Hundreds of Android apps contain hard-coded leaky keys and tokens that could be abused by hackers, says security research firm Fallible. The firm reverse engineered 16,000 apps to identify security issues. The keys and tokens frequently belong to third-party services to help app integration, but if leaked can also be used to alter or abuse the services. In a blog post, Google said it is working with developers on new ways for them to protect their apps. The security firm also found 10 examples of secret keys hard-coded into Amazon Web Service apps, which are popular among Silicon Valley start-ups.
Hundreds of Android apps contain hard-coded leaky keys and tokens that could be abused by hackers, says security research firm Fallible. The firm reverse engineered 16,000 apps to identify security issues. The keys and tokens frequently belong to third-party services to help app integration, but if leaked can also be used to alter or abuse the services. Of the 16,000 apps examined by Fallible, just over 300 had easily-found hard-coded keys for services such as Twitter, Dropbox and Slack. The security firm also found 10 examples of secret keys hard-coded into Amazon Web Service apps, which are popular among Silicon Valley start-ups.