7 ms·
Airbnb on Android just send a “Test, Test dev" push notification message
- hehehenry 4y ago
- mrbombastic123 4y agoReceived as well in LU ;
- wingworks 4y agoYeeep they did, I got it too. https://imgur.com/a/Yoa1G4k https://imgur.com/a/Yoa1G4k
- patrickdavey 4y agoGot it in Italy
- himalayanthrust 4y agoI got it too
- deleted 4y ago[deleted]
- U1F984 4y agoSame here, three minutes ago. Maybe their Key was leaked as well? I recall a similar issue happened with Firebase: https://cybernews.com/security/exposed-google-keys-leaves-billions-of-users-open-to-mass-spam-and-phishing-notifications/ https://cybernews.com/security/exposed-google-keys-leaves-bi...
- axby 4y agoInteresting, but why would an attacker push a notification like this to so many people? Or did not many people get it? Could I be targeted, along with the others in this thread? If the attacker really intended to send the notification to everyone (or even 10%), wouldn't that very likely get the attention of Airbnb, and then they'd know about the issue and be able to mitigate it? Edit: assuming everyone got it, this seemed much more likely to be a mistake, to me. For example, someone working at Airbnb was testing something and accidentally did it in prod instead of dev. Otherwise, why not camouflage this as something more innocent, like an ad for Airbnb, saying something generic like "Check out our listings near you"?
- SoeMyzlack 4y agoCould be a POC for an attacker. If they got the ability to send out custom push notifications in the future they could contain malicious links.
- 999900000999 4y agoWhy not just send the links. This would tip off Airbnb to patch it.
- axby 4y agoBut if so, why not try to camouflage it as something more generic, to try to avoid notifying Airbnb? I am tech savvy enough and have marketing notifications turned off, but I would assume that they are simply not honouring the setting somehow if I received an ad for Airbnb. Now Airbnb knows to change their key or something if possible, and I'll be very suspicious of any notifications from any app in the future, especially Airbnb.
- SoeMyzlack 4y agoJust had the same notification. Can anyone else confirm this isn't some exploit being used?
- blaziken 4y agoLol someone is getting fired!!!
- dazzlevolta 4y agoThat would actually be sad
- Anesto 4y agoPress F to pay respects
- joper90 4y agoHigh up yes, not the dev who did this.
- Alexfrance123 4y agoI have it in France too
- aflag 4y agoI just got that too in the uk
- cronus94 4y agoOh thank god I was freaking out my first name is dev
- cuculetz 4y agodon't know if related but when i opened it my phone rebooted with the boot logo for the os flashing (running a custom rom)
- SoeMyzlack 4y agoDid you have developer mode enabled on your device?
- Yurii17K 4y agoSame here, Poland
- wuyishan 4y ago+1 from Germany
- pockrasta 4y agoGot it in Norway ffs
- otterpond 4y agogot it too. made me open the app. brilliant marketing campaign
- axby 4y agoHaha I considered this as a possibility for why it was sent... I don't ever open their app otherwise, I only ever installed it to receive messages from a host on a trip. At the very least they might have wanted to understand a baseline for how many people will open a notification just to dig into the app and try to disable future notifications, regardless of how annoying the text in the notification was.
- amorsly 4y agosame here in France
- Posterguy2 4y ago+1 Australia.
- deleted 4y ago[deleted]
- gregos 4y agoGot it also in France
- rickette 4y agoGot it too in NL. Glad too see even the largest players make mistakes like this :)
- Anesto 4y agoGreece here, happened 2 minute ago
- nullified0 4y agogot it too, from usa
- zefyrus 4y agoyep, just got in the Netherlands. Someone over there f*cked up!
- nullified0 4y agoI got this notification too. from usa
- Anesto 4y agoGreece here, happened to me 2 minute ago
- dimitrisor 4y agoSame here in GR
- ilikemartians 4y agoYup, I got it too in Italy. Opening the notification apparently did nothing on the surface.
- hamzakhan904 4y agosame here, pak
- deleted 4y ago[deleted]
- thirumalairaj 4y ago+1 from India
- du5ky 4y agoi got this in aus
- du5ky 4y agoi got the same notification. australia
- deleted 4y ago[deleted]
- SebastienL 4y agoGot it in France
- RainDropsGoBoom 4y agoRecieved in Taiwan Hahaha
- chagaif 4y agoMe too in Switzerland
- johnsteinbeck 4y agoTurkey got it as well. Don't drink and work guys.
- wombatprincess 4y agoJust got it, Australia
- wombatprincess 4y agoGot it, Australia
- suddenDD 4y agoGot it in Sri Lanka
- Theapodig 4y agoI got it in australia
- VictorRamayo 4y agoSame here, in Mexico
- sanjithpk 4y agoGot it too, from India
- dglavask 4y agoGot it in germany
- dglavask 4y agoGot it
- mygo89 4y agoLatvia +1
- dglavask 4y agoMaybe they are Testing how many People will write about this on yc
- axby 4y agoAs another commenter mentioned, it's at least a good marketing campaign, causing me to open the app for the first time in months. Or it might be to gather a baseline of how many people react to their notifications, regardless of their contents? (Perhaps to immediately go to the notifications settings to disable them) Edit: if the notification is sent by an attacker, does the attacker get access to firebase metrics as well? (Guessing they at least contain info about how many people opened the app)
- extraoriginal 4y agoSame here
- extraoriginal 4y agoGot it in Italy
- dglavask 4y agoOnly android or Apple as well?
- newfoundry 4y agoGot it as well. Sweden. What I noticed was that the airbnb logo was red insured if Grey in the notification. Could it be a test of changing the notification logo color?
- newfoundry 4y agoAutocorrect kills me I meant to say the airbnb logo was red in the notification instead of grey. Maybe a color change test that wasn't meant to go public?
- FireHalf 4y agoİ just received now in Turkey.
- shez789 4y agoJust received test dev notification in Latvia.
- shez789 4y agoJust received this notification in Latvia.
- Skadabucci 4y agoGot it in AZ, USA
- Ostendo 4y agoSame here, in France. I hope the guy won't lose his job...
- darylteo 4y agoThere is a change to Push Notification behaviour in Android 12, which all apps need to update to by November according to my team mate. So this is likely what it seems - someone made an enhancement and was testing the new behaviour on Android 12 devices. https://developer.android.com/about/versions/12/behavior-changes-12 https://developer.android.com/about/versions/12/behavior-cha...
- Oleg11 4y agoGot it as well in Brussels, BE
- joper90 4y agoThis to me means the devs have access to the prod keys, even to the external services... not good.
- axby 4y agoHow big is their dev team? Does their app change much? Could they have contracted it out and now only have one or two people who still push updates to it?
- joper90 4y agoits AirBnB.. they should have this stuff sorted! Dev/prod should be completely separate with the vaults/secrets management in prod having the correct keys with only a few peeps having access (in a break glass situation). Dev's should not have the keys to put into code to push to a prod external service... There is zero reason why any dev (or worse external dev team) should have access to prod secrets, or the ability to push out via prod. (unless someone cocked up the config for the dev/staging push notification tooling, again requires a level of access)
- 5tormTrooper 4y agoSomewhere a junior is sweating buckets.
- joper90 4y agoNo, the process failed. They should NOT have access to prod API keys.. It actually shows how ABnB treats security of prod secrets.
- esprehn 4y agoAccess to a web app that can send push notifications to all users is not access to prod secrets.
- woevdbz 4y agoMaybe. But given the culture at most of these places I'd expect the junior to be explained that it's ok, everybody makes mistakes. Some engineering manager is probably sweating bigger buckets over their failure to properly secure casual human access to prod stuff, which is definitely not ok. Meanwhile the both of them are really really relieved that the notification contents were completely innocuous and not some sick inside joke that would have been massively offensive out of context.
- TheAceOfHearts 4y agoThe only cause for outrage would be if someone got fired for what appears to be an honest mistake.
- joper90 4y agoUnless its the CIO/CSO for shite secret management policies.
- valermor 4y agoCertainly some dev's fuck-up. Now it is interesting to see how they will handle it. My sympathy goes to the poor guy who made the mistake.
- joper90 4y agoIts the process, not the dev. A Dev should never have access to prod secrets, it show flaws in ABnB security model and tells me a fair bit around how the work with dev/deployment.
- trambopoline 4y agoGot it here in WA state at 12:03 PST
- deleted 4y ago[deleted]
- nougatmat 4y agosame here DK, CPH
- alefith 4y agoEveryone is blaming the process, secrets of prod etc. I'm saying, there's a test campaign problem, or, more probably, a lack of a human tester. Someone made a test in dev, it got put to the test, and wen through to prod. No real security leak or anything, just a product not properly tested. Like 99% of the internet. Who has the time and money to refactor, doc and test? It's like climate change: let's all drive full speed into a wall, while tinkering with the stereo system of the car.
- milicanogueira 4y ago+ 1 Brasil
- aaron695 4y ago
- Fennecxx 4y agoAirbnb support confirmed it is from Airbnb https://airbnbase.com/test-dev https://airbnbase.com/test-dev
- deleted 4y ago[deleted]
- lilgreenman 4y agoGot it in Mars as well