I guess

I wonder how they would identify a string that appears to be an API secret, and queries their database for it. For every plausible string in every app? I guess they decompile it and find string literals of the correct length?

jlees 13y ago
Probably just looked in strings.xml and perhaps for some obvious variable names / validation against string values. There might be some hashing check they can do that means they don't query every valid string in their database.
- ape4 13y ago
  Or the strings command. http://unixhelp.ed.ac.uk/CGI/man-cgi?strings http://unixhelp.ed.ac.uk/CGI/man-cgi?strings
anatari 13y ago
You can build a trie of all the AWS keys and then for each Android binary, traverse each series of bytes until it either terminates at a leaf node or fails to continue. If it fails, you start over again on the next byte. Or in order words, the trie allows you to easily test if a given byte is the start of an AWS key, and so then you just check every possible offset. Believe the run time will only be O(n*k) where n is the size of the binary and k is the size of the AWS key, plus enough memory to store the trie which is probably relatively small; less than 1m AWS accounts?
- ajanuary 13y ago
  Using Aho-Corasick [1] the runtime would be about O(n+k+) [1] http://en.m.wikipedia.org/wiki/Aho–Corasick_string_matching_algorithm http://en.m.wikipedia.org/wiki/Aho–Corasick_string_matching_...
alttab 13y ago
AWS knows the clients that are connecting to it. All they have to detect is that a large amount of traffic is coming from a wide distribution of mobile devices. This is indicative they embedded the creds into the APK. If they got the creds from a server during runtime, it would be safer to proxy to AWS through the server itself, and never distribute the sensitive data. This would result in only a few proxies connecting to AWS. Amazon surely has automated this with monitoring. I doubt they ever scan Google Play and download the APKs and scan them. Not only is that extremely wasteful it's most definitely violating the Google Play terms of service.
- brown9-2 13y ago
  It wouldn't even need to be a "large amount of traffic", just traffic using the AWS secret key from more than a handful of IP addresses in the same time window would be suspicious.

jlees 13y ago

Probably just looked in strings.xml and perhaps for some obvious variable names / validation against string values. There might be some hashing check they can do that means they don't query every valid string in their database.

ape4 13y ago
Or the strings command. http://unixhelp.ed.ac.uk/CGI/man-cgi?strings http://unixhelp.ed.ac.uk/CGI/man-cgi?strings

anatari 13y ago

You can build a trie of all the AWS keys and then for each Android binary, traverse each series of bytes until it either terminates at a leaf node or fails to continue. If it fails, you start over again on the next byte. Or in order words, the trie allows you to easily test if a given byte is the start of an AWS key, and so then you just check every possible offset. Believe the run time will only be O(n*k) where n is the size of the binary and k is the size of the AWS key, plus enough memory to store the trie which is probably relatively small; less than 1m AWS accounts?

ajanuary 13y ago
Using Aho-Corasick [1] the runtime would be about O(n+k+) [1] http://en.m.wikipedia.org/wiki/Aho–Corasick_string_matching_algorithm http://en.m.wikipedia.org/wiki/Aho–Corasick_string_matching_...

alttab 13y ago

AWS knows the clients that are connecting to it. All they have to detect is that a large amount of traffic is coming from a wide distribution of mobile devices. This is indicative they embedded the creds into the APK. If they got the creds from a server during runtime, it would be safer to proxy to AWS through the server itself, and never distribute the sensitive data. This would result in only a few proxies connecting to AWS. Amazon surely has automated this with monitoring. I doubt they ever scan Google Play and download the APKs and scan them. Not only is that extremely wasteful it's most definitely violating the Google Play terms of service.

brown9-2 13y ago
It wouldn't even need to be a "large amount of traffic", just traffic using the AWS secret key from more than a handful of IP addresses in the same time window would be suspicious.