Keep in Touch Episode 6 – “We know how the sausage is made” is now available. Enjoy!
Day trips are so much more exhausting that overnight trips.
In episode 5 of my Keep in Touch podcast I shared some thoughts on how I currently think about protecting credentials, API keys, and secrets (summarised as keys for the rest of the post) for 1st and 3rd party services and APIs. This blog post is a recap of those ideas and also a call for feedback and input from you.
The problem I am talking about addressing, is related to the fact that many applications embed keys in their binaries. These keys are required to authenticate (and authorise) the app, the user, or both with remote services. These services could be public or private APIs. Similar considerations apply if these APIs are 1st party or 3rd party.
If these keys are bundled with the app, a nefarious attacker could extract them and then impersonate the developer.
It’s not my intention to teach bad actors how to execute their plans, but I do want to give a few examples of some attack vectors that could lead to sensitive information falling in the wrong hands:
- the nightmare scenario: the attacker could run a man-in-the-middle attack by running a WiFi hotspot or could be operating one of the nodes on the internet between the device and the APIs the app connects to
- the easier than you’d think scenario: the attacker could run an on-device proxy (such as the brilliant Charles for iOS app that I use daily for non-nefarious reasons), and monitor all traffic
- the attacker could grab the app binary (ie. apk or ipa) and do a string search for key-like strings
Any of the above could lead to the attacker obtaining the keys that the app uses to authenticate itself against remote servers. Once they get these keys they can start impersonating the app and its users.
I believe that by not including any keys in the app’s binary and by provisioning these credentials only via a channel owned by the operating system that uses SSL pinning, the risks mentioned above can be reduced or even avoided.
SSL pinning is essential in order to prevent an attacker from inspecting the traffic between the client app and the remote endpoints.
This animation attempts to illustrate the approach I am suggesting:
- Provision the app without any keys
- Attempt to detect if the app is running on a jailbroken / rooted device, and bail if that is the case
- Upload the necessary keys to the Trusted Cloud provided by the Host operating system (i.e. CloudKit for iOS apps) using another app (i.e. console, browser, etc)
- Enforce read-only access to these keys for the client app
- Upon (first) launch, fetch the keys from the Trusted Cloud
- If the keys must be stored, only store them in a keychain or in a secure enclave
- Use the keys to communicate with the Server using an SSL pinned connection
- Should the keys become compromised, they should be replaced, and the client apps should naturally fetch the new keys. For this reason, getting the new keys should not require the previous keys.
The steps above rely on the fact that the mobile OS provides a cloud service that uses SSL pinning in order to communicate to the client apps. Without it, there cannot be a secure key provisioning mechanism and the entire flow falls apart.
Often times the security considerations come in “late” or “after the fact”. To assess the state of affairs, and to add more protection going forward, I would go over the checklist below:
- Limit the number of people who have access to the credentials. Replace the credentials when these people leave the job.
- Never embed the keys in the codebase
- Never grant the build (or distribution) servers access to the keys
- Only trust the cloud service that belongs to the platform vendor for your app (i.e. CloudKit for iOS apps, Firebase for Android apps.)
- Avoid storing the keys anywhere (on the device) unless really necessary
- If the keys must be stored, then the only acceptable place is the Keychain
- Avoid bundling black-box libraries. If the libraries use networking, inspect all networking traffic
- Do not use a 3rd party networking library unless absolutely necessary. Always check the source code of such libraries
- Never be the largest consumer of any one technology, framework, or library
- Only load the keys at the code level that really needs them. Do not pass them through the business layer, particularly if there are 3rd party analytics or logging libraries bundled with the app
- Obfuscate the code and avoid obvious naming strategies for the keys
- Check the app’s signature / hash or anything else similar that guarantees that the binary has not been tampered with
- Be mindful of jailbroken or rooted devices but never change the code in order to support them
- Do a quid-pro-quo vulnerability analysis with a trusted partner (make sure dinner or beer is something at stake if an issue is found)
If you have more to add to this list, I would love to hear from you!
I think of myself as a security minded person, but I am by no means an expert. I offer no guarantees that implementing the steps above is going to remove or prevent any security related problems for a system I have not seen before, but, based on my current knowledge, I do believe it is the closest thing to a “borderline bulletproof” approach to securing keys and credentials that native apps use.
Lastly, I sincerely hope that, if you read this and have identified a flaw in my reasoning, or if you can spot an oversight, you will share with me (ideally with a solution in tow) so I can update the article.
As I wrote previously, getting started with a Podcast can be very straight forward. Todd and I wanted to add some personality to our show’s online presence, so we decided we needed a website. A lot of the information that would normally go on the website is already available in the Podcast’s RSS feed, so I started thinking about a way of not duplicating this effort. The Keep In Touch show is a hobby, and given how busy (and lazy) I am at the moment, I needed a pragmatic solution.
KeepInTouch.fm runs on Jekyll and is updated every time we publish an episode using our fork of the Jekyll RSS importer. We upload the episode and its metadata to our Podcast host and then we point the importer at the Podcast RSS feed. If needed, we customise the blog post and then push it to GitHub. GitHub pages then automatically updates the website.
List of requirements
We wanted the website to provide some fairly basic functionality:
– general information about the show, and a the ability to subscribe to the Podcast
– a blog/website where each episode can have its own page
– each episode page would need to privide visitors with the ability to listen to the show, and to find shownotes, links, and other relevant information
As the administrators of the website, we would need:
– a modern website: responsive, fast, and secure
– an easy to maintain set up (i.e. no hardware / software maintenance)
– a simple updating mechanism
– a simple way of transforming the information we had already provided in the Podcast’s RSS feed
GitHub Pages was the first option we considered, and luckily it ticked all our boxes. We quickly set up an organisation and picked a simple, but quite configurable jekyll theme for the site.
The only friction I still had to deal with was the “transformation” of the Podcast RSS feed into blog posts on the site. Jekyll does come with an RSS importer, so I gave that a go. Most of the metadata was extracted nicely, but there was no way to play the show without changing the post manually to link to the mp3 file that was actually available in the RSS feed.
Open Source FTW
Luckily, the Jekyll project is open source, which meant I was able to fork the RSS importer, and turn the RSS audio enclosure into an HTML audio tag. All it took was 13 lines of code.
Today, my workflow couldn’t be (?) simpler:
– Record and edit the show
– Upload the episode and it’s metadata (i.e. shownotes) to the podcast host
– Run a simple script to fetch the new episode (and turn it from a feed Item into a blog Post)
– Push the new post to GitHub
If you found this post useful, please consider subscribing to KeepInTouch on Apple Podcasts, Google Podcasts, or wherever else you listen to podcasts. If you like what you hear, please leave a review. Lastly, please send us your feebdack via email or twitter @KeepInTouchFM.
Setting up a Podcast in 2019 can be fast, free, and painless. More importantly, the distribution and maintenance of the show can be (almost) fully automated. This post covers the steps I took to launch KeepInTouch.fm together with my co-host, Todd.
MVP – Minimum Viable Podcast
- First we decided what our show is about. Keep in Touch covers topics from two main areas: Apple/Google tech platforms, and raising kids
- To solve the hosting and publishing of the show we set up an account on Anchor.fm
- Lastly, we recorded and published the show
That’s could’ve been the proverbial it, but since both Todd and I are tech people, we were not satisfied, yet. Why not? Because of the details…
Past the basics
We wanted the show to have a home that we could customise, personalise. We also wanted to be able to understand and interact with our audience. To achieve this we made did a few more things:
- We put a little effort in the show artwork, we created chapters for the shows (chapter artwork and web links when appropriate), and we collected and published thorough show notes.
- We recorded and edited the audio outside Anchor, and only published the mastered audio. It’s not perfect but it’s definitely less *rough*.
- We bought a domain and we set up a website: KeepInTouch.fm.
- We set up a Twitter account: @KeepInTouchFM.
- We set up a vanity Google Alert for our show title and website.
- Speaking of vanity, we created a Chartable.com account to keep an eye on how the show is doing in the charts (we were #7 in the Educational Technology category at one point!).
- We transferred the ownership of the Apple Podcasts and Spotify feeds.
- We set up the Stitcher and TuneIn feeds ourselves.
- We integrated the podcast RSS feed with our new website: once we publish a show, a corresponding blog post gets created (almost) auto-magically.
Some of these enhancements will be the subject of future blog posts.
Things we learned
- Apple Podcasts took about five days to process Anchor’s request to list our show.
- Google Podcasts approved the show almost immediately but took about two weeks to actually make it available to listeners.
- PocketCasts picked up the show immediately (most likely due to an integration between them an Anchor).
- Anchor didn’t seem to get the show listed in TuneIn so we had to list add show manually.
- Anchor doesn’t actually support all the podcasting networks.
- Hosting the show’s website on GitHub pages was straightforward but did have some limitations. We forked Jekyll-Import to add support to the Jekyll RSS importer for Podcast RSS feeds, so we needed a home on GitHub. Hosting the website itself on GitHub made sense since Git enables a simple way to publish new episodes / blog posts.
- Hosting and publishing the show: Free.
- Hosting the website: Free.
- Having a custom domain name: same cost as for any other type of website.
- Podcast recording and editing tools: Free (not really, since we decided to use our own microphones and Digital Audio Workstation).
- Time required to record, edit, and publish the show: 1 hour for the recording, 4 hours for editing (takes less and less each time), 30 minutes for packaging and publishing.
TIL If you have a rogue stock ticker in your #iOS today widget that you cannot remove via the Stocks app (!), try getting rid of it via the macOS Today view. The removal will sync via iCloud to your iOS devices, too.
Ko tātou, tātou – We are one
I’m happy to introduce to you the Trade Me app for Apple Watch ⌚️
Can’t wait to hear what your thoughts are and how we can better suit your (wrist level) needs.
I’m proud of you, New Zealand Defence Force.
If you ever doubted that SSL pinning is really worth your time (and the pain), this article may convince you to reconsider your position.