Tag Archives: from

Unprotected Firebase databases leaked over 100 million records

Thousands of mobile applications are leaking personally identifiable information from unprotected Firebase databases.

According to research from application security company Appthority, 3,000 mobile iOS and Android apps are leaking 100 million exposed records of user data. The records include 2.6 million

plain text
passwords and user IDs, at least 4 million records with protected

health  information
(PHI), 25 million GPS location records, 50 thousand financial records, and at least 4.5 million Facebook, LinkedIn, Firebase and corporate datastore user tokens.

These exposures happen “when app developers fail to require authentication to a Google Firebase cloud database,” according to the report from Appthority, which also notes that Firebase is one of the 10 most popular datastores for mobile apps with over 53,000 apps using it in 2017.

“The challenge for app developers is that Firebase does not provide adequate security capabilities out of the box. The only security feature available to developers is authentication and

rule-based
authorization,” Appthority explained in its report. “However, Firebase does not secure user data by default nor are third-party tools available to provide encryption for it.”

The report also noted that it would be easy for hackers to find unprotected Firebase databases and gain access to private data records.

“The result is a trove of data that is open to the public internet unless the developer explicitly imposes user authentication on each individual table or directory,” Appthority explained in the report. “Even when developers do implement authentication, they may not secure every database table.”

As a result, the Appthority researchers found that over 113 GB of data has been exposed through the 3,000 apps. They also found that 62% of enterprises are using at least one vulnerable app, spanning a variety of industries across the globe including banking, telecoms, postal services,

ride sharing
companies, hospitality

and
education. The apps that leaked the most data were health and fitness apps.

“Medical information can be worth ten times more than credit card numbers on the deep web,” the report said. “Fraudsters can use this data to create fake IDs to buy medical equipment or drugs, or combine a patient number with a false provider number and file fictional claims with insurers.”

It’s misconfiguration and mismanagement of the backend infrastructure opening up these vulnerabilities.
Seth HardyDirector of Security Research, Appthority

Appthority said it notified Google of this issue with apps hosted on unprotected Firebase databases, but Seth Hardy, Appthority’s director of security research, doesn’t think the blame falls entirely to Google — despite Google not making the security features that would prevent these leaks set to default.

“They’re not directly responsible,” he told SearchSecurity. “When you make a tool and try to make it easy to use, then you’re probably not going to want to add that setting by default.”

Hardy noted that it’s also not the responsibility of the user to make sure the apps are secure.

“It’s definitely a developer issue,” he said. “It’s misconfiguration and mismanagement of the backend infrastructure opening up these vulnerabilities.”

The solution, according to Hardy, lies with the developers.

“It’s really just a matter of trying to educate developers in general about secure coding practices, making sure that they’re implemented in all parts of the software development lifecycle and giving users and enterprises the tools to verify whether these apps are implementing proper security controls on their data.”

For Sale – Acer XB281HK 28″ 4K G-sync Monitor

Selling this monitor due to getting a new one. It’s two years old and in great condition from a smoke free home.

Details here: Predator XB1 Gaming Monitor | XB281HK | Acer Store UK Official Site

Sadly can’t post it as I don’t have the original box and don’t want to chance it with courier services.

I live down near the St Ives area.

Price and currency: £290
Delivery: Goods must be exchanged in person
Payment method: BT or PPG
Location: Cornwall
Advertised elsewhere?: Advertised elsewhere
Prefer goods collected?: I prefer the goods to be collected

______________________________________________________
This message is automatically inserted in all classifieds forum threads.
By replying to this thread you agree to abide by the trading rules detailed here.
Please be advised, all buyers and sellers should satisfy themselves that the other party is genuine by providing the following via private conversation to each other after negotiations are complete and prior to dispatching goods and making payment:

  • Landline telephone number. Make a call to check out the area code and number are correct, too
  • Name and address including postcode
  • Valid e-mail address

DO NOT proceed with a deal until you are completely satisfied with all details being correct. It’s in your best interest to check out these details yourself.

For Sale – 2x4gb Samsung DDR3 sodimms (Laptop Memory)

I have for sale 2x4gb Samsung sodimms, recently bought from here for my Sony Vaio laptop.

After doing my best with my limited knowledge I was sure they would work for me, unfortunately they don`t so they are back up for sale here.

Comparing them to my original memory the differences are my memory says 8500s, PC3 2Rx8. Whereas as you can see from the photo the Samsung memory says 12800s, PC3L, 1Rx8. This all means nothing to me, I just know it doesn`t work in my laptop

Selling for £30 inc delivery

Price and currency: £30 inc delivery
Delivery: Delivery cost is included within my country
Payment method: Bank Transfer
Location: Ormskirk
Advertised elsewhere?: Not advertised elsewhere
Prefer goods collected?: I have no preference

______________________________________________________
This message is automatically inserted in all classifieds forum threads.
By replying to this thread you agree to abide by the trading rules detailed here.
Please be advised, all buyers and sellers should satisfy themselves that the other party is genuine by providing the following via private conversation to each other after negotiations are complete and prior to dispatching goods and making payment:

  • Landline telephone number. Make a call to check out the area code and number are correct, too
  • Name and address including postcode
  • Valid e-mail address

DO NOT proceed with a deal until you are completely satisfied with all details being correct. It’s in your best interest to check out these details yourself.

For Sale – 2x4gb Samsung DDR3 sodimms (Laptop Memory)

I have for sale 2x4gb Samsung sodimms, recently bought from here for my Sony Vaio laptop.

After doing my best with my limited knowledge I was sure they would work for me, unfortunately they don`t so they are back up for sale here.

Comparing them to my original memory the differences are my memory says 8500s, PC3 2Rx8. Whereas as you can see from the photo the Samsung memory says 12800s, PC3L, 1Rx8. This all means nothing to me, I just know it doesn`t work in my laptop

Selling for £30 inc delivery

Price and currency: £30 inc delivery
Delivery: Delivery cost is included within my country
Payment method: Bank Transfer
Location: Ormskirk
Advertised elsewhere?: Not advertised elsewhere
Prefer goods collected?: I have no preference

______________________________________________________
This message is automatically inserted in all classifieds forum threads.
By replying to this thread you agree to abide by the trading rules detailed here.
Please be advised, all buyers and sellers should satisfy themselves that the other party is genuine by providing the following via private conversation to each other after negotiations are complete and prior to dispatching goods and making payment:

  • Landline telephone number. Make a call to check out the area code and number are correct, too
  • Name and address including postcode
  • Valid e-mail address

DO NOT proceed with a deal until you are completely satisfied with all details being correct. It’s in your best interest to check out these details yourself.

For Sale – 8x Sapphire AMD Radeon RX570 4GB PULSE ITX Graphics Card

Have decided to sell the gfx cards from a mining setup of mine, I need to fund a new project.

All are 6 months old, under volted so not been stressed.

All work perfect condition, come with their original boxes and ran in a clean environment.

These are great cards and pack a punch, when mining Ethereum they ran at 29MH/s without breaking a sweat.

These are the single fan itx model.

Spec link: SAPPHIRE PULSE ITX Radeon™ RX 570 4GD5-SAPPHIRE Technology

Will use Royal Mail special delivery full insured.

If you will be using the card for mining, I will include a pci riser per card at no cost.

I may add some more parts over the next few days

Any questions, please ask.

Price and currency: £190 each
Delivery: Delivery cost is included within my country
Payment method: PayPal (Gift or add fees), Bank Transfer, Cash on collection
Location: Manchester
Advertised elsewhere?: Advertised elsewhere
Prefer goods collected?: I have no preference

______________________________________________________
This message is automatically inserted in all classifieds forum threads.
By replying to this thread you agree to abide by the trading rules detailed here.
Please be advised, all buyers and sellers should satisfy themselves that the other party is genuine by providing the following via private conversation to each other after negotiations are complete and prior to dispatching goods and making payment:

  • Landline telephone number. Make a call to check out the area code and number are correct, too
  • Name and address including postcode
  • Valid e-mail address

DO NOT proceed with a deal until you are completely satisfied with all details being correct. It’s in your best interest to check out these details yourself.

For Sale – toshiba satellite l500-1xj(spares)

Hey

Had this a few years and not used much.
I got this from my aunt a few years back and it’s been collecting dust.

Satellite L500-1XJ – Toshiba

Selling as spares as it has no battery, but it works fully.
Screen fully works with no dead pixels.

Talk to me people
Make me a offer

20180605_164929.jpg

20180605_164955.jpg

20180605_165136.jpg

Price and currency: £70
Delivery: Delivery cost is included within my country
Payment method: PP or BT
Location: LONDON
Advertised elsewhere?: Not advertised elsewhere
Prefer goods collected?: I have no preference

______________________________________________________
This message is automatically inserted in all classifieds forum threads.
By replying to this thread you agree to abide by the trading rules detailed here.
Please be advised, all buyers and sellers should satisfy themselves that the other party is genuine by providing the following via private conversation to each other after negotiations are complete and prior to dispatching goods and making payment:

  • Landline telephone number. Make a call to check out the area code and number are correct, too
  • Name and address including postcode
  • Valid e-mail address

DO NOT proceed with a deal until you are completely satisfied with all details being correct. It’s in your best interest to check out these details yourself.

For Trade – Dell Inspiron 17 5000 Series Laptop, Intel Core i7, 8GB RAM, 1TB, 17.3″ Full HD

Purchased from John Lewis December 2016, no longer needed so listing it on here, few scuffs on the lid.
No box but will be well packaged
Spec below

Waves MaxxAudio Pro
6.5 hours Battery Life
Bluetooth Enabled
DVD/RW
Integrated Widescreen HD 720P Webcam with Dual Digital Microphone Array
Full HD LED 17.3″ 1920 x 1080 pixels
AMD Radeon R7 M445 4GB DDR3
1TB
Backlit Keyboard
8GB RAM
3-in-1 Card Reader (SD, SDHC, SDXC)
Windows 10 (64 bit)
1x HDMI,1x USB3.0, 2x USB2.0
Intel Core i7-7500U
2.7GHz to 3.5GHz with Turbo Boost
Inspiron 17
Wi-Fi- 802.11ac

Price and currency: £399
Delivery: Delivery cost is included within my country
Payment method: BT
Location: Derby
Advertised elsewhere?: Advertised elsewhere
Prefer goods collected?: I have no preference

______________________________________________________
This message is automatically inserted in all classifieds forum threads.
By replying to this thread you agree to abide by the trading rules detailed here.
Please be advised, all buyers and sellers should satisfy themselves that the other party is genuine by providing the following via private conversation to each other after negotiations are complete and prior to dispatching goods and making payment:

  • Landline telephone number. Make a call to check out the area code and number are correct, too
  • Name and address including postcode
  • Valid e-mail address

DO NOT proceed with a deal until you are completely satisfied with all details being correct. It’s in your best interest to check out these details yourself.

Wanted – 8th gen Intel laptop with 1080P screen

I appreciate that it’s probably a long shot, but I’m looking to upgrade from my old Dell XPS 15, and thought I’d try here first.

Preferably after an i5 8250u or i7 8550u, minimum 1080P screen, SSD would be nice, but I’m happy to buy one with an M2 slot and fit my own.

Location: Hexham, UK

______________________________________________________
This message is automatically inserted in all classifieds forum threads.
By replying to this thread you agree to abide by the trading rules detailed here.
Please be advised, all buyers and sellers should satisfy themselves that the other party is genuine by providing the following via private conversation to each other after negotiations are complete and prior to dispatching goods and making payment:

  • Landline telephone number. Make a call to check out the area code and number are correct, too
  • Name and address including postcode
  • Valid e-mail address

DO NOT proceed with a deal until you are completely satisfied with all details being correct. It’s in your best interest to check out these details yourself.

For Sale – Mac Pro 256GB SSD / Samsung 1440p 34″ curved monitor

Mac Pro 2013 256GB SSD
MZ-JPU256T/0A6
SSUAX Samsung
Removed from working Mac Pro 2013. Fully working and formatted. Replaced with the 500GB as above.

£145

Samsung S34E790C 34″ LED Ultra Wide Curved Monitor 3440×1440

Specs:
– Screen Size Class (diagonal): 34″ Curved
– Panel Type: VA
– Aspect Ratio: 21:9
– Resolution: 3440×1440
– Color Gamut (CIE1931): sRGB 100%
– Brightness (typical): 300 cd/m2
– Contrast Ratio(Original): 3000:1
– Response Time: 4ms
– Viewing Angle (CR>10): 178/178
– Colour Depth (Num of Colours): 16.7M (8-Bit)
– Pixel Pitch (mm): 0.2325
– Surface Treatment: Anti-Glare 3H
– Curve: 3000R
– Connectivity: 2x HDMI 1.4 (50Hz), 1x DisplayPort 1.2 (60Hz)
– USB 3.0 Hub: Yes x4 (1up 4down)
– Speakers: 2x 7W
– Tilt: -5 / +20
– VESA: 100×100

Pics:
#14

Mint condition, had since new. Selling due to new iMac.
Boxed with everything. £500 inc P&P

Price and currency: 145 / 500
Delivery: Delivery cost is included within my country
Payment method: BT/PPG
Location: Oxfordshire
Advertised elsewhere?: Advertised elsewhere
Prefer goods collected?: I have no preference

______________________________________________________
This message is automatically inserted in all classifieds forum threads.
By replying to this thread you agree to abide by the trading rules detailed here.
Please be advised, all buyers and sellers should satisfy themselves that the other party is genuine by providing the following via private conversation to each other after negotiations are complete and prior to dispatching goods and making payment:

  • Landline telephone number. Make a call to check out the area code and number are correct, too
  • Name and address including postcode
  • Valid e-mail address

DO NOT proceed with a deal until you are completely satisfied with all details being correct. It’s in your best interest to check out these details yourself.

Developers reap benefits of iOS app modules with Swift

BOSTON — Modularization is one of the basic best practices of app development, but recent updates from Apple put it even higher on the priority list for many iOS developers.

Modularization is the process of breaking down an app into smaller, more digestible components. App modules are often based on particular functions; for example, an authentication module supports the authentication process, a login module supports the login process and so on. Here at this week’s SwiftFest event focused on Apple’s Swift programming language, developers discussed their reasons for breaking mobile applications into app modules and how they approach the process.

Modularization offers a variety of benefits to an app development team. For example, it generates a stronger sense of code ownership, which can cut down on time wasted during the development process. Modularization can also allow developers to track quality code and bugs more easily.

Cut confusion, allow scalability

Brad Smith, a senior iOS engineer at Wayfair, an e-commerce company based in Boston, is in the process of beginning to break down its app into app modules. Wayfair has a large team of 40 developers, which created confusion over code ownership during the app development process. The goal of modularization is to lower build times, eliminate bottlenecks and increase productivity, Smith said.

If you sound like a crazy person when you’re explaining your code to someone else, that’s a sign that you need to be more organized.
Alvin AndinoiOS software developer, Intrepid Pursuits

“If you sound like a crazy person when you’re explaining your code to someone else, that’s a sign that you need to be more organized,” said Alvin Andino, an iOS software developer at Intrepid Pursuits, a mobile development firm in Cambridge, Mass.

Modularization through Swift would clear up some of that confusion because Swift offers well-defined access controls that can limit developers to work on their own modules. Andino works in a team of six, but his team still deals with issues that Wayfair’s larger group deals with, such as code ownership. Breaking the app into app modules would help clarify the onboarding process for new developers, Andino said.

Scalability was one of the main reasons for The Washington Post’s development team to modularize, said Arthur Sabintsev, a lead iOS developer for the newspaper. After Jeff Bezos, the founder and CEO of Amazon, acquired The Washington Post in 2013, the company pivoted to also operate a software as a service (SaaS) platform called Arc Publishing that handles content management for other publishers such as The Boston Globe and Los Angeles Times.

“To scale at that level, we needed to break apart our code, which was tightly coupled to how the Post operates,” Sabintsev said. “The best way was to break everything apart into single pieces and then add these extra features [that our clients requested].”

Prior to modularization, the SaaS platform only supported Adobe Omniture for analytics. But during the modularization process, the team built a translation layer to take the raw data and convert it in a way that other analytics platforms such as Google’s Firebase and Snowplow could understand.

The evolution of modularized apps

Although breaking an app into app modules is a basic tenant of development, there are a few recent changes that have made the process more accessible for developers.

First, there was Apple’s support for dynamic frameworks in iOS 8 and for static libraries in Swift. Another change is Apple’s introduction of a variety of OSes, including TV OS and Watch OS, said Calvin Chestnut, an iOS developer at Rue La La, an e-commerce company in Boston. Each OS has different requirements and capabilities; for example, developers can’t use table views on Watch OS, but they can on iOS and TV OS. But breaking the code down into app modules allows developers to more easily share the code between different targets, Chestnut said.

The ability to port iOS apps to macOS with a universal framework — announced at Apple’s 2018 Worldwide Developers Conference — will make that process even easier.

“It’s the dream of every developer,” said Giorgio Natili, a software development manager at Amazon. “It’s a really good sign of [Apple] listening to the community.”

Other developers don’t believe that Apple’s different OSes are conducive to modularization. Developers need to be able to create crisper, cleaner, access-controlled interfaces with shared libraries to modularize effectively, said Brian Arnold, an engineering manager at MathWorks Inc., a software company in Natick, Mass. Swift, however, is primed for modularization because it allows developers to keep collections of symbols separate from each other, he said.

“Apple has made it easier,” Arnold said in an email. “But [frameworks and extensions] are not sufficient to enable companies sharing code in multiple apps to further increase modularity, except in a very limited way.”