40+ Apps With More than 100 Million Downloads Exposing AWS API Keys Which Leads to Compromise

From NASA to Netflix, Amazon Web Services (AWS) and APIs are used by millions of small companies, enterprises, and government companies worldwide for their infrastructure needs which had gotten its eyes on the attackers now! Yes, CloudSEK’s BeVigil, a security search engine for mobile apps, has found that 0.5% of mobile apps expose AWS API keys putting their internal networks and data at high risk. It is seen that 40+ apps, with over 100 million downloads, have hardcoded private AWS keys.

What is the critical flaw?

The API acts like a password for the mobile apps to access data stored on AWS, for practical understanding, let’s think that AWS is your apartment that has critical data, then the API key unlocks your front door. These keys could be easily discovered by malicious hackers or competitors who could use to compromise their data and networks.

Apps disclosing the API keys:

CloudSEK’s BeVigil is the world’s first security search engine for mobile apps, in April 2021. Sadly, developers are skipping this security check and they are shipped to app stores. over 10,000 apps have been uploaded to BeVigil for analysis on which 40+ apps had hardcoded private AWS keys.

Below is the list of apps whose keys are deactivated

Organisation	App ID	No. of Installs	Category	Country
Clubfactory	club.fromfactory	100,000,000+	Ecommerce	India
Adobe Photoshopfix	com.adobe.adobephotoshopfix	10000000	Photography	United States
Adobe Comp	com.adobe.comp	500,000+	Art & Design	United States
Weather Forecast & Snow Radar	com.weather.weather	100000000	Weather	United States
Wholee – Online Shopping Store	com.wholee	1000000	Shopping	Singapore
Oven Story Pizza	in.ovenstory	1000000	Food & Drink	India
Hootsuite:	com.hootsuite.droid.full	5000000	Social	Canada

Impacts Expected

AWS keys hardcoded in a mobile app source code can cause adverse effects as the attack can be chained and even attackers can get access to the codebase and config even.

This is an app in playstore with more than half a million downloads that have hardcoded AWS key and secret in its strings(.)xml file.

This key has access to multiple AWS services including ACM (Certificate Manager), ElasticBeanstalk, Kinesis, OpsWorks, S3. Collectively these 88 buckets contain 10,073,444 files and the data being exposed sums up to a total of 5.5 Terabytes.

Also, these source code, backup files, user reports, test artifacts, user uploads, logs, WordPress backup, user certificates, config files, credential files are found distributed across these buckets.

Reason for APK to be hardcoded?

• Accessing static files from s3 buckets in the mobile app
• Uploading data collected from the app user to s3
• Sending mails via the AWS SES service

Conclusion

If you happen to expose your AWS key, then quickly Revoke/Delete an access key.

Also Read

WeSteal: A Cryptocurrency-Stealing Malware that Sold in Dark Web Markets

Badloc- Microsoft Warns of Multiple Vulnerabilities that Could Affect a Wide Range of IoT and OT Devices