Thousands of Mobile Apps Leak Data from Firebase Databases

Thousands of mobile applications running on iOS and Android have exposed over 113 gigabytes of data from 2,300 unsecured Firebase databases, enterprise mobile security firm Appthority says in a new report.

The new research follows last year’s report into the HospitalGown attack vector, which revealed that more than 1,000 mobile apps on enterprise devices were exposing potentially sensitive data via insecure connections with backend servers.

Similar to the HospitalGown vulnerability, which was found in mobile applications’ architecture and infrastructure, the new security flaw resides in mobile app developers failing to require authentication to a Google Firebase cloud database.

One of the most popular backend database technologies for mobile apps, Firebase does not secure user data by default. It does not warn developers when data is not secure and does not provide third-party encryption tools either.

To ensure data is secure, app builders need to specifically implement user authentication on all database tables and rows, but that rarely happens, Appthority explains in a report (PDF). Because of that, an attacker can easily find open Firebase app databases and access private records.

The security issue, which the security firm refers to as the Firebase vulnerability, has a huge impact, leaking 100 million records (113 gigabytes) of data from unsecured Firebase databases.

After digging through millions of applications, the security researchers discovered 28,502 mobile apps (27,227 Android and 1,275 iOS apps) connected to a Firebase database, 3,046 of which (10.69%) were found vulnerable (2,446 Android and 600 iOS apps).

The 3,000 vulnerable applications, the security firm notes, exposed over 100 million records of data from 2,300 vulnerable databases (1 in 10 Firebase databases, or 10.34%, were found vulnerable). On Android alone, the vulnerable applications had more than 620 million downloads.

Impacted applications belong to multiple categories, including tools, productivity, health and fitness, communication, finance and business apps, and impact over 62% of enterprises.

Affected organizations included banks, telecoms, postal services, ride sharing companies, hotels and educational institutions in the United States, Europe, Argentina, Brazil, Singapore, Taiwan, New Zealand, India, and China.

Analysis of the exposed data revealed 2.6 million plain text passwords and user IDs; more than 4 million Protected Health Information records (including chat messages and prescription details); 25 million GPS location records; 50 thousand financial records including banking, payment and Bitcoin transactions; and over 4.5 million Facebook, LinkedIn, Firebase and corporate data store user tokens.

The report reveals that 975 (40%) of the vulnerable apps were business-related, installed in active customer environments, leaking corporate private keys and access credentials (potentially allowing attackers to exfiltrate sensitive intellectual property), private business conversations, and sales information.

The number of applications connecting to Firebase databases has increased significantly since 2015, and so did the number of vulnerable applications. Between 2015 and 2016, apps using Firebase grew 2,112%, while the vulnerable apps grew 1,225%. Between 2016 and 2017, the growth rates were of 271% and 74%, respectively.

“The Firebase vulnerability is a significant and critical mobile vulnerability exposing vast amounts of sensitive data. The large number of vulnerable apps and the wide variety of data shows that enterprises can’t rely on mobile app developers, app store vetting or simple malware scans to address data security,” Seth Hardy, Appthority Director of Security Research, commented.

Related: Enterprise Mobile Apps Expose Sensitive Data via Backend Systems

Related: What’s Up with Your Mobile Apps? Identifying and Mitigating Digital Risk