Unveiling the Hidden Threat: Hardcoded Cloud Credentials in Widely Used Mobile Apps

Short Summary:

Mobile apps are increasingly vulnerable due to the presence of hardcoded and unencrypted cloud service credentials in their codebases. This issue poses significant risks to user data and backend services, as demonstrated by the Pic Stitch: Collage Maker app, which has been found to contain hardcoded AWS credentials. The article discusses these vulnerabilities and suggests best practices for developers to mitigate such risks.

Key Points:

  • Mobile apps are integral to daily life, with millions of downloads.
  • Recent analysis reveals hardcoded and unencrypted cloud service credentials in popular apps.
  • This vulnerability allows unauthorized access to sensitive data and backend services.
  • The Pic Stitch: Collage Maker app contains hardcoded AWS credentials, posing a security risk.
  • Developers are urged to adopt best practices to prevent hardcoding sensitive credentials.

MITRE ATT&CK TTPs – created by AI

  • Credential Dumping – T1003
    • Extracting hardcoded credentials from application binaries or source code.
  • Data Exfiltration – T1041
    • Using extracted credentials to manipulate or exfiltrate data from cloud services.
  • Application Layer Protocol – T1071
    • Exploiting APIs to access cloud services using hardcoded credentials.

Mobile apps have become an essential part of our everyday lives, with millions of apps downloads on platforms like the Google Play Store and Apple App Store, a hidden threat has emerged that could put user data and backend services at significant risk. 

Recent analysis has uncovered a troubling trend: several widely-used apps have been found to contain hardcoded and unencrypted cloud service credentials within their codebases. This dangerous practice means that anyone with access to the app’s binary or source code could potentially extract these credentials and misuse them to manipulate or exfiltrate data, leading to severe security breaches. 

In this blog, we will explore specific examples of these vulnerabilities, focusing on apps that have hardcoded Amazon Web Services (AWS) and Microsoft Azure Blob Storage credentials, and discuss best practices that developers should adopt to prevent such issues.

Hardcoded AWS Credentials in Mobile Apps

The Pic Stitch: Collage Maker app, with over 5 million downloads on the Google Play Store, has been found to contain hardcoded AWS credentials directly within its code, posing a significant security risk. The code snippet from Jadx (Figure. 1-3) reveals that the app uses the method loadAmazonCredential(boolean z) to load the appropriate credentials depending on the environment. If the boolean flag is set to true, the app loads the production credentials, including the production Amazon S3 bucket name, the read and write access keys, and secret keys. Conversely, if the flag is false, the app loads the corresponding staging credentials.

Source: Original Post