I “found” the database of a college app (2018)

by yoginth • 7 years ago

109 99 7 years ago

Is there any way to hide keys from the extractions? I tried it before and ended up to find that users can do that if they really want to.

petjuh• 7 years ago

No, but I think the idea is to create a web API that connects to the database instead of having the phone connect directly to it.

bootloop2• 7 years ago

No, you can only obfuscate it but the correct way to do this is to limit the access scope of the access key.

yoginth6• 7 years ago

I think we can't hide keys up to my knowledge!

But make sure you just switched firebase to production mode.

In my case, the firebase was in development mode and the data is available public!

https://yoginth.com/college-hack#mitigations

evolveyourmind• 7 years ago

It’s not about keys or modes, it’s about the rules they didn’t set up. Everyone uses firebase like that. Those “keys” are required to allow you to connect to the correct firebase app, nothing more. You don’t get any direct special permission to do things on the database or storage. Here some more info about the rules: https://firebase.google.com/docs/database/security

whymauri2• 7 years ago

I'm not a mobile dev, but aren't there utilities like KeyStore for this?

https://developer.android.com/training/articles/keystore.htm...

bootloop2• 7 years ago

Well, the trick is that using a KeyStore ensures that the key doesn't leak into the application (but is only used for cryptographic operations in a trusted environment).

However, you would need the plain key to authenticate against the database so using this wouldn't work.

diericx• 7 years ago

Firebase keys give you access to the database, which can be public. You just have to setup rules for the database, usually so users have to be authenticated to view anything and can only read their own private info.

edit: just realized you may have just been asking about hiding keys in general. Sorry if this wasn't what you were asking about!

hyperthreading2• 7 years ago

Don’t put your API keys, Tokens and Secrets visible easily

I was just confused at this part because permission & rules are the solution as far as I know. Thanks for the reply though :) I'm prettry sure now that exposing keys are no problem.

noja2• 7 years ago

Read-only access through intermediate proxy that you control (but not to all data like here) + login required for more access (via intermediate proxy or direct).

q3k• 7 years ago

No, you can just obfuscate it and make it painful to extract to potential reverse engineers.

ggggtez• 7 years ago

Visible key isn't the bug. The bug is that the app should not have read access to other students.

anarchodev• 7 years ago

Yep. Although this exact thing has happened to so many apps I’m beginning to doubt the wisdom of this “allow completely open dev settings at first and then YOU get to remember to fix it” model that fire base uses.

Maybe they could require an IP whitelist if the permissions aren’t set yet or something.

rrix2• 7 years ago

This is the cause of many mongodb and redis woes as well.

gchamonlive• 7 years ago

permissions are a pain... i am considering centralizing permission handling in a separate service environment so that every service I have shares the same permission logic.

It is a shame since we could save some latency time by having permissions implemented in the same language and app that it is being requested. But to avoid stuff like that in the article I believe the cons are worth it

edit: the user had direct access to the database. No amount of code would mitigate that. Moral of the story is NEVER leave your database open to public, always hide it behind a service wall

NKCSS• 7 years ago

Security and usability are always at the opposite end of the spectrum. Balance it wisely.

joshgachnang• 7 years ago

As far as I know, none of these keys (except the email/password) are considered a secret. The real problem here is that they aren't using Firebase/Firestore rules to correctly limit database access.

noja2• 7 years ago

ITT everybody doing the same!

mappu• 7 years ago

Is Gitote a fork of Gogs/Gitea?

yoginth6• 7 years ago

It's a fork of Gogs!

kazinator• 7 years ago

A school that tracks attendance cannot be called a college or university. Kindergarten, I can swallow.

stedaniels2• 7 years ago

I'm not sure if you are in the industry, but attendance tracking is high up on most institutions lists of metrics to track. Aside from helping out the usual back office data, it's often a key indicator for students who are in trouble. The institution can then reach out and assist these students.

rocqua• 7 years ago

I think OPs point was about using attendance as part of assessment.

tastroder3• 7 years ago

They might just not be from the US. Here in Germany, tracking or forcing student attendance is subject of large discussions and generally often frowned upon (or forbidden by regulation) in the University setting these days.

TazeTSchnitzel2• 7 years ago

In the UK, I think universities have to track attendance if only to make the immigration authorities happy.

bgdam• 7 years ago

Here in India, the University I attended requires a minimum attendance of 75%, or they won't allow you to sit the end of semester exams. Your attendance even accounts for 5% of the score of your end of semester exams for that course. Quite insane when you think about it.

aitchnyu3• 7 years ago

And having a full day class on Saturday when a weekday was lost due to bad weather or strikes.

saagarjha3• 7 years ago

I attend a public school in the United States, and attendance is de-facto enforced by questions that you answer during class (using iClickers, or by quizzes you turn in at the end).

Scoundreller• 7 years ago

You never had a friend bring your iClicker in for you????

unixhero• 7 years ago

Although I agree. The attendance requirements meant that we went to tutorial "class sessions".

zapzupnz• 7 years ago

My university didn't officially track attendance, but lecturers did track it nonetheless. Poor attendance was used as a metric when deciding whether somebody deserves a late submission, resubmission, or aegrotat.

red_admiral2• 7 years ago

ETH Zurich, by most metrics one of the better universities in the world, tracks attendance.

z3t4• 7 years ago

This seem to be the default on most G services.

AlphaWeaver• 7 years ago

What makes this even more sloppy for the school is that I know for a fact that Firebase will send your admin account an email when it detects that you have weak security settings on your database. It also sends said email repeatedly, once per day.

I know because I intentionally have a developer db that is read access for the whole world and I get that email every afternoon. The admin of this app either is not competent enough to know what that email means, or is willfully ignoring it.

mattlondon• 7 years ago

Or registered on a "throw-away" gmail account created for this app that no one is reading.

bartread• 7 years ago

The admin of this app either is not competent enough to know what that email means, or is willfully ignoring it.

Or it's being filtered into their junk folder.

I'm not making excuses for them, btw (there's just so much else wrong here): just pointing out that this happens quite often with even legitimate automated messages.

MRD853• 7 years ago

The media would have a field day and say that he hacked his school database. It's crazy how so many institutions are doing the digital equivalent of leaving an unlocked car in a bad neighbourhood and no one holds them accountable. Most people understand the concept of an unlocked car, not many understand that he didn't do anything special to hack his school db. He just strolled right in.

julvo• 7 years ago

Exactly, it's like leaving your customers' cars unlocked in a bad neighborhood

scoot• 7 years ago

Like keeping your unlocked filing cabinet on the front porch...

fyfy18• 7 years ago

I did this when I was at high school with a friend. Basically the place had a shared Windows file system, and the only thing that prevented everyone from viewing it was that it was hidden in the UI. On the drive was lots of data, including some applications in PDF format - completely unprotected - full of personal information of minors.

At the time we had recently covered data protection in IT class, so we wrote up a document explaining what we did, and why it was bad, and gave copies to a few people in prominent positions (principle, head of IT, IT teacher) as well as posting it (with instructions redacted) on an internal message board.

Well of course they didn't take it very well. They threatened to expel us and call the cops, and suspended us for a week until they decided what to do. In the end a well written warning from my friend's parent made them drop the issue and let us back in. I doubt they did anything to change the "security".

hjk052• 7 years ago

he didn't do anything special to hack...

Someone who snatched a purse out the hand of someone else isn’t “doing anything special” either. The illegality doesn’t hinge on the difficulty of the action. Why is that so hard to grasp for technical crowds?

If you find a car with the keys in the ignition and the door unlocked, you won’t get away with driving it a block down the road by telling the judge: “Oh, but it was obviously insecure, and I was just testing to see if I could steal it”.

ryanmarsh• 7 years ago

This is more like walking up to the bank at night and jiggling the door handle then telling everyone it’s unlocked and the alarm isn’t on.

MRD853• 7 years ago

The data that's available isn't the school, it's student data! The school left the students "cars unlocked" and no one holds them accountable. They just say that people shouldn't steal cars.

lone_haxx0r• 7 years ago

Why is that so hard to grasp for technical crowds?

Because laws concerning actual theft are objectively defined, and are logically consistent with themselves and other laws.

Laws about 'hacking', where the crime is simply a message, not a physical action, are extremely subjective. It revolves around intent more than the action.

For example: If a user goes to the website of theirbank.com and the root page is a list with all the credit card numbers of all the clients. Is he committing a crime? He used computers to get information that he shouldn't be allowed to see. Most people would say: no, he only wanted to visit the website.

If I see that the bank's API has no security, am I committing a crime?

If I use SQL injection to see all the users data, am I committing a crime?

Most people would say that it depends on intent, but intent is extremely subjective, and IMO a pretty bad way to define laws.

powercf• 7 years ago

The car analogy would be:

  He saw a car
  He tried the doors until he found one that was open
  He climbed in and searched everywhere until he found personal information about other users of the system

Even though the security of this system was poor, he still (probably) broke the law. There are plenty of opportunities for people with some knowledge of IT to abuse their power, but it's our responsibility not to do so.

nfoz2• 7 years ago

He looked in the window of a car and saw tons of users' personal information -- visible through the window! Any criminal could walk by and copy the info, privately, without anyone knowing. Maybe some criminals already have.

I think the important thing we miss with car/physical crime analogies is that cybercrime can be so invisible. Nothing is missing, nothing is taken... but users private data is lost. So if an organization is doing something terribly naive like publishing passwords to userdata in plaintext... it's disgusting for our society to punish the wrong people, the people pointing out the flaws rather than the ones who cause them. All the really malicious entities came and went and will never be caught.

They put private information into a JSON file accessible by an HTTPS GET, the only password being one that they put in plaintext onto everyone's phones.

My analogy: They put the private information onto a billboard, but you can only see the billboard from a particular vantage point in a public park.

nkrisc• 7 years ago

Not only are they leaving it unlocked, they are handing the keys to anyone who downloads the app.

manfredo• 7 years ago

He downloaded the apk and extracted the database key from it. This is probably beyond the means of >98% of people of people. To be fair there have been instances were literally just editing the route on a URL to view a different document has resulted in hacking charges, I wouldn't go to such great lengths to defend this guy.

If you go up to someone's house and look under their welcome mat and find a key, is it okay to unlock the door and stroll in with the rationale that the poor security counts as consent to enter?

sammnaser• 7 years ago

Good spot, but be careful in the future in your approach. Some places will nail you for having not stopped at the point where you unpacked the apk resources and noticed the API keys. Downloading the credentials might not have been the smartest move.

aitchnyu3• 7 years ago

I had to code-review a Django app using Firebase as a DB and swore never again. He did features and promised to do validation and security later by going to their editor and writing Javascript files. Django lets him write valid forms and correct SQL queries in almost same lines of code. Pagination was a pain in current version and present only in a version forever in beta. All the hard work coaching him on exceptions went out of the window.

An Android dev finally enlightened me where Firebase shines: offline sync of mobile to a server by eliminating lots of explicit CRUD calls and error handling.

zeristor• 7 years ago

Isn’t this the opening to film Wargames?

Has Joshua asked you to play a game of global thermonuclear war yet?

empath75• 7 years ago

I’m not familiar with Firebase, but is it unusual for end users to have direct access to a database at all? Why isn’t there a web front end there?

wildrhythms• 7 years ago

Firebase has a "rules" feature where you set up security/authorization rules on your database:

https://firebase.google.com/docs/database/security#section-a...

There's a "development" mode you can enable on your database that simply ignores all of the rules. The college app either 1) has no/unsafe rules set up, or 2) left their Firebase database in development mode.

bayareanative• 7 years ago

An Australian autistic developer found a top university's custom authentication database exposed to the internet in less than 10 minutes. Please, no more DIY crypto or running unaudited services willy-nilly. :prayer-emoji-here:

throwaway527694• 7 years ago

Did someone verify any of this?

If I recall correctly this `yoginth` is a known fraudster.

See: https://twitter.com/sindresorhus/status/1015873644377935874 or https://twitter.com/natfriedman/status/1059865722904440833

yoginth6• 7 years ago

Hey, that is too old and I have done it without knowledge, it's my mistake and I apologized for all of them personally and publicly!

Here this app belongs to my college, it's my attendance and work is mine!

uponcoffee• 7 years ago

How does one plagiarize and attempt to profit off somebody else's work without knowing it?

It's ingenious to say you've apologized while at the same time saying you didn't knowingly do anything.

surelyyoujest• 7 years ago

You've built an entire online presence by copying everything from other people's work - from your blog theme to your content "without knowing"?

Adorable.

Also, by briefly reading the docs on the "platform" you are trying to peddle, I'm getting fairly certain you also copied that as well, as it is too well written in comparison to the drivel on your blog.

gus_massa2• 7 years ago

The first linked tweeter thread is from July 2018, the second is from November 2018. I don't classify that as "too old". And your article is dated October 25, 1028, so it's approximately the same period of time.

Also, your article is extremely similar to https://medium.com/@fs0c131y/how-i-found-the-database-of-the... (Oct 16, 2018)

Flashtoo• 7 years ago

You're still plagiarizing today:

https://gitlab.com/yo/hackathon-countdown/blob/master/js/ind...

is the same as

https://gist.github.com/iamkdev/6bcb79670f72ff346590#file-sc...

but you did not include his license.

The same is true for many other projects on your GitLab profile. Many of them are just snippets from Stackoverflow which you decided to turn into a repository with copyright in your name, for some reason.

rnotaro• 7 years ago

Even his other blog post are plagiarizing this Github Blog post.

GH: https://github.blog/2018-03-01-ddos-incident-report/

Yoginth: https://archive.is/EfMFq

prashnts2• 7 years ago

Pretty sure it’s the same person from what I could find out from archive.org snapshots. I followed this trail:

- From the tweet you linked, it’s clear that they owned yoginth.ml

- Archive of the homepage links to a gitlab profile [1] which uses the same profile picture and style of writing as their current gitlab profile.

- The page linked to yoginth.ml, and subsequent snapshots of page show it changed to yoginth.com (the current domain).

Additionally, I noticed that they mentioned that they work at “DocsPen”. Quick google linked to a repository with years of history (evident from the migrations page), but everything committed in 2017. Looked up, and it’s essentially another unattributed copy of BookStackApp with licenses changed and s/BookStack/DocsPen.

Unfortunately, it seems its a case of naive plagiarism and not knowing what counts as fraud. I say this because there’s enough information to get their entire identity (I’m not gonna post a link to that) and it’s clearly a school kid who’s misguided enough. If OP reads this, I’d suggest them to reflect upon their actions, (or cover their tracks more carefully). Sooner or later, if authorities get involved it won’t be difficult for them (I just did archive.org search on my phone). I feel a bit more aware of this because I studied at Delhi University and I knew a few people who did/do similar things to get enough attention and build a resume.

[1] https://web.archive.org/web/20180213200624/https://gitlab.co...

[2] https://web.archive.org/web/20190312041322/https://gitlab.co...

[3] https://github.com/DocsPen/DocsPen/tree/master/database/migr...

[4] https://github.com/BookStackApp/BookStack/tree/master/databa...

ssddanbrown• 7 years ago

Yeah, Docspen was a copy of BookStack. Was a really awkward and difficult thing to handle as maintainer with BookStack being my first popular OS project. It was done very purposeful in an odd way. I remember that issues, filed by BookStack users, were being re-created on the docs pen repo by (potentially fake?) docspen maintainers with pretty much the same text.

Yoginth would then commonly create issues on the BookStack repo, many of which would be issues with DocsPen and not BookStack, and would email me asking to deploy new releases. I remember being at-a-loss of how to handle it, I raised my concerns [1] and asked for advice on reddit[2]. The docspen repo then suddenly moved to GitLab before being hidden. Yoginth then deleted all issues and comments made in the BookStack repo, or this may have been just part of a full account deletion.

[1] https://web.archive.org/web/20180130085921/https://github.co... [2] https://www.reddit.com/r/opensource/comments/7v7yl5/advice_n...

I “found” the database of a college app (2018)

Related Stories