How I Stole Your ChatGPT API Keys
The AI gold-rush is in full swing. And in a gold rush, baddies will steal shovels. One deadly mistake is commonplace: bundling ChatGPT API keys directly into your shiny new AI app. This makes it trivial to steal your keys, burn through your credits, and rack up painful bills. Today, I’ll explain a fundamental Security Law:
Today, we’re looking at the two main ways bad actors can sniff out your API keys; then we’ll learn how you can avoid this fate. Decompiling Your AppIf you’re storing API keys on your device, you might employ various protections mechanisms, with varying levels of sophistication. I’ll go through the most popular approaches in detail, and demonstrate how easy they are to circumvent. Raw Strings in codeThis is usually the first approach engineers take, prior to becoming securitypilled. When requesting data from an API, you’ll write something like this: This code is compiled and delivered to users in the form of an I’ve written before about how easy it is to get access to the
By following this approach, it’s trivial to get into the
The real juice lies inside Bev, the UNIX executable for my trusty, boozy side project. This contains all the compiled and linked code for my app. With a built-in UNIX command, Naturally, the output is pretty verbose:
As well as raw strings, you’ll also see a ton of symbol names for your compiled functions. But near the bottom of this list, we see our prize: The raw string for our API key, out in the open — easily searchable by any villain handy with a regex. Info.plistYou might think to yourself, okay, I’m not going to put raw strings into my app where they can be easily decompiled. So I’ll put them in the
Your API call site becomes a little more complex to retrieve this value. There are a few sub-levels of sophistication here.
But all this is for naught. Let’s take one more look at that
Ruh-roh.
Regardless of how they find their way into the Obfuscated StringsIf you listen uncritically to everything you read on the internet, you might think you’re slick by obfuscating your strings. That’s certainly what I thought in 2019 when I first decided to be the resident security expert. You can get very fancy with your obfuscation algorithm and your salting, but let’s be real: you’re going to ask ChatGPT to write a pair of functions to obfuscate and decode your keys. You might as well use up those credits before they get nicked. Getting the key at runtime is as simple as decoding the raw obfuscated string. While it’s a little harder to read than raw strings, it’s still straightforward for a sufficiently motivated hacker to steal your keys. If you use an insecure approach such as base-64 encoding or XORing, it’s trivial to reverse engineer. Even with a decent algorithm and salt, attackers can use tools like Frida to extract your API keys from device memory at runtime. Obfuscation provides security by obscurity, but this isn’t an effective approach. No matter how good your obfuscation is, that API key will eventually be decoded and sent across the network. This leads us to the second, potentially far deadlier, method of stealing API keys. Monitoring Network TrafficThis is one of the most powerful techniques at your disposal. Free tools like Proxyman (or Charles Proxy if you’re an Original Gangster) allow you to inspect all the network I/O for an app or website.
Within seconds of loading the program, we immediately spot the auth header containing our API key in a network request.
Mitigating ProxyingIt’s possible to use techniques such as SSL pinning to mitigate this attack vector. SSL pinning checks the TLS certificates presented by backend servers, to verify they match certificates bundled on-device. This prevents man-in-the-middle attacks and blocks the proxy root certificate of network traffic monitoring tools like Proxyman. To implement SSL pinning on iOS, you can create a network request decorator with But, you guessed it, SSL pinning isn’t necessarily all it's cracked up to be. Reverse-engineers can use tools to bypass pinning, trivially when using jailbroken devices. Plus, when you don’t know exactly what you’re doing, SSL pinning can be risky.
How can I protect my app?I hope by now you’ve internalised our main lesson: protecting client-side API keys is largely security theatre. Your API keys will never be perfectly secure if you’re bundling them into your publicly-distributed app. Now that we know what not to do, what can we do? While the client-side is inherently insecure, it’s far more straightforward to keep your backend safe from bad actors. The “textbook” approach to securing third-party API keys is to place them into a (rotating) secrets manager, and proxying network requests via your backend. With this approach, you can authenticate network requests using your own systems and narrow down the potential attack vector. If you aren’t quite rolling your own infrastructure yet, Firebase Cloud Functions offer a simpler way to implement this middleware layer. While we’re at it, you can add a few more layers of protection to your device through tools like AppAttest on iOS, Play Integrity on Android, and by implementing RASP (runtime application self-protection) libraries. These stop your app from running on jailbroken devices, and protect against reverse-engineering tooling.
If you’re keen to learn more about protecting your app at runtime, tune in next week for an article exclusive to my paid subscribers: Jailbreak Protection on iOS. ConclusionDon’t store API keys on the client. Like, ever. Anybody telling you that your keys are safe on the client are either foolish or malevolent. Anything bundled into your app can be inspected. API keys in raw strings and Network proxying is a powerful tool for both good and evil. Approaches like SSL pinning can help protect against proxies, but may prove more trouble than they’re worth if you don’t know what you’re doing. Client-side protection mechanisms such as app integrity checking or reverse-engineering-detection libraries can help to layer protection onto your app or website. If you want to keep your API keys (reasonably) safe, you want to store everything on the backend, or use products such as Firebase Cloud Functions. You can sleep easy knowing your API keys are secure. Probably.
|
