Incident
incident:donald_daters_database_exposure
Exposure of Donald Daters user records, messages, profile pictures, and session-related tokens through its Firebase database.
Exposure of Donald Daters user records, messages, profile pictures, and session-related tokens through its Firebase database.
“Within five minutes I managed to get a list of all the people registered”
“all their names, all their photos, personal messages, and a token to steal their sessions”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | INVOLVES | Firebase security rules misconfiguration | Explicit | 49 |
| outgoing | COMPROMISES | Firebase | Explicit | 49 |
Donald Daters database exposure INVOLVES Firebase security rules misconfiguration
The Donald Daters database exposure involved Firebase debug/security settings being left open.
Explicit Confidence 99% · Elliot Alderson EP 49 Details
“This is a scandal because they kept the debug sitting on Firebase.”
Donald Daters database exposure COMPROMISES Firebase
Elliot gained access to the Donald Daters Firebase database and could view its contents.
Explicit Confidence 99% · Jack Rhysider EP 49 Details
“Within five minutes, Elliot has gained access to the entire Donald Daters database.”
“I had access to everything; all the messages, all the people’s details.”