Android Google Play makes a boo boo
Source: http://phys.org/news/2014-06-thousands-secret-keys-android-apps.html
Researchers find thousands of secret keys in Android apps
In a paper presented—and awarded the prestigious Ken Sevcik Outstanding Student Paper Award—at the ACM SIGMETRICS conference on June 18, Jason Nieh, professor of computer science at Columbia Engineering, and PhD candidate Nicolas Viennot reported that they have discovered a crucial security problem in Google Play, the official Android app store where millions of users of Android, the most popular mobile platform, get their apps.
"Google Play has more than one million apps and over 50 billion app downloads, but no one reviews what gets put into Google Play—anyone can get a $25 account and upload whatever they want. Very little is known about what's there at an aggregate level," says Nieh, who is also a member of the University's Institute for Data Sciences and Engineering's Cybersecurity Center. "Given the huge popularity of Google Play and the potential risks to millions of users, we thought it was important to take a close look at Google Play content."
Nieh and Viennot's paper is the first to make a large-scale measurement of the huge Google Play marketplace. To do this, they developed PlayDrone, a tool that uses various hacking techniques to circumvent Google security to successfully download Google Play apps and recover their sources. PlayDrone scales by simply adding more servers and is fast enough to crawl Google Play on a daily basis, downloading more than 1.1 million Android apps and decompiling over 880,000 free applications.
Nieh and Viennot discovered all kinds of new information about the content in Google Play, including a critical security problem: developers often store their secret keys in their apps software, similar to usernames/passwords info, and these can be then used by anyone to maliciously steal user data or resources from service providers such as Amazon and Facebook. These vulnerabilities can affect users even if they are not actively running the Android apps. Nieh notes that even "Top Developers," designated by the Google Play team as the best developers on Google Play, included these vulnerabilities in their apps.
"We've been working closely with Google, Amazon, Facebook, and other service providers to identify and notify customers at risk, and make the Google Play store a safer place," says Viennot. "Google is now using our techniques to proactively scan apps for these problems to prevent this from happening again in the future."
In fact, Nieh adds, developers are already receiving notifications from Google to fix their apps and remove the secret keys.
Nieh and Viennot expect PlayDrone to lay a foundation for new kinds of analysis of Android apps. "Big data is increasingly important and Android apps are just one form of interesting data," Nieh observes. "Our work makes it possible to analyze Android apps at large scale in new ways, and we expect that PlayDrone will be a useful tool to better understand Android apps and improve the quality of application content in Google Play."
Other findings of the research include:
- showing that roughly a quarter of all Google Play free apps are clones: these apps are duplicative of other apps already in Google Play
- identifying a performance problem resulting in very slow app purchases in Google Play: this has since been fixed
- a list of the top 10 most highly rated apps and the top 10 worst rated apps in Google Play that included surprises such as an app that, while the worst rated, still had more than a million downloads: it purports to be a scale that measures the weight of an object placed on the touchscreen of an Android device, but instead displays a random number for the weight
Comments
Anyhoo, good find, good article. Thanks.
If a developer hardcode their own security keys in the code, then those are stupid developers. They are just stupid whether they develop for Playstore or Appstore.
At least there are people who do this analysis and scrutinze the Playstore apps. The Apple Appstore is so closed off that all these problems are not surfaced or just swept under the carpet by Apple.
Welcome to having a false sense of security in the Apple eco-system.
Without having anyone outside of Apple able to do such an analysis, how will we know if Apple is doing the same security scan before making developers' apps available on the App Store? Is there any way to scan apps after they have been put up? I know the apps are merely a compressed folder and viewable when changing the .ipa suffix to .zip. I'm not a developer (or security expert for that matter) and can only go by articles like these from knowledgable people.
Good, and interesting info. Thanks for posting it. This is a issue that Google should address to developers sooner rather than later. I don't see why 'open' (I use that term lightly) has to also mean 'unsecure'.
Here is the actual paper (http://www.cs.columbia.edu/~nieh/pubs/sigmetrics2014_playdrone.pdf).
On the flip side apple closed system doesn't mean secure either. Just that nobody can peek into the system to discover problems.
Maybe there are as many security holes or malware in iOS as android but only those on android were discovered since it is an open platform.
According to developer comments in an Ars article on the subject some iOS developers take the same lazy path and include those "secret keys" hard-coded into their iOS apps.
http://arstechnica.com/security/2014/06/secret-keys-stashed-in-google-play-apps-pose-risk-to-android-users-developers/