Security professionals from the firm Check Point Research (CPR) have leveraged Virus Total queries to identify improperly configured Firebase cloud-based mobile application databases that leave thousands of applications vulnerable, and susceptible to threat actor exploitation. Some of these applications are so popular that they’ve been downloaded tens of millions of times, and include “dating, fitness, bookkeeping, logo design, e-commerce and more.” These vulnerabilities are being exploited by attackers, allowing them to alter configurations, and read/write to the databases. This opens up an incredibly broad range of potential attacks, from injecting malicious values to corrupt or wipe the databases, to deploying malware, and exposing sensitive information like, “chat messages in popular gaming apps, personal family photos, token IDs on … healthcare applications, data from cryptocurrency exchange platforms, and more.” There are many reasons why databases may be configured and hardened improperly. Often times, just like with average users unknowingly compromising themselves, there’s a component of complacency, such as not altering default configurations, or forgetting to re-harden their infrastructure after purposely exposing it for testing purposes. Virus Total is a valuable tool in this scenario due to many applications being uploaded to the platform, whether it be automatically due to a policy, or manually by developers using Virus Total for its sandbox features and identifying if their products have been flagged by the platform as malicious. Over the course of three months, CPR found 2,113 mobile applications utilizing Firebase that were uploaded to Virus Total. In their blog post located below, CPR has made some cloud-based hardening recommendations for database administrators and application developers, and Ankura CTIX analysts urge our readers to make security a constant priority to stop easily preventable breaches like this from happening.