Slide 13 of 28
Part 2 · How It WorksSlide 13
Slide 13 · Real Incident
Firebase open rules — 100 million records exposed by default configuration.
September 2018. 2,446 apps. Open read/write by anyone. The default was insecure.
📄 Appthority Mobile Threat Intelligence Report · September 2018
THE VULNERABILITY
Firebase Realtime Database — Default Open Rules

Firebase is Google’s backend-as-a-service platform. Firebase Realtime Database stores data and exposes it through a REST API. Access to the database is controlled by security rules — a JSON configuration that specifies who can read and write which data.

At the time, Firebase’s default rule when creating a new database was: { “rules”: { “.read”: true, “.write”: true } } — open read/write access for anyone, with no authentication required. This was the template shown during database setup.

Developers created databases using the default rules for rapid prototyping — and never changed them before shipping.

What Appthority found: Analyzing 2,705 iOS and Android apps, they identified 2,446 apps (over 90%) using Firebase databases with open read/write access. The exposed databases contained: 2.6 million plain-text passwords and usernames, 4 million+ protected health information (PHI) records, 25 million+ GPS location records, 50,000+ financial records (bank transactions), and 4.5 million+ Facebook, LinkedIn, and Twitter tokens. Total: approximately 100 million records exposed to anyone who knew the Firebase database URL (often discoverable in the app’s binary).
The default problem

Firebase changed their default rules in 2019 to require authentication. But this incident illustrates a systemic API8 pattern: when the default is insecure and there is no enforced review step before deployment, misconfigurations proliferate at scale. The bug wasn’t in any single developer’s code — it was in the default that 2,446 developers never changed.

← Back Attack Scenarios →