3,000+ mobile apps leaking data from unsecured Firebase databases

guest · Jun 20, 2018

3,000+ mobile apps leaking data from unsecured Firebase databases
Appthority published research on its discovery of a new HospitalGown threat variant that occurs when app developers fail to require authentication to Google Firebase databases.
June 20, 2018
https://www.helpnetsecurity.com/2018/06/20/unsecured-firebase-databases/

Appthority security researchers discovered the HospitalGown vulnerability in 2017 which leads to data exposures, not due to any code in the app, but to the app developers’ failure to properly secure backend data stores (hence the name). The new Firebase variant exposes large amounts of mobile app-related data stored in unsecured Firebase databases.

“The Firebase vulnerability is a significant and critical mobile vulnerability exposing vast amounts of sensitive data,” said Seth Hardy, Appthority Director of Security Research. “The large number of vulnerable apps and the wide variety of data shows that enterprises can’t rely on mobile app developers, app store vetting or simple malware scans to address data security.

More than 100 million records are exposed: [...]
Click to expand...

guest · May 11, 2020

Firebase developers urged to check their configurations to prevent data leaks
May 11, 2020
https://www.itworldcanada.com/artic...r-configurations-to-prevent-data-leaks/430572

Android developers using Google’s Firebase application development platform are being warned to check their configurations after security researchers discovered thousands of apps are leaking sensitive data.

News website Comparitech says a team analyzed 155,066 apps on the Google Play store, of which 11,730 had publicly exposed databases. Of those 4, 282 apps were leaking sensitive information including email addresses, user names, passwords, full names credit card data and photos of government-issued IDs.
In addition, of the 11,730 with publicly-exposed databases, 9,014 of them included write permissions, which would allow an attacker to add, modify, or remove data on the server, in addition to viewing and downloading it.

The story says Firebase is used by an estimated 30 per cent of all apps on the Google Play Store. [...] That would work out to roughly 24,000 apps.
Click to expand...

Google scrubs these vulnerable database URLs from its search results. However, the article adds, they are still indexed by other search engines like Bing.
Click to expand...

Comparitech: Report: Estimated 24,000 Android apps expose user data through Firebase blunders

Common misconfigurations on Google Firebase databases allow unauthorized parties to easily find and access users' personal data in thousands of apps
What data is exposed?
The vulnerable applications identified by our team have been installed 4.22 billion times by Android users. Given the average smartphone user has between 60 and 90 apps installed, the chances are high that an Android user’s privacy has been compromised by at least one app.
Click to expand...

Our recommendations
For users:

Don’t reuse the same password across multiple accounts. Use a password manager to generate and store strong random passwords

Use only trusted applications with a high number of reviews and installs

Be aware of what information you share with an application

Do not share sensitive personal information such as home address, photos of government ID, Social Security numbers, etc

Click to expand...

guest · Sep 30, 2021

14 top Android apps with 142.5 million installs are misconfigured, leaving their data exposed to unauthorized parties
September 30, 2021
https://securityaffairs.co/wordpress/122777/mobile-2/android-apps-data-leak.html

14 top Android apps with 142.5 million installs are misconfigured, leaving their data exposed to unauthorized parties.

Nine out of 14 popular Android apps are still potentially leaking the data of more than 30.5 million users.

Firebase is a cross-platform tool, which suggests that Firebase misconfigurations affect their iOS versions as well.

Click to expand...

If you have an Android app installed on your smartphone, there’s a high chance it is using Firebase.
In 2014, the platform was acquired by Google and had since become one of the most popular real-time data storage solutions on the market for Android apps.

What our Investigations team discovered was eye-opening: 14 top Android apps with 142.5 million installs were suffering from Firebase misconfigurations, which enabled us – and anyone else who knows the right URL – to access their real-time databases and all the user information stored without any kind of authentication.
Although we only looked at top Android apps on the Google Play store, Firebase is platform-agnostic. This means that iOS apps that use Firebase might be affected by these misconfigurations as well.
Click to expand...

Log in or Sign up

3,000+ mobile apps leaking data from unsecured Firebase databases

guest Guest

guest Guest

guest Guest

Log in or Sign up

3,000+ mobile apps leaking data from unsecured Firebase databases

guest Guest

guest Guest

guest Guest

Useful Searches