Tea continued – Unauthenticated access to 150+ Firebase databases, storage buckets and secrets

These aren’t just random mobile apps with a few hundred or thousand downloads. Most of them had over 100K+, 1M+, 5M+, 10M+, 50M+, or even 100M+ downloads (Tea app only has 500K+ downloads). I’m also releasing OpenFirebase, an automated Firebase security scanner that checks for unauthorized read and/or write access on Firestore, Realtime Database, Storage Buckets, and Remote Config. It performs checks from both unauthenticated and/or authenticated perspectives, and it can bypass weak Google API key restrictions. submitted by /u/Woowowow91 [link] [comments]Technical Information Security Content & DiscussionRead More