Is it possible to hack and Update a firebase realtime database data

user_10081329 0
Viewed 4732

Recently i build a app using Firebase, But after i got Some users through advertisement, Someone just hacked Firebase database and Updated all user datas like . Username Profile pic path

They set it to a bad word and bad pic.

So then i Also Checked the Firebase rules and redefined them..

Like

Only Authenticated users can read/write.

But problem is.

The hacker is still updated the Value on firebase db.

and i want to know what i am missing.

Is it possible to update a Firebase db without the whole secure key and things.. using a browser may be?

User data of a single user ...

email : "https://m.me.developer.scg" lastseen : "1617987743" pic : "https://www.dropbox.com/s/03a50cx4adxqepk/(url cannot be posted publically it contains nude images)" privacy : "PU" state : "offline" status : "Lets watch some movies" type : "FREE USER" username : "FU*KED BY DreamPLAY"

Here the hacker updated the 3 fields. email : pic: username:

firebase-realtime-database firebase
4 Answers

You have to know that as soon as (1) someone has the apiKey of your Firebase Project and (2) the email/password sign-in method is enabled, this person can use the Firebase Auth REST API and sign-up to your project (i.e. create a new account).

Getting the apiKey is not very difficult if you deploy an app linked to your Firebase project (Android, iOS, Web...).

Consequently, rules only based on auth != null allow anyone that has signed-up through the REST API accessing your Realtime Database. No need to use any GUI: after having been identified through the Auth REST API, the user can use the RTDB REST API.

One classical approach to avoid "non-desired" users to access data, is to add one or more Custom Claims to the desired accounts and use these claims in the Security Rules: See the doc for more details.

user_33718620

I will answer as parts :

  1. Reason of Problem : The Hacker found your API then created project and added your API to it then he created authenticated user then he updated the fields , So this the reason of problem

  2. Solution :

    First : is to create unique Fields (e.g Email to 1234567890Email as Example but more secure)

    Second : is to connect to Google Cloud Platform then setup Google Cloud Platform HTTP with your Domain (As Firebase will only accept data from your Domain ONLY)

    Third : Is to create more secure rules as to denied access to Entire Database but just give access to some collections or even documents So it will be more secure

    I just covered the most famous actions (You can see more but by google your problem) & Wish I helped you :)

user_149456960

I just thought of a way to secure Firebase credentials so thought of a way to use a custom cloud functions authentication function (URL based function) to accept user credentials like username and password via URL encoded parameters. This method will only use database(firestore would be preferable). The function will only have to create custom tokens and send it to the user while keeping the user's temporary data like IP addresses etc. So request to write or read to the database will only be granted to this function.

user_165575150

You CAN prevent all those non authencated activities right from your firebase console.

  • GO to your firebase console, Open your project's android app.
  • Add SHA fingerprints of your app's SHA signing certificate fingerprints.
user_67649310
Related