0

According to this post, it's possible to decompile an iOS application.

How can I prevent an attacker from gaining access to my AWS DynamoDB database? Just having the access keys out in the open like shown on the Amazon developer guide doesn't seem like it would be very safe.

I would think that I could use keychain to store the keys, but I feel like there would be an easy way to get past this for a motivated attacker, given they have the app's assembly source code.

Currently, I connect using Amazon Cognito. All I have to use to connect are the identity ID and the role name. I don't see anything stopping an attacker from simply getting those values and connecting to the database.

For example, what stops an attacker from decompiling the Facebook iOS app code and deleting all of the users?

How can I prevent attackers from decompiling my iOS application and getting access to the database access keys, or at least prevent them from doing any major damage, such as deleting users?

Community
  • 1
  • 1
Jojodmo
  • 23,357
  • 13
  • 65
  • 107
  • The same page says *"We recommend using Amazon Cognito as your credential provider to access AWS services from your mobile app. Cognito provides a secure mechanism to access AWS services without having to embed credentials in your app. To learn more, see Amazon Cognito Identity."* Isn't that what you're looking for? – zneak Apr 29 '15 at 03:05
  • @zneak That is how I access the database. The thing is, I don't see any mechanism stopping an attacker from getting the cognito identity ID, and connecting to the database using that (I connect to the database with only the identity ID and a role name) – Jojodmo Apr 29 '15 at 03:11

3 Answers3

5

Based on my admittedly limited experience, I'd say that a really motivated attacker will always be able to retrieve the credentials you use to access your database regardless of what you do to your executable. I would, however, question why you application needs to have direct access to your database in the first place.

The usual way to safeguard your serverside data is to use a web service to access it. App contacts web service with request, service contacts db, gets data, sends it back. Since the web service and the db are both hosted on your server and only the web service needs direct access to your db, there is no need to store db access info in your app. Problem solved.

dandan78
  • 13,328
  • 13
  • 64
  • 78
0

It's impossible. In order for your program to do something, it must contain the instructions that allow the computer to follow to do that thing, which means anyone else can also follow those instructions to learn how to do the exact same thing.

newacct
  • 119,665
  • 29
  • 163
  • 224
  • Do you know of any way to limit the amount of damage an attacker can do? For example, how does facebook stop attackers from deleting all of their users? I just updated the question to make it a more clear – Jojodmo Apr 30 '15 at 02:03
  • @Jojodmo: You would need to be logged in to Facebook with some credential (password, etc.) as a particular user in order to delete that user. The app is simply an interface to a backend API. You could figure out how the app works and access the backend API directly but that makes no difference in terms of what credentials you need to perform a particular operation. – newacct Apr 30 '15 at 02:33
0

You can use SQLCipher and use your auth's userToken and/or userId as cipher keys.

Debaprio B
  • 503
  • 7
  • 9