Article Details

AWS, Azure auth keys found in Android and iOS apps used by millions. Multiple popular mobile applications for iOS and Android come with hardcoded, unencrypted credentials for cloud services like Amazon Web Services (AWS) and Microsoft Azure Blob Storage, exposing user data and source code to security breaches. Exposing this type of credentials can easily lead to unauthorized access to storage buckets and databases with sensitive user data. Apart from this, an attacker could use them to manipulate or steal data. According to a report from Symantec, a Broadcom company, these keys are present in the apps' codebases because of errors and bad practices during the development phase. "Recent analysis has uncovered a troubling trend: several widely-used apps have been found to contain hardcoded and unencrypted cloud service credentials within their codebases," Symantec explains. "This dangerous practice means that anyone with access to the app's binary or source code could potentially extract these credentials and misuse them to manipulate or exfiltrate data, leading to severe security breaches," the researchers say. Symantec says that its reasearchers found credentials to cloud services in the following apps on Google Play: They also discovered credentials in several popular apps listed in Apple's App Store: While the App Store does not report the number of downloads, the number is typically much higher than the amount of ratings listed. It is worth noting that Google displays in Play Store the total number of downloads for the lifetime of the app and does not reflect active installations. The presence of any of the apps above on your phone does not mean that your personal data has been stolen but that it is accessible and hackers could exfiltrate it unless developers take action and remove the risk. In September 2022, Symantec raised the alarm about this risk, highlighting that its researchers found more than 1,800 iOS and Android apps that contained AWS credentials, 77% of the apps having valid access tokens in the codebase. The researchers recommend developers to follow best practices for protecting sensitive information in mobile apps. This includes using environment variables to store credentials, using secrets management tools (e.g. AWS Secrets Manager, Azure Key Vault), encrypting data, regular code reviews and audits, and integrate automated security scanning early in the development process to detect sensitive data or security issues.