What do you dislike about Google Cloud Firestore?
We were hacked, and our number of reads spiked by literally billions of reads within a short period, our bill spiked by thousands of dollars and as we were unable to explain this to our stakeholders we had to shut down development and our jobs are less stable than before.
We set up alerts and quotas on our API but the reads bypassed the api and so we were alerted when our bill showed up - were we to have our time again we would have found a way to set alerts on the Firevase reads itself but had run with the premise that reads would have been throuigh our apis
Our security team advised us that the requirement to include the google credentials file in our Android app (so that app knows the end point to use) meant that our firestore endpoint was open for anyone to see, so we were relying on the rules to work. We were confident that that was ok and that having rules in place would mitigate these risks.
What we experienced was a malicious agent for no gain of their own found a way to smash our service and drive our bill up.
in case it helps anyone our rules are below. These did not work and suddenly we are facing a massive bill that has massively damaged our business units reputation within our organisation,
We have (to date, it's been about 20 days since the attack was noted) received no useful assistance from Google tracking down how the attack worked, but our security team is guessing that either someone managed to pretend that their requests were originating from our domain.
We use Microsoft authentication - our product was targetted at business clients - and had successfully tested security with non authenticated accounts and authenticated accounts outside our domain.
service cloud.firestore {
match /databases/{database}/documents {
match /{document=**} {
allow read, write: if request.auth != null && request.auth.token.email.matches('.*@["our domain"]);
}
}
} Review collected by and hosted on G2.com.
