5 ms·
I don't think they are inspecting the app ; they don't need to. They can see that there are a higher-than-average number of API accesses from a given platform,
by Aqueous 13y ago
I don't think they are inspecting the app ; they don't need to. They can see that there are a higher-than-average number of API accesses from a given platform, using the AWS Secret Key as the login credential.
- ampersandy 13y agoI think this is a more plausible approach (and likely cheaper resource-wise to implement). Though, if the authentication requests somehow identify the Android app in question, it might be easy for Amazon to then perform a follow-up and download the app to verify their suspicions and avoid false-positives.
- lugg 13y agoI dont think it would be that hard to automate decompilation and fire off an email after looking for secret keys. Either way it's good to see.
- joelhaasnoot 13y agoThis exists as a service - http://apkscan.nviso.be/ http://apkscan.nviso.be/ does a scan of your APK and registers requests to servers, lists hardcoded strings and other possible issues.
- anatari 13y agoBut then how would you automatically identify the app name as shown in his email? I think it's easier to download the app. Only ~1m android applications out there. You can probably crawl the android store with just 1 or 2 servers using the algorithm I described below with a trie. Identifying patterns from random data seems way harder to get right, but maybe that's because I have a CS background rather than a statistics one.
- lern_too_spel 13y agoMost Android http clients put the package name in the user agent header. It's trivial for Amazon to find the app as a result. Also, Amazon would use Aho-Corasick if they were really in the mood for violating the Google Play TOS.
- vvvnnnnvvv 13y agoI received a similar email about AWS keys checked into a public github repo. The email was very specific about this being the issue, so I suspect they were crawling and not merely detecting a strange usage pattern.
- rajbala 13y agoI don't think they're looking for higher than average API calls for a given key because my charges were completely expected.
- chippy 13y agoAPI calls from different IP Addresses plus any other information that gets through in the request packet.
- jakirk42 13y agoraj, just saw your post on here. I was wondering if you were the same guy Dennis in Delaware was trying to connect us to. We were doing the large scale touchscreen collaboration stuff
- rajbala 13y agoNope, not I. :)
- jakirk42 13y agoOk thanks lol
- GrinningFool 13y agoWait, there's someone in Delaware besides me? Unpossible!
- rajbala 13y agoThey clearly say that they've detected my access credentials in the app. There's no way to associate my credentials to my app without downloading the app first and inspecting it.
- brown9-2 13y agoPerhaps, but the assumed order of events here might not be what you think. I doubt that Amazon is scanning every app in the Android app store to find unsecured AWS credentials. It's more likely that they have an alert when the secret key is used to access an account from many different IP addresses, and looking at the user-agent string in the HTTP headers probably pointed them towards an Android app. It wouldn't be too hard for them to then look to see who owns the AWS account and then search for that person's name in the Android app store.