# Firebase Cloud Messaging Service Takeover: A small research that led to 30k$+ in bounties

Exposed FCM server keys in decompiled APKs let attackers broadcast arbitrary push notifications to every user of Google Play Music, Hangouts, YouTube Go and Music.

- Payout: unconfirmed
- Severity: high
- Program: Google
- Credited: Abss
- Disclosed: 2020-08-17
- Write-up quality: 8/10
- Original: https://abss.me/posts/fcm-takeover/
- Library page: https://bugbountylibrary.com/r/blog%3Aabss-me-posts-fcm-takeover
- Tags: domain:mobile impact:integrity impact:mass-exploit kind:bounty platform:blog sev:high tech:firebase technique:recon technique:reverse-engineering technique:source-review vuln:misconfiguration vuln:secrets-leak

**Target:** Android APK decompiled resources and FCM legacy HTTP send endpoint
**Root cause:** FCM server keys (legacy AIzaSy and AAAA:... variants) were hardcoded in client APK code instead of server-side, granting send authority over the whole Firebase project.
**Steps:**
1. Mass-decompile APKs with apktool and grep for `AIzaSy[0-9A-Za-z_-]{33}` and `AAAA[a-zA-Z0-9_-]{7}:[a-zA-Z0-9_-]{140}`
2. Validate each key: `curl -H "Authorization: key=$key" -H 'Content-Type:application/json' -d '{"registration_ids":["ABC"]}' https://fcm.googleapis.com/fcm/send` — 200 OK means valid
3. Confirm key-to-app mapping: `curl -H "Authorization: key=$key" https://iid.googleapis.com/iid/info/<IID>?details=true` returns `application` package id
4. Extract own IID token via Frida hooking `getFcmIidToken()` in `com.google.android.music.sync.google.gcm.FcmRegistrationHandler`
5. Send notification: `curl -H "Authorization: key=$key" -H 'Content-Type:application/json' -d '{"registration_ids":["<IID>"]}' https://fcm.googleapis.com/fcm/send`
6. Broadcast to all users via condition `"!('xyz4356545' in topics)"` in the send request body
**How found:** Started with static secret hunting: mass-decompiled 50-70 APKs, grepped with gf for key regexes, then focused on variable names like `server_key` and `notification_server_key` which pointed to FCM. Read the legacy-to-HTTPv1 migration docs to learn AIzaSy keys authorize legacy send requests, then discovered the AAAA:... key variant in the Firebase console and GCM-migrated GCP keys.
**Exploitation:** Attacker with a leaked server key sends legacy HTTP v1 send requests to fcm.googleapis.com/fcm/send. Using a logical condition `!('random' in topics)` that always evaluates true, the FCM backend enrolls every registered device of the app, delivering attacker-controlled title/body/image push notifications to the entire userbase.
**Escalation:** Chained key discovery across many APKs; used FCM topic conditions to convert single-device PoC into a broadcast affecting a billion users across Google Play Music, Hangouts, YouTube Go and YouTube Music.
**Insight:** Variable names next to grepped secrets (e.g. `notification_server_key`) reveal the key's privilege class; validate candidate keys against the service's own auth endpoint (200 OK) and map key-to-app via the IID info endpoint before reporting. FCM topic conditions with a negated random topic name broadcast to all users without knowing any real topic.