(In-)Security of Backend-As-A-Service
summary
Claims that automated analysis of ~2 million Android apps yields widespread BaaS misconfiguration, with tools that extract embedded credentials (even obfuscated) and grant access to 56 million records. Demonstrates live exploits against Parse and AWS: reading/writing user data, hijacking S3 buckets, modifying websites, and gaining EC2/VM control. Describes a hybrid static/dynamic extractor and the Harvester automatic exploit generator, reports responsible disclosure outcomes and practical countermeasures developers rarely use.
AI-written summary · about
chapters (13)
- 0:00Start
- 2:06Introduction
- 2:36Platform as a Service
- 3:32Back-End as a Service
- 8:19Why Do You Need Two Keys To Initialize or To Connect to a Database
- 19:09The Hybrid Analysis
- 27:46Security 101
- 28:33Usage Models of an App
- 31:21Key Hierarchy
- 32:57Token Vending Machine
- 47:54But You Have To See that the the General Problem Is a Developer Problem So in the End Amazon Can Just Go to the Developer and Say Please Get this Right They Will Not Start and for Instance Deactivate Root Access or Access with Root Keys because Then They Will Break Existing Apps and that Will Hurt Their Business Model of Course We Told Them Hey Documentation Isn't So Great and I Think They Are Working on It but for for Ultimate Solutions You Have To Contact the Guy Who Wrote the Code the Guy Who Kind Of Owns the Data and Especially for for Parser Conference
- 48:18And I Think They Are Working on It but for for Ultimate Solutions You Have To Contact the Guy Who Wrote the Code the Guy Who Kind Of Owns the Data and Especially for for Parser Conference and Say They Have a Free Subscription a Free Basic Subscription so You Even Have Apps That Are No Longer on the Play Store because the Guy Died or Whatever I Don't Know but the Data Is Still There and no One Actually Feels the Responsibility To Delete It Parse CanNot because It's a Free Service They Don't Even Know whether this Guy Is Still Alive or Around and the Guy of Course He Doesn't Care Anymore His App Is Not the Store Anymore He's Gone He's Probably Doing Something Else So What about this Data
- 50:28But They these Findings Were Confirmed Just To Clarify this by Amazon and Parse so It's Real Data We'Re Talking about because the Providers They Actually Looked into into the Data Okay so the Question Was When We Verified if We Still Have Access to this Data To Verify this if We Access the the Keys What We Had or Ids the Credentials or Did We Run the Complete Application Again with Our Scanning Engine What We Did We Used Only the Credentials so the Application Id and the Key in Order To Check from those What We Already Know if It's Still Possible No so the Question Was if Face if the Facebook App Was Implemented Wrong Now
related talks
55mBreaking and Fixing Web Application Security
45mI just hacked your app!
19mProtect Your Digital Assets: Spot and Secure Open APIs Quickly
45mI just hacked your app!
33mHacking and protection of Mobile Apps and backend APIs
31mHow I hacked 30 mobile banking apps & the future of API Security
36mI just hacked your app!
27mCommon Application Security Mistakes that Enable Automated Attacks