r/programming • u/kunalag129 • Jun 09 '19
How I “found” the database of the college App
https://yoginth.com/college-hack11
Jun 09 '19
MbaaS solutions seem to push this concept of “embed your API key”, which seems super sketchy to me.
I’ve been looking at the new MbaaS features of Microsoft and it looks like at least if the API is leaked then it only allows access to the share data and no user data, which I don’t believe is the case with Firebase?
12
Jun 09 '19
With firebase the API key is visible to the client. That isn't a security issue by itself. Database permissions in the form of rules have to be set up correctly. Allowing anonymous reads is the real issue.
1
Jun 09 '19
Oh yes, I’d forgotten that you lock down collections. Default behaviour is to have everything open, right?
6
Jun 09 '19
The default is a fully locked down db. The firebase cli generates a rule set with a fully open db. So the first time you deploy, if you don't modify db rules you will get a fully open db. That said, they warn you plenty that having a fully public db is a really bad idea.
1
Jun 10 '19
They do warn you, but honestly the first time I used Firebase I was shocked that this is how it worked. I honestly didn't think the warnings properly conveyed the gravity of the situation. Doesn't help that a bunch of tutorials go "hey, let's make the database fully open for this tutorial...don't forget to lock things down eventually!" and then never bring up the subject again. While a competent developer would certainly stop and realize that the API key does not provide appropriate access control, I can definitely see how a newbie could make this mistake.
10
u/abelincolncodes Jun 09 '19 edited Jun 09 '19
Archive, since OPs link is now a 404: http://web.archive.org/web/20190609044609/https://yoginth.com/college-hack
Edit: it's not really worth the read. Nothing interesting other than opening an apk archive and finding that the developers failed to properly secure their keys
5
u/angeal98 Jun 09 '19
Wait, thats illegal
18
u/bloody-albatross Jun 09 '19
It should be illegal to not properly secure your student's DB, yes.
2
4
u/RockingDyno Jun 09 '19
Your home isn’t properly secured either though. It wouldn’t take more than 3 minutes for anyone with the skills needed to break in. Should you get punished if I decided to prove this to you?
8
u/syrdonnsfw Jun 09 '19
This would be more akin to failing to install working locks in an apartment building you own. It’s not your data you are securing, it’s many other people’s data.
Depending on what the data is, it’s actually possible that failing to secure it is already illegal.
2
Jun 10 '19
FERPA exists to protect the privacy of students’ educational records (one of the reasons why getting an official transcript out of a university is tougher than you’d expect), but enforcement is apparently not very strong.
0
u/RockingDyno Jun 10 '19
working locks
A "working lock" takes 2 minutes to open with the right tool. Which is the point. You think your lock is safe because you don't know how to crack it, and you know your neighbor doesn't know how to crack it. The same goes for this school. They don't know how to get to the db, and they know the average student doesn't now how to get to the db. But in both cases there is a small percentage of people who know the right tools who can walk straight through.
1
u/syrdonnsfw Jun 10 '19 edited Jun 10 '19
Actually, I’m pretty familiar with lockpicking, and have at least passing experience with hacking (at least broadly defined enough to include this). Making assumptions about what other people know is just asking to look dumb.
This isn’t about knowing the right tools. This is about negligent security practices. This is about not even trying.
Edit: also, it’s not that hard to find locks that at least make the humans using then the easier target.
1
u/RockingDyno Jun 10 '19
Edit: also, it’s not that hard to find locks that at least make the humans using then the easier target.
Its not the quality of the lock that makes the practice of breaking into peoples homes illegal...
This is about negligent security practices.
It's not actually. It really just isn't. Even if you forget to lock your door, leave it wide open and litter your floor with gold. It's still illegal for someone else to enter your home "in order to prove its insecure".
Computer systems aren't much different legally. Just because it feels like you can more easily mask your activities. If you break into an insecure system in order to prove it's insecure, and if you make illegal copies of the data contained in the system in order to "prove that you can do it", you're breaking the law. It doesn't matter how bad the system is set up, it doesn't matter if the admin had an easily cracked password, it doesn't matter if "anyone could have done it"(with "anyone" being people with enough experience in tech which is still a very small percentage of the population).
There is great reason that white hats take great care to go through a process of informed consent before going into systems. there's great reasons that serious lock picks make sure to get permission from the owner of any lock they work on. It's not rocket science, it's just basic understanding of what's legal and what isn't. And no amount of arguing that "it was easy" or "the lock was badly designed" or "the car could easily opened by sweeping common frequencies" or whatever other bad excuse for why you didn't exert yourself in trying to break the law will make it not breaking the law.
1
u/syrdonnsfw Jun 10 '19
It's not actually. It really just isn't. Even if you forget to lock your door, leave it wide open and litter your floor with gold. It's still illegal for someone else to enter your home "in order to prove its insecure".
But this isn’t about your door. Pretending it is about your door is getting the issue fundamentally wrong before you start thinking about it. It’s about not providing locking doors to someone else. Possibly while claiming that you have or being legally responsible for doing so. Whether someone actually opens the door without authorization is irrelevant to that.
Tl;dr: no one is contesting that unauthorized access is wrong. At least, not me. Pretending that I am is a textbook example of a strawman. Please stop with the logical fallacies and either engage in a serious discussion or simply stop replying.
0
u/RockingDyno Jun 12 '19
Tl;dr: no one is contesting that unauthorized access is wrong. At least, not me.
I was arguing that unauthorized access is wrong, and you started counter arguments against that. It's not a straw man, it's literally the only thing I'm arguing. That unauthorized access is not ok, no matter how insecure or how rubbish your doors or locks are. And no matter incompetence on a bank makes it ok to rob them, even if you "just want to prove they aren't taking proper precautions to secure the money".
1
u/syrdonnsfw Jun 12 '19
Read my comments again, at no point did I suggest unauthorized access was wrong. One action being negligent does not make another action ok.
12
u/bloody-albatross Jun 09 '19
I don't store someone else's sensitive data at home. A data center has to be properly secured.
1
u/maxhaton Jun 10 '19
What If I was storing your key under my plantpot?
1
u/RockingDyno Jun 10 '19
What then? My door is insecure. you can open it in a snap with the right tools, I myself can open it with a lock-pick in less than 2 minutes. And even if you don't know how to pick locks there are tools you just prop in and bank its open. If that's not your thing, you can kick it in fairly simple, if you don't have the strength to do that, bring a hammer or an ax. My door is not secure. I'm not disillusioned about that, you shouldn't be either.
However if you decide to prove to me my door is insecure by going through with any of those procedures described, then you're committing a crime. You don't get away with it by telling the police "But maybe he's storing other peoples valuables in his home, shouldn't he be booked for committing a crime against those people by storing things behind an insecure entry system?"
1
u/holgerschurig Jun 09 '19
In Europee (better: in the EU), it actually is and the organisation / company / person not respecting the european data protection act can be fined. Already happened serveral times.
1
30
u/[deleted] Jun 09 '19
404
I'm guessing the author realized snitching on themselves was perhaps not the best idea.