The mayhem caused by Shiney Hunters groups to multiple organizations was still afresh when a researcher reported roughly 24,000 Android apps leaking user data.
What exactly happened?
Security researchers at Comparitech discovered misconfigured Google Firebase databases allowing attackers to find and steal data form storage. Firebase is a mobile and web application development platform with SDKs for multiple platforms, including Android, iOS, web, C++, and Unity (for games).
Key insights from the report
The team revealed that an estimated 30% of all apps on the Google Play Store use Firebase.
The security team reviewed about 18% of apps in the Play store and found 4,282 apps leaking sensitive information.
4.8 percent of mobile apps that use Firebase to store user data are not properly secured.
These databases containing users’ information, access tokens, and other data without any password protection.
Going by the Google Play category, game apps topped the list in exposing databases, followed by education apps, entertainment, business, and travel, in that order.
Access to database
As surprising as it can get, no complex hacking skills were required to pilfer data.
To find Firebase URLs, experts sought each app's resources for text strings ending ".firebaseio[.]com."
They added '.json' to the end of the Firebase URL to expose the contents of vulnerable databases. Anyone could have done that, told experts.
Exposed data included email addresses, phone numbers, usernames, passwords, addresses, chat messages, GPS data (in case the address is not enough), and more.
There were also a few exposures of passport data, credit cards, and "photos of government-issued identification."
Insecurities with Firebase
Everything aside, it not the first time that the security of Fir ..
Support the originator by clicking the read the rest link below.
