I “found” the database of a college app (2018)

#1

Post by yoginth » Sun, Jun 09, 2019, 4:31 AM UTC

I “found” the database of a college app (2018)
yoginth.com

Re: I “found” the database of a college app (2018)

#2

Post by hyperthreading » Sun, Jun 09, 2019, 5:59 AM UTC

Is there any way to hide keys from the extractions? I tried it before and ended up to find that users can do that if they really want to.

Re: I “found” the database of a college app (2018)

#3

Post by ggggtez » Sun, Jun 09, 2019, 6:02 AM UTC

Visible key isn't the bug. The bug is that the app should not have read access to other students.

Re: I “found” the database of a college app (2018)

#4

Post by petjuh » Sun, Jun 09, 2019, 6:04 AM UTC

hyperthreading wrote: post #2

Is there any way to hide keys from the extractions? I tried it before and ended up to find that users can do that if they really want to.

No, but I think the idea is to create a web API that connects to the database instead of having the phone connect directly to it.

Re: I “found” the database of a college app (2018)

#5

Post by bootloop » Sun, Jun 09, 2019, 6:06 AM UTC

hyperthreading wrote: post #2

Is there any way to hide keys from the extractions? I tried it before and ended up to find that users can do that if they really want to.

No, you can only obfuscate it but the correct way to do this is to limit the access scope of the access key.

Re: I “found” the database of a college app (2018)

#6

Post by joshgachnang » Sun, Jun 09, 2019, 6:06 AM UTC

As far as I know, none of these keys (except the email/password) are considered a secret. The real problem here is that they aren't using Firebase/Firestore rules to correctly limit database access.

Re: I “found” the database of a college app (2018)

#7

Post by yoginth » Sun, Jun 09, 2019, 6:07 AM UTC

hyperthreading wrote: post #2

Is there any way to hide keys from the extractions? I tried it before and ended up to find that users can do that if they really want to.

I think we can't hide keys up to my knowledge!

But make sure you just switched firebase to production mode.

In my case, the firebase was in development mode and the data is available public!

https://yoginth.com/college-hack#mitigations

Re: I “found” the database of a college app (2018)

#8

Post by whymauri » Sun, Jun 09, 2019, 6:08 AM UTC

hyperthreading wrote: post #2

Is there any way to hide keys from the extractions? I tried it before and ended up to find that users can do that if they really want to.

I'm not a mobile dev, but aren't there utilities like KeyStore for this?

https://developer.android.com/training/articles/keystore.htm...

Re: I “found” the database of a college app (2018)

#9

Post by bootloop » Sun, Jun 09, 2019, 6:10 AM UTC

whymauri wrote: post #8

hyperthreading wrote: post #2

Is there any way to hide keys from the extractions? I tried it before and ended up to find that users can do that if they really want to.

I'm not a mobile dev, but aren't there utilities like KeyStore for this? https://developer.android.com/training/articles/keystore.htm...

Well, the trick is that using a KeyStore ensures that the key doesn't leak into the application (but is only used for cryptographic operations in a trusted environment).

However, you would need the plain key to authenticate against the database so using this wouldn't work.

Re: I “found” the database of a college app (2018)

#10

Post by whymauri » Sun, Jun 09, 2019, 6:13 AM UTC

bootloop wrote: post #9

whymauri wrote: post #8

Earlier quoted context omitted.

I'm not a mobile dev, but aren't there utilities like KeyStore for this? https://developer.android.com/training/articles/keystore.htm...

Well, the trick is that using a KeyStore ensures that the key doesn't leak into the application (but is only used for cryptographic operations in a trusted environment). However, you would need the plain key to authenticate against the database so using this wouldn't work.

Gotcha, I see the problem now.