Light

Episode #887 Quiz

Embedding AWS Credentials
Date: 2022-09-06 | Length: 1.75 hrs | Episode page at twit.tv

About this episode

Symantec found 1,859 iOS and Android apps leaking hard-coded AWS credentials; 77% enabled private AWS services, 47% exposed S3 files, and 53% reused tokens across apps via shared SDKs and libraries. Hard-coded keys granted access to images, backups, biometrics, source code, and even root accounts.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what condition on Google’s OSS VRP submissions was required when a bug was found in a third-party dependency rather than Google’s own code?

Question 1

According to the episode, what condition on Google’s OSS VRP submissions was required when a bug was found in a third-party dependency rather than Google’s own code?

A fully working proof-of-concept exploit had to be published before submission was accepted Prior notification to the affected dependency before submission was required The dependency had to be owned by Google before it could qualify for reward consideration Public disclosure to the dependency maintainer after the reward was paid was required

Question 2: In the TikTok breach discussion, which detail was central to why Troy Hunt remained unconvinced by the initial claims?

Question 2

In the TikTok breach discussion, which detail was central to why Troy Hunt remained unconvinced by the initial claims?

The attacker had already demanded ransom from TikTok before any data was analyzed The breach was immediately confirmed by TikTok’s own security team The entire claim was based on a single screenshot with no database samples at all Some sample data matched public information while some appeared to be junk or test data

Question 3: What exactly did the Chromium team say about clipboard behavior when discussing the issue highlighted by webplatform.news?

Question 3

What exactly did the Chromium team say about clipboard behavior when discussing the issue highlighted by webplatform.news?

Reading from the clipboard always requires permission, but writing plain text or images can currently happen without permission or user gesture Clipboard access is disabled unless the user first installs a browser extension Clipboard writing is only possible after a site has obtained persistent background access Reading from the clipboard is allowed silently, but writing always requires a permission prompt

Question 4: What was the key technical reason Symantec found for the AWS credentials appearing across many unrelated mobile apps?

Question 4

What was the key technical reason Symantec found for the AWS credentials appearing across many unrelated mobile apps?

The credentials were leaked only through intercepted network traffic between apps and AWS The same tokens were embedded in a shared library, third-party SDK, or other shared component The apps all used the same public AWS test account for development builds only The tokens were generated by AWS and inserted dynamically on first launch

Question 5: For the PyPI pip behavior described in the episode, under what package condition did the unexpected code execution occur when a package was downloaded?

Question 5

For the PyPI pip behavior described in the episode, under what package condition did the unexpected code execution occur when a package was downloaded?

When pip downloaded any package that included a compiled extension module When pip installed a wheel file from the primary repository mirror When pip fell back to a tar.gz package because no wheel file was present When pip was used in offline mode without network verification

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.