MyChat – Secure Real-Time Messaging & Firebase Hardening

A Java-based Android chat application designed as a Security Research Case Study. This project focuses on the Offensive-First, Defensive-Driven analysis of real-time cloud integrations, specifically targeting common misconfigurations in Firebase (BaaS) environments.

---

🎯 Security Research Objectives

The goal is to deconstruct the communication between a mobile client and cloud services to identify where trust boundaries fail.

• Firebase Security Rules Audit: Analyzing how over-permissive rules lead to massive data exfiltration and unauthorized database writes.
• Authentication Flow Analysis: Studying the security of Firebase Auth tokens and potential account enumeration vectors.
• Data Isolation: Implementing and testing per-user data silos to prevent Insecure Direct Object References (IDOR).
• Storage Security: Researching media upload vulnerabilities in Firebase Storage (e.g., uploading malicious payloads or unauthorized file access).

---

🔍 Attack Surface & Threat Modeling

This project explores the following critical vectors in Java-based Android apps:

• Logic Flaws in Java Listeners: Analyzing how ChildEventListener can be abused to leak data if not properly detached during the Activity lifecycle.
• Client-Side Trust Fallacy: Demonstrating how simple "if/else" checks on the client can be bypassed via Frida to read messages intended for other users.
• NoSQL Injection (Firebase): Testing how malformed queries can bypass security filters if the rules are not strictly defined.
• PII Leakage: Identifying where User Model data (Emails, IDs) might be exposed in public database nodes.

---

🛡️ Defensive Hardening & Mitigations

1. Cloud Infrastructure Hardening

• Granular Security Rules: Implementation of strict Firebase rules using the auth.uid variable to ensure users can only read/write their own chat nodes.
• Storage Validation: Enforcing file-type and file-size constraints at the storage rule level to prevent resource exhaustion and malware distribution.

2. Client-Side Resilience (Java)

• Memory Safety: Ensuring Adapters and Listeners are cleared in onStop(), preventing memory-resident data from being scraped via runtime inspection.
• Obfuscation: Custom ProGuard rules to protect the Java business logic and Firebase API integration patterns.
• Input Sanitization: Validating all chat inputs to prevent basic XSS or injection-style payloads from being rendered in the RecyclerView.

---

🧠 Technical Stack

• Language: Java (Modern Android SDK)
• Backend: Firebase (Auth, Realtime DB, Storage)
• Architecture: Observer Pattern with Event Listeners
• AppSec Tools: MobSF, Burp Suite (WebSockets analysis), Frida, Firebase Console Simulator.

---

🧪 AppSec Training Scenarios

• Scenario A: Use the Firebase Simulator to try and read the users node without a valid token.
• Scenario B: Use Burp Suite to intercept the WebSocket traffic and analyze the JSON structure of the real-time messages.
• Scenario C: Decompile the app and attempt to find the Firebase google-services.json metadata to assess its impact if leaked.

---

👤 Author

Nikolay Vetrik – Senior Security Engineer & Mobile Developer 📧 devnikolaivetrik@gmail.com | 🔗 LinkedIn

---

⚠️ Disclaimer

This project is intended solely for educational research and defensive security analysis. It demonstrates how to transform an "Offensive" understanding of Firebase into a "Defensive" production-ready implementation.