(In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing...

55
13.11.15 | BlackHat Europe 2015 | 1 (In-)Security of Backend-as-a-Service Siegfried Rasthofer (TU Darmstadt / CASED) Steven Arzt (TU Darmstadt / CASED) Robert Hahn (TU Darmstadt) Max Kolhagen (TU Darmstadt) Eric Bodden (Fraunhofer SIT / TU Darmstadt)

Transcript of (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing...

Page 1: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 1

(In-)Security of Backend-as-a-Service

Siegfried Rasthofer (TU Darmstadt / CASED) Steven Arzt (TU Darmstadt / CASED) Robert Hahn (TU Darmstadt) Max Kolhagen (TU Darmstadt) Eric Bodden (Fraunhofer SIT / TU Darmstadt)

Page 2: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 2

Steven Arzt •  3rd year PhD-Student at TU Darmstadt •  Maintainer of the Soot and FlowDroid frameworks •  Works on static program analysis •  Likes to look for vulnerabilities

#Whoami

Siegfried Rasthofer •  3rd year PhD-Student at TU Darmstadt •  Research interest in static-/dynamic code analyses •  AOSP exploits, App security vulnerabilities •  Talks at academic as well as industry conferences

Page 3: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 4

IaaS PaaS

SaaS

??

Page 4: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 5

BaaS

Page 5: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 6

Security?

Page 6: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 7

Page 7: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 8

Agenda

•  Introducing BaaS

•  Security Analysis

•  Findings

•  Countermeasures

•  The Wishlist

•  Conclusion

Page 8: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 9

Backend-as-a-Service (1)

BaaS SDK

Cloud

APP

Page 9: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 10

Backend-as-a-Service (2)

BaaS

Android iOS

...

JavaScript

Page 10: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 11

Backend-as-a-Service (3)

Push Notifications Data Storage

User Administration Social Network

...

Page 11: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 12

Amazon Tutorial

DB connection

BaaS SDK

AmazonS3Client s3Client = new AmazonS3Client(new BasicAWSCredentials(“ACCESS_KEY_ID“, “SECRET_KEY“) );

Page 12: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 13

Amazon Tutorial

DB connection AmazonS3Client s3Client = new AmazonS3Client(

new BasicAWSCredentials(“ACCESS_KEY_ID“, “SECRET_KEY“) );

BaaS SDK

“When you access AWS programmatically, you use an access key to verify your identity and the identity of your applications. An access key consists of an access key ID and a secret access key. Anyone who has your access key has the same level of access to your AWS resources that you do.“

Source: http://docs.aws.amazon.com/

“ACCESS_KEY_ID“, “SECRET_KEY“

Page 13: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 14

Amazon Tutorial

DB connection AmazonS3Client s3Client = new AmazonS3Client(

new BasicAWSCredentials(“ACCESS_KEY_ID“, “SECRET_KEY“) );

BaaS SDK

“…The AWS SDKs use your access keys to sign requests for you so that you don't have to handle the signing process…”

http://docs.aws.amazon.com/

“…Secret access keys are, as the name implies, secrets, like your password…”

Jim Scharf

Director, AWS Identity and Access Management

“ACCESS_KEY_ID“, “SECRET_KEY“

(username) (password)

Page 14: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 15

IT Security 101

Peter

“Hi, I am Peter” Identification

“My password is Secret123” Authentication

"I am allowed to access foo.txt”

Authorization

Server

Page 15: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 16

App Authentication Model

App “Hi, I am app <Application ID>” Identification

“My <Secret Key> is in the app” ??? Authentication

Server

Identification Authentication = ??

Page 16: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 17

App Authentication Model

Server

Peter

Howard

Page 17: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 18

Developer Opinion

[...]“The App-Secret key should be kept private - but when releasing the app they can be reversed by some guys. I want to know what is the best thing to encrypt, obfuscate or whatever to make this secure.“[...]

(Source: stackoverflow.com)

“Few ideas, in my opinion only first one gives some guarantee: 1. Keep your secrets on some server on internet, and when needed

just grab them and use. 2. Put your secrets in jni code 3. use obfuscator 4. Put your secret key as last pixels of one of your image in assets “

(Source: stackoverflow.com)

Q:

R:

NO!!!!

Page 18: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 19

SECURITY ANALYSIS Let’s go for it

Page 19: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 20

Pre-Analysis (Parse example)

public void onCreate() { java.lang.String $S1, $S2; $S1 = “34lI1wgISkIUpTunWRAzXei20H3NAL7W6buKTe7e"; $S2 = “pB7OlNi0jsEp3fpJfq9wvHBoOWgaOQCSW98BF7e3"; staticinvoke <Parse: void initialize(Context, String, String)>(this, $S1, $S2); }

+

”User” Table

Page 20: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 21

Pre-Analysis result: •  All records were accessible •  Few developers used obfuscation techniques (“security

by obscurity”)

Page 21: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 22

… let’s get ready for a mass-analysis

Page 22: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 23

Mass Analysis

Apk 1

...Apk 2

Apk n

Pre-Analysis

Library-Detection

Key-Extraction

TablenameExtraction

Exploit Information

Exploit-GeneratorConcrete Database

Information

Page 23: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 24

Apk 1

...Apk 2

Apk n

Pre-Analysis

Library-Detection

Key-Extraction

TablenameExtraction

Exploit Information

Exploit-GeneratorConcrete Database

Information

How can we extract specific information (e.g. strings) from Apks?

Page 24: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 25

APK Information Extraction

$S1 = “34lI1wgISkIUpTunWRAzXei20H3NAL7W6buKTe7e";$S2 = “pB7OlNi0jsEp3fpJfq9wvHBoOWgaOQCSW98BF7e3";staticinvoke <Parse: void initialize(Context, String, String)>(this, $S1, $S2);

1.  API Identification

2. Information Extraction:

Static Dynamic Hybrid

Page 25: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 26

HARVESTER (Hybrid Data Extraction)

Harvesting Runtime Data in Android Applications for Identifying Malware and Enhancing Code Analysis Siegfried Rasthofer, Steven Arzt, Marc Miltenberger, Eric Bodden Technical Report, February 2015.

Hybrid

Page 26: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 27

Data Access Apk 1

...Apk 2

Apk n

Pre-Analysis

Library-Detection

Key-Extraction

TablenameExtraction

Exploit Information

Exploit-GeneratorConcrete Database

Information

“34lI1wgISkIUpTunWRAzXei20H3NAL7W6buKTe7e"

“pB7OlNi0jsEp3fpJfq9wvHBoOWgaOQCSW98BF7e3"

“CreditCardDataTable"

“ContactDataTable"

...

BaaS API

Page 27: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 28

OUR FINDINGS So … how bad is it?

Page 28: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 29

Findings Parse

Purchase data

User-centric location data

Facebook Information -  User‘s friends -  User‘s blocked

friends

Contact data Valid email addresses

Birthday Information Phone numbers

Pictures Precise car accident Information

Page 29: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 30

Findings Parse (2)

We know what you did this summer: Android Banking Trojan exposing its sins in the cloud Siegfried Rasthofer, Eric Bodden, Carlos Castillo, Alex Hinchliffe VirusBulletin 2015, AVAR 2015

Intercepted SMS messages C&C tasks

C&C commands Leaked data

Page 30: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 31

Responsible Disclosure Process – Parse (Facebook)

Full access to 100 tables Partial access to 32 tables ( ~56 Mio Data)

Contacted Facebook with a few samples

Facebook verified it and asked for more data

We provided all information

28th April 2015

5th Mai 2015

18th Mai 2015

12th Nov 2015 Full access to 99 tables Partial access to 33 tables

20th Mai 2015 Facebook forwarded everything to Parse (we assume they contacted the developers)

Page 31: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 32

Findings Amazon (3)

Server Backups Baby Growth Data Photos

Page 32: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 33

Findings Amazon (4)

Private Messages Lottery Data Web Page Content

Page 33: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 34

COUNTERMEASURES How can we get it right?

Page 34: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 35

IT Security 101: ACLs

Peter

Howard

Peter‘s stuff

Howard’s stuff

X X

Page 35: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 36

Recall: App Authentication Model

Server

Peter

Howard

Page 36: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 37

Two BaaS Usage Scenarios

Authenticated User

Anonymous Users

Page 37: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 38

Two BaaS Usage Scenarios

Authenticated User

Anonymous Users

ACL

ACL

Page 38: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 39

ACLs in The App Security Model

Peter

Howard

Peter‘s stuff

Howard’s stuff

Anonymous Users Public stuff

X X

Page 39: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 40

Amazon Key Hierarchy (1)

Page 40: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 41

Amazon Key Hierarchy (2)

Root Account (AWS Account)

App1 Account App2 Account

Peter‘s Account Howard‘s Account

Page 41: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 42

Amazon Token Vending Machine (1)

Sample available, final implementation is on you

Needs hosting. Tomcat, Elasticbeanstalk anyone?

Page 42: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 43

Amazon Token Vending Machine (2)

Although you will need to use your AWS account credentials to deploy the TVM, we recommend that you do not run the TVM under your AWS account. Instead, create an IAM user and configure the TVM to use the credentials of this IAM user, which we will call the TVM user.

So, we have S3, TVM, IAM, Elastic Beanstalk

Page 43: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 44

Amazon Token Vending Machine (3)

You would need to modify the provided samples in order to implement these user-specific policy objects. For more information about policy objects, see the Identity and Access Management (IAM) documentation

•  What if I want ACLs?

•  Identity TVM samples do exist, but…

Page 44: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 45

Amazon Cognito (1)

•  Provides Identity Management •  Real users

•  Anonymous identities

•  Rather New Service

•  Not commonly used yet

Page 45: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 46

Amazon Cognito (2)

Note: If you created your identity pool before February 2015, you will need to reassociate your roles with your identity pool in order to use this constructor without the roles as parameters. To do so, open the Amazon Cognito Console, select your identity pool, click Edit Identity Pool, specify your authenticated and unauthenticated roles, and save the changes.

Page 46: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 47

Amazon Cognito (5)

AWS Credentials

Page 47: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 48

Amazon Cognito (6)

(1) User credentials or nothing

Amazon Cognito

(2) Temporary AWS credentials

S3 (3) Temporary AWS credentials

Page 48: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 49

Parse.com ACLs (1)

Source: http://blog.parse.com/learn/engineering/parse-security-ii-class-hysteria/

Page 49: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 50

Parse.com ACLs (2)

http://blog.parse.com/announcements/protect-user-data-with-new-parse-features/

Cloud ? 0x1238409

Page 50: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 51

Parse.com ACLs (3)

Anonymous users are special, however, in that once logged out, the user cannot be recovered – a new user will need to be created, and the original user (and its associated data) will be orphaned.

Double-check your cloud

storage space!

Page 51: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 52

Parse.com Global Settings

Source: http://blog.parse.com/learn/engineering/parse-security-ii-class-hysteria/

Get this wrong and offer

free disk space to anyone!

Page 52: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 53

THE WISHLIST What now?

Page 53: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 54

What shall change?

Legal Framework Improved Documentation Checks and Alerts

Page 54: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 55

Takeaway Messages

•  Security in the cloud doesn‘t come for free

•  Attacks are free, effortless, and simple

•  Mitigation techniques exist

!  People must care about them

!  Secure your apps now – we’re there!

Page 55: (In-)Security of Backend-as-a-Service · 13.11.15 | BlackHat Europe 2015 | 8 Agenda • Introducing BaaS • Security Analysis • Findings • Countermeasures • The Wishlist

13.11.15 | BlackHat Europe 2015 | 56

Siegfried Rasthofer Secure Software Engineering Group Email: [email protected] Twitter: @CodeInspect

Steven Arzt Secure Software Engineering Group Email: [email protected]

Blog: http://sse-blog.ec-spride.de Website: http://sse.ec-spride.de


.BAAS!,»», - Hofstra University

.BAAS!,»», - Hofstra University

Wishlist Febrero Sopotamito

Wishlist Febrero Sopotamito

Wishlist Wedding Ale & Andres

Wishlist Wedding Ale & Andres

Spring09 Wishlist

Spring09 Wishlist

Wishlist december

Wishlist december

the wishlist

the wishlist

Baas to-saab

Baas to-saab

Wishlist for Cloud: Desirable Attributes

Wishlist for Cloud: Desirable Attributes

Baas, Désir pur

Baas, Désir pur

Wishlist - KARE Design

Wishlist - KARE Design

13.11.15 exegesis trinity 25

13.11.15 exegesis trinity 25

Last BaaS Standing ApacheCon 2016schd.ws/.../60/Last_BaaS_Standing_upload.pdf · Last BaaS Standing Dave Johnson - Apigee. Brief History of BaaS. Wait… WTF is a BaaS? ... • 2010

Last BaaS Standing ApacheCon 2016schd.ws/.../60/Last_BaaS_Standing_upload.pdf · Last BaaS Standing Dave Johnson - Apigee. Brief History of BaaS. Wait… WTF is a BaaS? ... • 2010

Interactive Videogames: accessibility wishlist.

Interactive Videogames: accessibility wishlist.

Mentoring Wishlist Registration Report

Mentoring Wishlist Registration Report

Wishlist de Febrero Sopotamito

Wishlist de Febrero Sopotamito

BaaS Comparison - iOS.mn

BaaS Comparison - iOS.mn

Stephen Dibb Jewellery Wishlist #6

Stephen Dibb Jewellery Wishlist #6

Christmas Wishlist 2011

Christmas Wishlist 2011

"Package Wishlist" By Gu Peizhen

"Package Wishlist" By Gu Peizhen

Enterprise Mobile BaaS

Enterprise Mobile BaaS