![\"Firebase\"](\"https:\/\/www.gstatic.com\/devrel-devsite\/prod\/v96fe7c72c7b00a90a6621d124258058ede00fa09bdb0b7e43bfa676d03923593\/firebase\/images\/lockup.svg\")
Google Firebase is a cloud-hosted database mainly used for developing mobile and web apps. It utilizes Firebase Realtime Database which is an API that allows developers to push updates to application data across multiple platforms at the same time (3). Problems can arise when these databases are left misconfigured by developers. <\/p>\n\n\n\n
\n\n\n\n
![\"\"](\"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/wp-content\/uploads\/sites\/115\/2022\/03\/image-10.png\")
VirusTotal is a tool where developers can upload URLs, IP addresses, domains, and files to check for data breaches and test how malicious something is. Submissions are shared to VirusTotal’s security community, which is comprised of people that work in the fields of antivirus, security, and malware. These people give their critiques and can vote on whether submitted files and URLs are malicious or not (5).<\/p>\n\n\n\n
The Breach<\/h2>\n\n\n\n
Over the span of three months, Check Point Research utilized VirusTotal by searching for Firebase URLs. First, they skimmed VirusTotal for any URLs in Android application PacKages (APKs) that contained “.firebaseio.com”. Then they added “\/.json” to the end of the URLs that they found in order to see if they were able to read them. Among the databases that they were able to read, they filtered for keywords, such as “password”, and were able to find many databases with sensitive user information (5). These databases ranged from applications for dating to healthcare applications.<\/p>\n\n\n\n Rest assured, the good people over at Check Point Research notified the companies after their discovery!<\/p>\n\n\n\n Make sure to lock up!<\/p>\n\n\n\n As hard of a mistake it seems to be, the 2000 compromised databases found by Check Point Research were either left in test mode, which allows for all reads and writes to your database, or had exposed credentials (2). By leaving your database in test mode, the not so good people (AKA attackers) can not just read sensitive information, but also write to your database. By writing in malicious code, the safety of your database and the users of your application can be compromised.<\/p>\n\n\n\n There is no denying the benefits and ease of use that comes with cloud computing. Many start-up companies can enter the market through the use of this technology. However, as we all know, no matter how great the security, the greatest point of weakness is often the user. With how fast technology evolves, it is easy to miss key steps in security one may not have had to be aware of before. Having cloud misconfigurations leaves the door open for attackers so it is critical that more awareness is brought to this issue and that the proper standards of practice are in place to guard against such issues from happening.<\/p>\n\n\n\n With the adoption of cloud computing, developers are now able to cut costs when it comes to servers. Cloud computing can be more beneficial than on premise servers since companies only pay for what they need while a third party deals with the maintenance of the server (1). However, following a study done by Check … <\/p>\n![\"\"](\"https:\/\/blog.checkpoint.com\/wp-content\/uploads\/2022\/03\/cprcloud7.png\")
What Can be Done?<\/h2>\n\n\n\n
Sources:<\/h4>\n\n\n\n