Thousands of customer-facing Android and iOS mobile apps — including banking apps — have been found to contain hardcoded Amazon Web Services (AWS) credentials that would allow cyberattackers to steal sensitive information from corporate clouds.
Symantec researchers uncovered 1,859 business apps that use hardcoded AWS credentials, specifically access tokens. Of these, three-quarters (77%) contain valid AWS access tokens for logging into private AWS cloud services; and close to half (47%) contain valid AWS access tokens that also crack open millions of private files housed in Amazon Simple Storage Service (Amazon S3) buckets.
That means that a malicious-minded user of the app could easily extract the tokens and be off to the data-theft races, tapping into the cloud resources of the businesses that created the applications.
Thanks, Mobile Software Supply Chain
This unfortunate state of affairs is thanks to a mobile code supply chain issue, Symantec researchers said — vulnerable components that allow developers to embed hardcoded access tokens.
“We discovered that over half (53%) of the apps were using the same AWS access tokens found in other apps,” they said in an analysis on Sept. 1. “Interestingly, these apps were often from different app developers and companies. [Eventually] the AWS access tokens could be traced to a shared library, third-party SDK, or other shared component used in developing the apps.”
The firm found that these shared, hardcoded AWS tokens are used by in-house app developers for a variety of reasons, including downloading or uploading large media files, recordings, or images from the company cloud; accessing configuration files for the app; collecting and storing user-device information; or accessing individual cloud services that require authentication, such as translation services. However, the tokens’ reach into the cloud is often far greater than the developer may realize.
“The problem is, often the same AWS access token exposes all files and buckets in the Amazon S3 cloud, often corporate files, infrastructure files and components, database backups, etc.,” according to the analysis. “Not to mention cloud services beyond Amazon S3 that are accessible using the same AWS access token.”
As an example, one of the apps uncovered by the analysis was created by a B2B company that offers an intranet and communication platform. It also provides a mobile software-development kit (SDK) for customers to use to access the platform.
“Unfortunately, the SDK also contained the B2B company’s cloud infrastructure keys, exposing all of its customers’ private data on the B2B company’s platform,” Symantec researchers noted, adding that they notified all organizations using vulnerable apps of the issue. “Their customers’ corporate data, financial records, and employees’ private data was exposed. All the files the company used on its intranet for over 15,000 medium-to-large-sized companies were also exposed.”
The same situation held true for a collection of mobile banking apps on iOS that rely on the AI Digital Identity SDK for authentication. The SDK embeds AWS tokens that could be used to access private authentication data and keys belonging to every banking and financial app using it, as well as 300,000 banking users’ biometric digital fingerprints used for authentication, and other personal data (names, dates of birth, and more).
“Apps with hardcoded AWS access tokens are vulnerable, active, and present a serious risk,” Symantec researchers concluded. “[And] this is not an uncommon occurrence.”
Avoiding Cloud Compromise via Mobile Apps
Organizations can take steps to ensure that the apps they build for their customers don’t unwittingly offer a path to cyberespionage, according to Scott Gerlach, co-founder and CSO at StackHawk.
“Adding DevSecOps tools, like secret scanning, to continuous integration/continuous development pipelines (CI/CD) can help ferret out these types of secrets when building software,” he noted in a statement. “And it’s critical that you understand how to manage and securely provision AWS and other API keys/tokens to prevent unwarranted access.”
From a design perspective, developers can also replace hardcoded credentials with API calls to a repository or software as-a-service (SaaS) vault, or to use temporary tokens, according to Tony Goulding, cybersecurity evangelist at Delinea.
“[That way] they can pull a credential or key down in real-time that doesn’t persist on the device, in the app, or a local config file,” he said in a statement. “An alternative approach is to use the AWS STS service to provision temporary tokens to grant access to AWS resources. They’re similar to their long-term brethren except they have a short lifespan that’s configurable — as little as 15 minutes. Once they expire, AWS won’t recognize them as valid, preventing an illicit API request using that token.”
