There is a change to Push Notification behaviour in Android 12, which all apps need to update to by November according to my team mate. So this is likely what it seems - someone made an enhancement and was testing the new behaviour on Android 12 devices.

https://developer.android.com/about/versions/12/behavior-cha...

Oh thank god I was freaking out my first name is dev

Maybe they are Testing how many People will write about this on yc

As another commenter mentioned, it's at least a good marketing campaign, causing me to open the app for the first time in months. Or it might be to gather a baseline of how many people react to their notifications, regardless of their contents? (Perhaps to immediately go to the notifications settings to disable them)

Edit: if the notification is sent by an attacker, does the attacker get access to firebase metrics as well? (Guessing they at least contain info about how many people opened the app)

Yeeep they did, I got it too. https://imgur.com/a/Yoa1G4k

What phone do you have? 1 day 23 hours, I'm jealous of your battery life!

Pixel 4a. Recently I've not been using it excessively, so it's got quite an optimistic estimate. But if I'm careful it's possible.

Interesting, I've got a Pixel 4a 5G! I definitely don't get that sort of longevity out of a charge.

Yeah battery isn't so flash if I have cell network on. (reception is shocking here so leave it disable most of the time)

Same here, three minutes ago. Maybe their Key was leaked as well? I recall a similar issue happened with Firebase: https://cybernews.com/security/exposed-google-keys-leaves-bi...

Interesting, but why would an attacker push a notification like this to so many people?

Or did not many people get it? Could I be targeted, along with the others in this thread?

If the attacker really intended to send the notification to everyone (or even 10%), wouldn't that very likely get the attention of Airbnb, and then they'd know about the issue and be able to mitigate it?

Edit: assuming everyone got it, this seemed much more likely to be a mistake, to me. For example, someone working at Airbnb was testing something and accidentally did it in prod instead of dev. Otherwise, why not camouflage this as something more innocent, like an ad for Airbnb, saying something generic like "Check out our listings near you"?

Could be a POC for an attacker. If they got the ability to send out custom push notifications in the future they could contain malicious links.

But if so, why not try to camouflage it as something more generic, to try to avoid notifying Airbnb? I am tech savvy enough and have marketing notifications turned off, but I would assume that they are simply not honouring the setting somehow if I received an ad for Airbnb.

Now Airbnb knows to change their key or something if possible, and I'll be very suspicious of any notifications from any app in the future, especially Airbnb.

If it was a poc they just lost the ability to build the real attack by being way too noticeable. This issue has likely already been mitigated and will be patched up within days if not hours. Much more likely to be an honest mistake.

Why not just send the links. This would tip off Airbnb to patch it.

Oh could the attacker get information about whether or not I opened the app? Is the same key used to send notifications and access metrics that Firebase collects?

Somewhere a junior is sweating buckets.

Maybe. But given the culture at most of these places I'd expect the junior to be explained that it's ok, everybody makes mistakes. Some engineering manager is probably sweating bigger buckets over their failure to properly secure casual human access to prod stuff, which is definitely not ok. Meanwhile the both of them are really really relieved that the notification contents were completely innocuous and not some sick inside joke that would have been massively offensive out of context.

The only cause for outrage would be if someone got fired for what appears to be an honest mistake.

Unless its the CIO/CSO for shite secret management policies.

No, the process failed. They should NOT have access to prod API keys.. It actually shows how ABnB treats security of prod secrets.

Access to a web app that can send push notifications to all users is not access to prod secrets.

Everyone is blaming the process, secrets of prod etc. I'm saying, there's a test campaign problem, or, more probably, a lack of a human tester. Someone made a test in dev, it got put to the test, and wen through to prod. No real security leak or anything, just a product not properly tested. Like 99% of the internet. Who has the time and money to refactor, doc and test?

It's like climate change: let's all drive full speed into a wall, while tinkering with the stereo system of the car.

Airbnb support confirmed it is from Airbnb https://airbnbase.com/test-dev

I get a paywall. Can a subscriber share the content here? Airbnb charges to read their own official publications?

That's the weirdest thing I've seen.

This to me means the devs have access to the prod keys, even to the external services... not good.

How big is their dev team? Does their app change much? Could they have contracted it out and now only have one or two people who still push updates to it?

its AirBnB.. they should have this stuff sorted! Dev/prod should be completely separate with the vaults/secrets management in prod having the correct keys with only a few peeps having access (in a break glass situation). Dev's should not have the keys to put into code to push to a prod external service...

There is zero reason why any dev (or worse external dev team) should have access to prod secrets, or the ability to push out via prod. (unless someone cocked up the config for the dev/staging push notification tooling, again requires a level of access)

Just had the same notification. Can anyone else confirm this isn't some exploit being used?

Same here, in France. I hope the guy won't lose his job...

Got it as well. Sweden. What I noticed was that the airbnb logo was red insured if Grey in the notification. Could it be a test of changing the notification logo color?

Autocorrect kills me I meant to say the airbnb logo was red in the notification instead of grey. Maybe a color change test that wasn't meant to go public?

Certainly some dev's fuck-up. Now it is interesting to see how they will handle it. My sympathy goes to the poor guy who made the mistake.

Its the process, not the dev. A Dev should never have access to prod secrets, it show flaws in ABnB security model and tells me a fair bit around how the work with dev/deployment.

don't know if related but when i opened it my phone rebooted with the boot logo for the os flashing (running a custom rom)

Did you have developer mode enabled on your device?

Yup, I got it too in Italy. Opening the notification apparently did nothing on the surface.

Got it too in NL. Glad too see even the largest players make mistakes like this :)

got it too. made me open the app. brilliant marketing campaign

Haha I considered this as a possibility for why it was sent... I don't ever open their app otherwise, I only ever installed it to receive messages from a host on a trip.

At the very least they might have wanted to understand a baseline for how many people will open a notification just to dig into the app and try to disable future notifications, regardless of how annoying the text in the notification was.

I have it in France too

Turkey got it as well. Don't drink and work guys.

Just received test dev notification in Latvia.

Got it in germany

Just received this notification in Latvia.

Greece here, happened to me 2 minute ago

I got this notification too. from usa

Got it here in WA state at 12:03 PST

Greece here, happened 2 minute ago

Got it as well in Brussels, BE

İ just received now in Turkey.

Only android or Apple as well?

I just got that too in the uk

Recieved in Taiwan Hahaha

Received as well in LU ;

yep, just got in the Netherlands. Someone over there f*cked up!

Got it in Mars as well

Got it too, from India

Just got it, Australia

I got it in australia

Me too in Switzerland

Got it also in France

Same here, in Mexico

Got it in Norway ffs

Got it in Sri Lanka

Got it in AZ, USA

Got it, Australia

Same here, Poland

Got it in France

Got it in Italy

Same here in GR

+1 from Germany

Got it in Italy

i got the same notification. australia

+1 from India

+1 Australia.

I got it too

+ 1 Brasil

Same here

Latvia +1

Got it

Lol someone is getting fired!!!

High up yes, not the dev who did this.

That would actually be sad

Press F to pay respects

got it too, from usa

same here in France

same here DK, CPH

i got this in aus

same here, pak