Mixing
Firebase Api Key can be used at another App (Decompiled APK)
We were planning to use Firebase Anonymous Authantication and Realtime Database for our Android app. Then we wanted to try if our Firebase Api Key can be used in another app to access our Database and we've crated a fake app with same package name, put our existing Firebase Api Key to it and then signed it with brand new Sign key. Once we run it, it was able to access our previous apps firebase backend.
(Since Firebase Api key can be extracted from apk easily, we wanted to simulate the same action)
Despite the most of the answers says that Firebase checks the signature of the App, we were able to access the database with completely different APK.
Do I missing anything on the Firebase configuration side ?
Edit :
What I Did Step By Step :
1) Created a new Android Project with same package name of existing one.
2) Put the google-services.json of existing project to new project
3) Wrote the following code to new project
final FirebaseAuth mAuth;
mAuth = FirebaseAuth.getInstance();
FirebaseUser currentUser = mAuth.getCurrentUser();
final String TAG = "AuthTest";
mAuth.signInAnonymously()
.addOnCompleteListener(this, new OnCompleteListener<AuthResult>() {
@Override
public void onComplete(@NonNull Task<AuthResult> task) {
if (task.isSuccessful()) {
// Sign in success, update UI with the signed-in user's information
Log.d(TAG, "signInAnonymously:success");
FirebaseUser user = mAuth.getCurrentUser();
} else {
// If sign in fails, display a message to the user.
Log.w(TAG, "signInAnonymously:failure", task.getException());
}
}
});
4) Signed the APK with completely new Signing Key
5) Run the Application on the device.
Result : Anonymous user was created on our existing Firebase Project
android firebase firebase-realtime-database firebase-authentication decompiling edited Nov 19 '18 at 23:12
Doug Stevenson
71.8k981101
asked Nov 19 '18 at 22:18
Eren DemirEren Demir
9613
add a comment |
We were planning to use Firebase Anonymous Authantication and Realtime Database for our Android app. Then we wanted to try if our Firebase Api Key can be used in another app to access our Database and we've crated a fake app with same package name, put our existing Firebase Api Key to it and then signed it with brand new Sign key. Once we run it, it was able to access our previous apps firebase backend.
(Since Firebase Api key can be extracted from apk easily, we wanted to simulate the same action)
Despite the most of the answers says that Firebase checks the signature of the App, we were able to access the database with completely different APK.
Do I missing anything on the Firebase configuration side ?
Edit :
What I Did Step By Step :
1) Created a new Android Project with same package name of existing one.
2) Put the google-services.json of existing project to new project
3) Wrote the following code to new project
final FirebaseAuth mAuth;
mAuth = FirebaseAuth.getInstance();
FirebaseUser currentUser = mAuth.getCurrentUser();
final String TAG = "AuthTest";
mAuth.signInAnonymously()
.addOnCompleteListener(this, new OnCompleteListener<AuthResult>() {
@Override
public void onComplete(@NonNull Task<AuthResult> task) {
if (task.isSuccessful()) {
// Sign in success, update UI with the signed-in user's information
Log.d(TAG, "signInAnonymously:success");
FirebaseUser user = mAuth.getCurrentUser();
} else {
// If sign in fails, display a message to the user.
Log.w(TAG, "signInAnonymously:failure", task.getException());
}
}
});
4) Signed the APK with completely new Signing Key
5) Run the Application on the device.
Result : Anonymous user was created on our existing Firebase Project
android firebase firebase-realtime-database firebase-authentication decompiling edited Nov 19 '18 at 23:12
Doug Stevenson
71.8k981101
asked Nov 19 '18 at 22:18
Eren DemirEren Demir
9613
Are you suggesting that you were able to authenticate as a user in the project from an app that was signed with a SHA-1 hash that was not added to the project? Please edit the question with exactly the tests you performed that you think should not have worked.
– Doug Stevenson
Nov 19 '18 at 22:32
@DougStevenson Thanks for the comment. It is not the same as you described. I add the details to question.
– Eren Demir
Nov 19 '18 at 23:12
@DougStevenson What do you mean by "signed with a SHA-1 hash"? A digital signature?
– beroal
Dec 27 '18 at 17:54
add a comment |
We were planning to use Firebase Anonymous Authantication and Realtime Database for our Android app. Then we wanted to try if our Firebase Api Key can be used in another app to access our Database and we've crated a fake app with same package name, put our existing Firebase Api Key to it and then signed it with brand new Sign key. Once we run it, it was able to access our previous apps firebase backend.
(Since Firebase Api key can be extracted from apk easily, we wanted to simulate the same action)
Despite the most of the answers says that Firebase checks the signature of the App, we were able to access the database with completely different APK.
Do I missing anything on the Firebase configuration side ?
Edit :
What I Did Step By Step :
1) Created a new Android Project with same package name of existing one.
2) Put the google-services.json of existing project to new project
3) Wrote the following code to new project
final FirebaseAuth mAuth;
mAuth = FirebaseAuth.getInstance();
FirebaseUser currentUser = mAuth.getCurrentUser();
final String TAG = "AuthTest";
mAuth.signInAnonymously()
.addOnCompleteListener(this, new OnCompleteListener<AuthResult>() {
@Override
public void onComplete(@NonNull Task<AuthResult> task) {
if (task.isSuccessful()) {
// Sign in success, update UI with the signed-in user's information
Log.d(TAG, "signInAnonymously:success");
FirebaseUser user = mAuth.getCurrentUser();
} else {
// If sign in fails, display a message to the user.
Log.w(TAG, "signInAnonymously:failure", task.getException());
}
}
});
4) Signed the APK with completely new Signing Key
5) Run the Application on the device.
Result : Anonymous user was created on our existing Firebase Project
android firebase firebase-realtime-database firebase-authentication decompiling edited Nov 19 '18 at 23:12
Doug Stevenson
71.8k981101
asked Nov 19 '18 at 22:18
Eren DemirEren Demir
9613
We were planning to use Firebase Anonymous Authantication and Realtime Database for our Android app. Then we wanted to try if our Firebase Api Key can be used in another app to access our Database and we've crated a fake app with same package name, put our existing Firebase Api Key to it and then signed it with brand new Sign key. Once we run it, it was able to access our previous apps firebase backend.
(Since Firebase Api key can be extracted from apk easily, we wanted to simulate the same action)
Despite the most of the answers says that Firebase checks the signature of the App, we were able to access the database with completely different APK.
Do I missing anything on the Firebase configuration side ?
Edit :
What I Did Step By Step :
1) Created a new Android Project with same package name of existing one.
2) Put the google-services.json of existing project to new project
3) Wrote the following code to new project
final FirebaseAuth mAuth;
mAuth = FirebaseAuth.getInstance();
FirebaseUser currentUser = mAuth.getCurrentUser();
final String TAG = "AuthTest";
mAuth.signInAnonymously()
.addOnCompleteListener(this, new OnCompleteListener<AuthResult>() {
@Override
public void onComplete(@NonNull Task<AuthResult> task) {
if (task.isSuccessful()) {
// Sign in success, update UI with the signed-in user's information
Log.d(TAG, "signInAnonymously:success");
FirebaseUser user = mAuth.getCurrentUser();
} else {
// If sign in fails, display a message to the user.
Log.w(TAG, "signInAnonymously:failure", task.getException());
}
}
});
4) Signed the APK with completely new Signing Key
5) Run the Application on the device.
Result : Anonymous user was created on our existing Firebase Project
android firebase firebase-realtime-database firebase-authentication decompiling android firebase firebase-realtime-database firebase-authentication decompiling edited Nov 19 '18 at 23:12
Doug Stevenson
71.8k981101
asked Nov 19 '18 at 22:18
Eren DemirEren Demir
9613
edited Nov 19 '18 at 23:12
Doug Stevenson
71.8k981101
asked Nov 19 '18 at 22:18
Eren DemirEren Demir
9613
edited Nov 19 '18 at 23:12
Doug Stevenson
71.8k981101
edited Nov 19 '18 at 23:12
Doug Stevenson
71.8k981101
edited Nov 19 '18 at 23:12
Doug Stevenson
71.8k981101
71.8k981101
asked Nov 19 '18 at 22:18
Eren DemirEren Demir
9613
asked Nov 19 '18 at 22:18
Eren DemirEren Demir
9613
asked Nov 19 '18 at 22:18
Eren DemirEren Demir
9613
9613
Are you suggesting that you were able to authenticate as a user in the project from an app that was signed with a SHA-1 hash that was not added to the project? Please edit the question with exactly the tests you performed that you think should not have worked.
– Doug Stevenson
Nov 19 '18 at 22:32
@DougStevenson Thanks for the comment. It is not the same as you described. I add the details to question.
– Eren Demir
Nov 19 '18 at 23:12
@DougStevenson What do you mean by "signed with a SHA-1 hash"? A digital signature?
– beroal
Dec 27 '18 at 17:54
add a comment |
Are you suggesting that you were able to authenticate as a user in the project from an app that was signed with a SHA-1 hash that was not added to the project? Please edit the question with exactly the tests you performed that you think should not have worked.
– Doug Stevenson
Nov 19 '18 at 22:32
@DougStevenson Thanks for the comment. It is not the same as you described. I add the details to question.
– Eren Demir
Nov 19 '18 at 23:12
@DougStevenson What do you mean by "signed with a SHA-1 hash"? A digital signature?
– beroal
Dec 27 '18 at 17:54
Are you suggesting that you were able to authenticate as a user in the project from an app that was signed with a SHA-1 hash that was not added to the project? Please edit the question with exactly the tests you performed that you think should not have worked.
– Doug Stevenson
Nov 19 '18 at 22:32
Are you suggesting that you were able to authenticate as a user in the project from an app that was signed with a SHA-1 hash that was not added to the project? Please edit the question with exactly the tests you performed that you think should not have worked.
– Doug Stevenson
Nov 19 '18 at 22:32
@DougStevenson Thanks for the comment. It is not the same as you described. I add the details to question.
– Eren Demir
Nov 19 '18 at 23:12
@DougStevenson Thanks for the comment. It is not the same as you described. I add the details to question.
– Eren Demir
Nov 19 '18 at 23:12
@DougStevenson What do you mean by "signed with a SHA-1 hash"? A digital signature?
– beroal
Dec 27 '18 at 17:54
@DougStevenson What do you mean by "signed with a SHA-1 hash"? A digital signature?
– beroal
Dec 27 '18 at 17:54
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53383463%2ffirebase-api-key-can-be-used-at-another-app-decompiled-apk%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53383463%2ffirebase-api-key-can-be-used-at-another-app-decompiled-apk%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Are you suggesting that you were able to authenticate as a user in the project from an app that was signed with a SHA-1 hash that was not added to the project? Please edit the question with exactly the tests you performed that you think should not have worked.
– Doug Stevenson
Nov 19 '18 at 22:32
@DougStevenson Thanks for the comment. It is not the same as you described. I add the details to question.
– Eren Demir
Nov 19 '18 at 23:12
@DougStevenson What do you mean by "signed with a SHA-1 hash"? A digital signature?
– beroal
Dec 27 '18 at 17:54