Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Application Security

Thousands of Mobile Apps Leak Data from Firebase Databases

Thousands of mobile applications running on iOS and Android have exposed over 113 gigabytes of data from 2,300 unsecured Firebase databases, enterprise mobile security firm Appthority says in a new report.

Thousands of mobile applications running on iOS and Android have exposed over 113 gigabytes of data from 2,300 unsecured Firebase databases, enterprise mobile security firm Appthority says in a new report.

The new research follows last year’s report into the HospitalGown attack vector, which revealed that more than 1,000 mobile apps on enterprise devices were exposing potentially sensitive data via insecure connections with backend servers.

Similar to the HospitalGown vulnerability, which was found in mobile applications’ architecture and infrastructure, the new security flaw resides in mobile app developers failing to require authentication to a Google Firebase cloud database.

One of the most popular backend database technologies for mobile apps, Firebase does not secure user data by default. It does not warn developers when data is not secure and does not provide third-party encryption tools either.

To ensure data is secure, app builders need to specifically implement user authentication on all database tables and rows, but that rarely happens, Appthority explains in a report (PDF). Because of that, an attacker can easily find open Firebase app databases and access private records.

The security issue, which the security firm refers to as the Firebase vulnerability, has a huge impact, leaking 100 million records (113 gigabytes) of data from unsecured Firebase databases.

After digging through millions of applications, the security researchers discovered 28,502 mobile apps (27,227 Android and 1,275 iOS apps) connected to a Firebase database, 3,046 of which (10.69%) were found vulnerable (2,446 Android and 600 iOS apps).

The 3,000 vulnerable applications, the security firm notes, exposed over 100 million records of data from 2,300 vulnerable databases (1 in 10 Firebase databases, or 10.34%, were found vulnerable). On Android alone, the vulnerable applications had more than 620 million downloads.

Impacted applications belong to multiple categories, including tools, productivity, health and fitness, communication, finance and business apps, and impact over 62% of enterprises.

Affected organizations included banks, telecoms, postal services, ride sharing companies, hotels and educational institutions in the United States, Europe, Argentina, Brazil, Singapore, Taiwan, New Zealand, India, and China.

Analysis of the exposed data revealed 2.6 million plain text passwords and user IDs; more than 4 million Protected Health Information records (including chat messages and prescription details); 25 million GPS location records; 50 thousand financial records including banking, payment and Bitcoin transactions; and over 4.5 million Facebook, LinkedIn, Firebase and corporate data store user tokens.

The report reveals that 975 (40%) of the vulnerable apps were business-related, installed in active customer environments, leaking corporate private keys and access credentials (potentially allowing attackers to exfiltrate sensitive intellectual property), private business conversations, and sales information.

The number of applications connecting to Firebase databases has increased significantly since 2015, and so did the number of vulnerable applications. Between 2015 and 2016, apps using Firebase grew 2,112%, while the vulnerable apps grew 1,225%. Between 2016 and 2017, the growth rates were of 271% and 74%, respectively.

“The Firebase vulnerability is a significant and critical mobile vulnerability exposing vast amounts of sensitive data. The large number of vulnerable apps and the wide variety of data shows that enterprises can’t rely on mobile app developers, app store vetting or simple malware scans to address data security,” Seth Hardy, Appthority Director of Security Research, commented.

Related: Enterprise Mobile Apps Expose Sensitive Data via Backend Systems

Related: What’s Up with Your Mobile Apps? Identifying and Mitigating Digital Risk

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Mobile & Wireless

Apple’s iOS 12.5.7 update patches CVE-2022-42856, an actively exploited vulnerability, in old iPhones and iPads.

Mobile & Wireless

Two vulnerabilities in Samsung’s Galaxy Store that could be exploited to install applications or execute JavaScript code by launching a web page.

Application Security

Drupal released updates that resolve four vulnerabilities in Drupal core and three plugins.

Application Security

A CSRF vulnerability in the source control management (SCM) service Kudu could be exploited to achieve remote code execution in multiple Azure services.

Application Security

PayPal is alerting roughly 35,000 individuals that their accounts have been targeted in a credential stuffing campaign.