{"id":5904,"date":"2024-10-23T10:44:38","date_gmt":"2024-10-23T15:44:38","guid":{"rendered":"https:\/\/www.darkreading.com\/cloud-security\/mobile-apps-millions-downloads-expose-cloud-credentials"},"modified":"2024-10-23T10:44:38","modified_gmt":"2024-10-23T15:44:38","slug":"mobile-apps-with-millions-of-downloads-expose-cloud-credentials","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2024\/10\/23\/mobile-apps-with-millions-of-downloads-expose-cloud-credentials\/","title":{"rendered":"Mobile Apps With Millions of Downloads Expose Cloud Credentials"},"content":{"rendered":"
<\/a><\/div>\n
<\/div>\n

Several widely used mobile apps, some with millions of downloads, expose hardcoded and unencrypted <\/span>credentials to cloud services<\/a><\/span> within their code bases, researchers from Symantec have found. This potentially allows anyone with access to the app\u2019s binary or source code to extract the credentials to exploit cloud infrastructure for misuse.<\/span><\/p>\n

Popular apps for both Android and iPhone devices include credentials for either Amazon Web Services (AWS) and Microsoft Azure Blog Storage within their code, Symantec <\/span>revealed<\/a><\/span> in a blog post this week. And they’re found on each device platform\u2019s respective official mobile app store: <\/span>Google Play<\/a><\/span> and Apple’s App Store.<\/span><\/p>\n

“This dangerous practice means that anyone with access to the app’s binary or source code could potentially extract <\/span>these credentials<\/a><\/span> and misuse them to manipulate or exfiltrate data, leading to severe security breaches,” Symantec engineers wrote in the post.<\/span><\/p>\n

Further, the “widespread nature” of the vulnerabilities across apps for both iOS and Android platforms “underscores the urgent need for a shift towards more secure development practices” when it comes to mobile applications, they added.<\/span><\/p>\n

Symantec\u2019s research zeroed in on a number of widely distributed mobile applications that included either AWS or Azure credentials in their codebases. In terms of the former, both Android and iOS apps are guilty of credential exposure, while several Android apps expose Azure storage credentials.<\/span><\/p>\n

Related:<\/span>SoftwareOne Launches Cloud Competency Centre in Malaysia<\/a><\/p>\n

For example, an app called The Pic Stitch: Collage Maker found on the Google Play store contains hardcoded AWS production credentials \u2014 including the production Amazon S3 bucket name, the read and write access keys, and secret keys \u2014 in its codebase, the researchers found. It also reveals staging credentials in some cases.<\/span><\/p>\n

iOS Apps With Serious Security Risks<\/h2>\n

Meanwhile, three iOS apps examined by Symantec also were found to expose AWS <\/span>credentials<\/a><\/span>. One called Crumbl, which has more than 3.9 million user ratings and is ranked No. 5 in the Food & Drink category on the Apple App Store, initializes an AWSStaticCredentialsProvider with plaintext credentials. The credentials, which are used to configure AWS services, include both an access key and secret key.<\/span><\/p>\n

Furthermore, the app also includes another “significant security oversight” by including a WebSocket Secure (WSS) endpoint within its code. This endpoint, part of the Amazon API URL, is hardcoded with an API Gateway that directly connects to the Internet of Things services on AWS.<\/span><\/p>\n

“Exposing such URLs alongside static credentials makes it easier for attackers to potentially intercept or manipulate communications, leading to unauthorized access to the associated AWS resources,” the engineers wrote. Thus, this vulnerable configuration, without proper encryption or obfuscation, “presents a serious risk to the integrity of the application and its backend infrastructure,” they noted.<\/span><\/p>\n

Related:<\/span>Unmanaged Cloud Credentials Pose Risk to Half of Orgs<\/a><\/p>\n

Two other iOS apps with hundreds of thousands of App Store ratings also expose AWS credentials by hardcoding them directly within their code; the apps are Eureka: Earn Money for Surveys and Videoshop \u2013 Video Editor.<\/span><\/p>\n

The former allocates an INMAWSCredentials object and initializes it with the access key and secret key, both stored in plaintext and which can be used to log events to AWS, “exposing critical cloud resources to potential attacks,” the engineers said.<\/span><\/p>\n

The latter directly embeds unencrypted AWS credentials in the [VSAppDelegate setupS3] method, which means anyone with access to the app’s binary could easily extract them. This would give them unauthorized access to the associated S3 buckets and potentially lead to data theft or manipulation.<\/span><\/p>\n

Android Apps Expose Azure Credentials<\/h2>\n

Similarly, three Android applications expose credentials to Microsoft Azure Blob Storage directly, via either their binaries or codebases, Symantec found.<\/span><\/p>\n

Related:<\/span>Cisco Disables DevHub Access After Security Breach<\/a><\/p>\n

An Indian ride-sharing app, Meru Cabs \u2014 which has more than 5 million downloads on Google Play \u2014 includes hardcoded Azure credentials within its UploadLogs service by embedding a connection string that includes an account key. “This connection string is used to manage log uploads, exposing critical cloud storage resources to potential abuse,” the engineers wrote.<\/span><\/p>\n

Sulekha Business, another Android app with more than 500,000 downloads, embeds multiple hardcoded Azure credentials used for various purposes \u2014 such as adding posts, handling invoices, and storing user profiles \u2014 across its codebase.<\/span><\/p>\n

A third Android app that also has more than 500,000 downloads, ReSound Tinnitus Relief, also hardcodes Azure Blob Storage credentials for managing various assets and sound files, the exposure of which could lead to unauthorized access and data breaches.<\/span><\/p>\n

Mitigation Begins With App Development<\/h2>\n

Symantec\u2019s findings come a day after the release of a report by Datadog that found that <\/span>unmanaged credentials<\/a><\/span> that live for too long on a cloud-based network posed a security risk to half of organizations. Indeed, any inadvertent disclosure of credentials to cloud services exposes any organization with network infrastructure, software, or other assets running on them to significant risk, according to Symantec.<\/span><\/p>\n

A good place to start to mitigate these risks is in the development of applications, where developers should follow best practices for managing sensitive information. They include the use of environment variables to store sensitive credentials so they are loaded at runtime rather than embedded directly in the app’s code, according to Symantec.<\/span><\/p>\n

Developers also should use dedicated secrets management tools, such as AWS Secrets Manager or Azure Key Vault, to securely store and access credentials. If the credentials must be stored in the app, then they should ensure that they use strong encryption algorithms, and decrypt them at runtime as needed.<\/span><\/p>\n

According to Symantec, another way to protect credentials and also avoid other <\/span>potential app-development missteps<\/a><\/span> is to integrate automated security-scanning tools into the development pipeline to detect common security flaws early in the development process.<\/span><\/p>\n

Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Several widely used mobile apps, some with millions of downloads,<\/p>\n","protected":false},"author":12,"featured_media":5905,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1],"tags":[809],"class_list":["post-5904","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-dark-reading"],"featured_image_urls":{"full":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/mobile-apps-with-millions-of-downloads-expose-cloud-credentials.png?fit=1920%2C1080&ssl=1",1920,1080,false],"thumbnail":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/mobile-apps-with-millions-of-downloads-expose-cloud-credentials.png?resize=150%2C150&ssl=1",150,150,true],"medium":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/mobile-apps-with-millions-of-downloads-expose-cloud-credentials.png?fit=300%2C169&ssl=1",300,169,true],"medium_large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/mobile-apps-with-millions-of-downloads-expose-cloud-credentials.png?fit=640%2C360&ssl=1",640,360,true],"large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/mobile-apps-with-millions-of-downloads-expose-cloud-credentials.png?fit=640%2C360&ssl=1",640,360,true],"1536x1536":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/mobile-apps-with-millions-of-downloads-expose-cloud-credentials.png?fit=1536%2C864&ssl=1",1536,864,true],"2048x2048":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/mobile-apps-with-millions-of-downloads-expose-cloud-credentials.png?fit=1920%2C1080&ssl=1",1920,1080,true],"chromenews-featured":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/mobile-apps-with-millions-of-downloads-expose-cloud-credentials.png?fit=1024%2C576&ssl=1",1024,576,true],"chromenews-large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/mobile-apps-with-millions-of-downloads-expose-cloud-credentials.png?resize=825%2C575&ssl=1",825,575,true],"chromenews-medium":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/mobile-apps-with-millions-of-downloads-expose-cloud-credentials.png?resize=590%2C410&ssl=1",590,410,true]},"author_info":{"display_name":"Dark Reading","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/darkreading\/"},"category_info":"Uncategorized<\/a>","tag_info":"Uncategorized","comment_count":"0","jetpack_featured_media_url":"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/mobile-apps-with-millions-of-downloads-expose-cloud-credentials.png?fit=1920%2C1080&ssl=1","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/5904","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=5904"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/5904\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media\/5905"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=5904"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=5904"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=5904"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}