I came across these blog posts where a man was able to extract the Instagram private signature key from the Android app: http://mokhdzanifaeq.github.io/extracting-instagram-signature-key/

Which could then be used for the purpose of exploiting Instagram's private API, like so: https://gist.github.com/will3942/8113903#file-app-rb

A few personal questions arose out of this:

  1. Is there anything else the Instagram security engineers could have done to prevent this from happening? I assume they are extremely talented software engineers, but does having a user in possession of an app, in this case in the form of an android .apk, make it always inherently easier/always possible for people to discover secret keys?
  2. Are web apps inherently more secure than mobile apps? Let's say that the Instagram web app is identical to their mobile app. Would it still be possible for someone to extract the web app secret keys, or is this much more difficult, if not impossible, to do because the user will never be in possession of the full source code of the web app.

1 Answer 1

  1. Yes, once you release an application, you have no control over what people do with it. You can obfuscate or pre-process code to make it harder to find things out, but by definition, it needs to be executable and accessible to the underlying processor. Given enough time and effort, someone can always find out anything that is embedded in the application. This applies to any type of application - mobile app, desktop app, console app. If all else fails, a really determined attacker could emulate the processor and dump out what happens.

  2. No, but the attack methods change. Taking the Instagram example, if you have a web app, communications can be sent over an encrypted channel, but they might not be able to control the source of communications. It would be difficult to distinguish between the legitimate app and a third party one. For some businesses, this is important (for example, if they show adverts in their official app). On the other hand, with a mobile app, it would be possible to provide, for example, certificate verification, where the server and client mutually verify each other. In this case, it would be possible to remove a compromised certificate on the server side, although this might cut off users who haven't updated their apps.

    In the first case, attacks would concentrate on identifying valid calls to the backend system, and then attempting to abuse that. In the second case, attacks would initially try to extract the certificate, but in that process would probably find the calls.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .