AWS, Azure authentication keys found in Android and iOS apps used by millions of users

Several popular mobile applications for iOS and Android come with hard-coded, unencrypted credentials for cloud services such as Amazon Web Services (AWS) and Microsoft Azure Blob Storage, which protect user data and Your source code has been exposed to a security breach.

If this type of credential is exposed, it can easily lead to unauthorized access to storage buckets or databases containing sensitive user data. Apart from this, attackers can also use them to manipulate or steal data.

According to a report from Symantec, a Broadcom company, these keys exist in the app’s codebase due to errors or poor practices during development.

“Recent analysis reveals an alarming trend: Some widely used apps include hard-coded and unencrypted cloud service credentials within their codebases. ,” Symantec explains.

“This dangerous activity allows anyone with access to the app’s binaries or source code to extract these credentials and misuse them to manipulate or steal data, potentially leading to major security breaches. “This means that,” the researchers said.

Symantec says its researchers discovered credentials to cloud services in the following apps on Google Play:

1. photo stitch – Over 5 million downloads – Amazon hardcoded credentials
2. Mercabs – Over 5 million downloads – Hardcoded credentials for Microsoft Azure Blob Storage
3. Sureka businesss – 500,000+ downloads – Microsoft Azure Blob Storage Hardcoded Credentials
4. resound tinnitus relief – 500,000+ downloads – Microsoft Azure Blob Storage Hardcoded Credentials
5. Salusa – 100,000+ downloads – Microsoft Azure Blob Storage Hardcoded Credentials
6. Chola Ms Breakin – 100,000+ downloads – Microsoft Azure Blob Storage Hardcoded Credentials
7. EatSleepRIDE Motorcycle GPS – 100,000+ downloads – Twilio hardcoded credentials
8. Beltone relieves tinnitus – 100,000+ downloads – Microsoft Azure Blob Storage Hardcoded Credentials

They also discovered credentials for several popular apps listed in Apple’s App Store.

1. crumble – 3.9 million+ ratings – Amazon hardcoded credentials
2. Eureka: Make Money with Surveys – 402.1K+ Rating – Amazon Hardcoded Credentials
3. Videoshop – Video Editor – 357.9K+ Ratings – Amazon Hardcoded Credentials
4. Solitaire Clash: Earn Real Cash – 244.8K+ Ratings – Amazon Hardcoded Credentials
5. Zap Surveys – Make Money Easy – 235,000+ ratings – Amazon Hardcoded Credentials

The App Store does not report download numbers, but those numbers are usually much higher than the number of ratings listed.

Note that Google displays the total number of downloads over an app’s lifetime in the Play Store, and does not reflect active installs.

The presence of the above-mentioned apps on your phone does not mean that your personal data has been stolen, but unless the developer takes action and eliminates the risk, your personal data can be accessed and hackers can steal your data. This means that there is a possibility that it may be extracted.

In September 2022, Symantec sounded the alarm about this risk, saying its researchers discovered more than 1,800 iOS and Android apps containing AWS credentials, and 77% of those apps had valid access tokens in their codebase. I emphasized that.

Researchers recommend that developers follow best practices for protecting sensitive information in mobile apps.

This includes using environment variables to store credentials, using secret management tools (AWS Secrets Manager, Azure Key Vault, etc.), data encryption, regular code reviews and audits, and sensitive data. and integrating automated security scanning early in the development process to detect security issues. .