Multiple Apps on Google’s Firebase Platform Exposing Sensitive Data

A security analysis has uncovered a significant vulnerability in over 150 popular mobile applications using Google's Firebase platform, exposing sensitive user data due to misconfigurations. This issue affects approximately 80% of mobile apps, potentially impacting millions of users worldwide. The analysis of 1,200 apps revealed that many allowed unauthenticated access to critical data stores, including Realtime Databases and Storage Buckets.

The exposed data includes payment details, personal information, and access tokens for services like AWS and GitHub. The primary cause of this vulnerability is the use of Firebase's 'test mode,' which can leave data publicly accessible. Researchers have developed OpenFirebase, a tool to automate the scanning of Firebase configurations for unauthorized access. Organizations using Firebase are urged to audit their security settings to prevent data exposure.