Hacker News Reader

Comment by Aqueous | Hacker News Reader

I don't think they are inspecting the app ; they don't need to. They can see that there are a higher-than-average number of API accesses from a given platform, using the AWS Secret Key as the login credential.

View on HN

I think this is a more plausible approach (and likely cheaper resource-wise to implement). Though, if the authentication requests somehow identify the Android app in question, it might be easy for Amazon to then perform a follow-up and download the app to verify their suspicions and avoid false-positives.

I dont think it would be that hard to automate decompilation and fire off an email after looking for secret keys. Either way it's good to see.

This exists as a service - http://apkscan.nviso.be/ does a scan of your APK and registers requests to servers, lists hardcoded strings and other possible issues.

I received a similar email about AWS keys checked into a public github repo. The email was very specific about this being the issue, so I suspect they were crawling and not merely detecting a strange usage pattern.

I don't think they're looking for higher than average API calls for a given key because my charges were completely expected.

API calls from different IP Addresses plus any other information that gets through in the request packet.

raj, just saw your post on here. I was wondering if you were the same guy Dennis in Delaware was trying to connect us to. We were doing the large scale touchscreen collaboration stuff

Nope, not I. :)

Ok thanks lol

Wait, there's someone in Delaware besides me? Unpossible!

But then how would you automatically identify the app name as shown in his email? I think it's easier to download the app. Only ~1m android applications out there. You can probably crawl the android store with just 1 or 2 servers using the algorithm I described below with a trie. Identifying patterns from random data seems way harder to get right, but maybe that's because I have a CS background rather than a statistics one.

Most Android http clients put the package name in the user agent header. It's trivial for Amazon to find the app as a result.

Also, Amazon would use Aho-Corasick if they were really in the mood for violating the Google Play TOS.

They clearly say that they've detected my access credentials in the app. There's no way to associate my credentials to my app without downloading the app first and inspecting it.

Perhaps, but the assumed order of events here might not be what you think. I doubt that Amazon is scanning every app in the Android app store to find unsecured AWS credentials.

It's more likely that they have an alert when the secret key is used to access an account from many different IP addresses, and looking at the user-agent string in the HTTP headers probably pointed them towards an Android app.

It wouldn't be too hard for them to then look to see who owns the AWS account and then search for that person's name in the Android app store.

Reply on news.ycombinator.com