Firebase Storage Security Error - Incorrectly flagged as phishing

user_16168897 0
Viewed 445

I'm working on this React, Redux, Google Auth, Firebase / Firestore app. I'm fairly new to React, so I basically just modified code I made from doing a clone of a social site tutorial from YouTube.

Everything worked fine on my tutorial project and I never got any of these warnings even after deploying or testing online.

I started modifying the code for my new use case which is basically a simple CRUD tool for my business. Just some input fields, with the ability to upload up to 2 files to firebase storage and then display those uploaded documents in iframes alongside the other values from inputs. I got a basic implementation working and I wanted to show my partner. After I deployed the site to firebase, I logged into the app on our custom domain and everything was fine. I created a couple dummy documents with the app and in the middle of creation of the second document / upload, the screen goes red with a:

!DANGEROUS Deceptive Site Ahead WARNING! - Attackers on firebasestorage.googleapis.com may trick you into doing something dangerous like installing software or revealing your personal information.

I was really surprised by this. I clicked ignore, and everything was working properly. The strange thing is, this same "Dangerous!" Security Warning started occurring simultaneously on my localhost server that was the same as the deployed version but had never generated these warnings previously.

I've tried finding relevant info on what could be causing this but have not been successful.

I didn't know what else to do, so I started "reporting a detection problem" with requests for any kind of guidance in troubleshooting this issue. I also reached out to firebase support who once they finally got back to me, basically said this issue was "out of scope" as it was an issue with Chrome - although this warning is occurring on other browsers.

I didn't know what I was going to do. I couldn't figure out what direction to go in to resolve this issue, and then without me modifying anything the warnings just went away. And they stopped showing up for 3 days. I thought, it must have just been some type of automatic security feature that flags new firebase apps with certain types of functionality until they can be analyzed as non-malicious or something along those lines. Confused but relieved I continued working.

And then while creating a test document several days later, the screen went red again and the same security warning appeared and persists. This warning only appears after logging in via google auth and being redirected to an authenticated section of the app.

Does anyone know what could be causing this?

Any advice or troubleshooting tips are greatly appreciated!

firebase-storage google-cloud-firestore firebase reactjs
1 Answers

In this Google Support page, they mention the issue and it’s cause, but, more importantly, if you are the owner of the site, it redirects you to the developers site where you can check and follow several verification and security steps to verify this is not from your side and if there is really a threat on how to deal with it. I will try to mention the most important and the ones I think could be causing the issue. First, this specific message is shown when a phishing attack is detected.

Even if the support page sends you directly to request a review, we will step back and check if your site is ok.

How do I know if my site is hacked?

Follow these steps if:

  • You’ve been alerted by Google that your site is hacked
  • You see a warning in search that your site is hacked or compromised
  • You’re not sure if your site is actually hacked

If you’re unsure if your site is actually hacked, or if you think your site was incorrectly flagged, start by registering your site in Search Console. Go to the Security Issues sections of Search Console and look for example URLs where Google detected that your site has been hacked... ...If you’re unable to see hacked content on the URLs provided in Search Console, the hacked content might be using a technique known as cloaking...

Please visit the site for further details. If you continue to the next page, you will find there are some tips and techniques to avoid getting hacked, and I think one possible cause for this issue would be the Security Policy Holes.

Security policy holes

If you are a system administrator or run your own site, remember that poor security policies can allow attackers to compromise your site. Some examples include:

  • Allowing users to create weak passwords
  • Giving administrative access to users who don’t require it
  • Not enabling HTTPS on your site and allowing users to sign in using HTTP
  • Allowing file uploads from unauthenticated users, or with no type checking

A few basic tips to protect your site:

  • Ensure your website is configured with high security controls by disabling unnecessary services
  • Test access controls and user privileges
  • Use encryption for pages that handle sensitive information, like login pages
  • Regularly checking your logs for any suspicious activities.

Please try to read the full page; it has a lot of useful information that can help you with your case. I will continue to address information I think you can use. In the Potential Vulnerabilities section, you can find what I think could be a possible cause.

Potential vulnerabilities to investigate include:

  • Virus-infected administrator computer
  • Weak or reused passwords
  • Out-of-date software
  • Permissive coding practices, such as open redirects and SQL injections

These are just the headers. Each point has a lot of information to quote it, but since you are uploading files from your system, one of these could also be the root cause. Each point explains in detail how to solve and identify the possible problem. In the next page, ”Clean and maintain your site” you can clear any possible thread coming from your side, and, finally, if none of this work and the message is still showing, you would need to Request a review.

user_169380110
Related