NEW DELHI — India’s action against at least 57 websites and databases hosted on Google’s Firebase platform has highlighted how cybercriminals are allegedly exploiting legitimate cloud infrastructure to carry out phishing campaigns, distribute malware and steal financial information.
Firebase is a cloud-based development platform owned by Google that helps developers build and manage mobile apps and websites. It offers services including hosting, databases, authentication, analytics and other backend tools.
The platform itself is legitimate and widely used. Concerns raised by Indian authorities relate to the alleged misuse of Firebase by criminals, rather than wrongdoing by Google or the platform itself.
According to notices sent to Google by the Indian Cyber Crime Coordination Centre, or I4C, scammers allegedly used Firebase-hosted pages to impersonate major banks and other trusted organizations.
Some of the websites reportedly mimicked institutions including State Bank of India, ICICI Bank and Axis Bank. Such pages can be designed to resemble legitimate banking websites and trick users into entering passwords, account details or other sensitive information.
Authorities also identified Firebase-hosted sites and databases that were allegedly used to collect information stolen from victims’ smartphones, including credit card details and one-time passwords.
Using established cloud infrastructure can make fraudulent websites and backend systems appear more credible and potentially harder for users to distinguish from legitimate services.
In one reported scheme, scammers allegedly created fake websites offering help with PM-KISAN payments and persuaded victims to download an Android application.
The application was allegedly malicious and capable of collecting information from a victim’s phone. That information could then be transmitted to a Firebase database controlled by the scammers.
The scheme illustrates how several components can work together: a fake website attracts the victim, malicious software collects information from the device and cloud infrastructure is used to receive or store the stolen data.
Firebase is commonly described as a backend-as-a-service platform because it allows developers to use ready-made infrastructure instead of building their own backend systems from scratch.
Those features can help legitimate developers create applications more efficiently, but the same hosting and database capabilities can also be abused to support phishing sites, malicious apps and fraudulent data collection.
Indian authorities ordered Google in August to remove at least 57 Firebase-hosted websites and databases that were allegedly linked to phishing, malware distribution and financial fraud. (Source: IANS)
