[Analytics/GoogleAppMeasurement 12.17.0] Security-scanner findings: MD5/SHA‑1 (CC_MD5/CC_SHA1) in analytics event hashing, JWT persisted in GDT cache, and undeclared tracking domains

### Description

# Firebase SDK Security Scanner Findings – GoogleAppMeasurement 12.17.0

## Overview

A NowSecure scan of our iOS application identified several security findings originating from Firebase/Google SDK binaries.

We verified that our application source code does **not** use `CC_MD5`, `CC_SHA1`, CommonCrypto hashing, or generate/store the flagged JWT.

### Environment

* Firebase iOS SDK: **12.17.0**
* GoogleAppMeasurement: **12.17.0**
* GoogleDataTransport: **10.1.1**
* Integration: **Swift Package Manager**
* Products: **FirebaseAnalyticsCore + FirebaseCrashlytics**
* IDFA/Ad-ID: **Disabled**
* Scanner: **NowSecure Static + Dynamic Analysis**

## Findings

### 1. MD5 / SHA-1 Hashing

NowSecure detected `CC_MD5` and `CC_SHA1` inside the **GoogleAppMeasurement** binary.

The hashing appears to be used for analytics event/instance identification and deduplication. The resulting data is passed to GoogleDataTransport and persisted in its local event cache.

**Request:** Please confirm that these hashes are used only for non-security analytics purposes and provide any planned migration from MD5/SHA-1 to a modern algorithm such as SHA-256.

### 2. JWT in GoogleDataTransport Cache

An ES256 JWT was detected in:

```text
Library/Caches/google-sdks-events/GDTCORFlatFileStorage/gdt_event_data/...
```

This appears to be an SDK-managed Google/Firebase transport token rather than an application or user credential.

**Request:** Please confirm the token's purpose, lifetime, security classification, and whether its on-disk storage is expected SDK behavior.

### 3. Tracking Domains

NowSecure identified the following hardcoded domains within Firebase/Google SDK binaries:

```text
firebase-settings.crashlytics.com
www.googleadservices.com
```

Our configuration uses FirebaseAnalyticsCore and Crashlytics with IDFA/Ad-ID disabled. We do not enable ATT tracking.

**Request:** Please confirm whether these domains should be considered tracking domains in this configuration and whether keeping:

```text
NSPrivacyTracking = false
```

is correct.

## Current Disposition

All findings have been identified as **SDK-internal** and are not caused by application code.

We are currently risk-accepting these findings pending vendor clarification/remediation, as disabling Analytics or Crashlytics is not an option for our application.

### Requested Vendor Response

Please provide:

1. Confirmation of the purpose and security relevance of the MD5/SHA-1 operations.
2. Remediation timeline, if MD5/SHA-1 replacement is planned.
3. Confirmation regarding the JWT stored by GoogleDataTransport.
4. Privacy/tracking classification of the identified domains.
5. Any supported mitigation that avoids these findings without disabling Firebase Analytics or Crashlytics.

An official response or statement would be helpful for our security audit documentation.

### Reproducing the issue

_No response_

### Firebase SDK Version

12.17.0

### Xcode Version

26.6

### Installation Method

Swift Package Manager

### Firebase Product(s)

Analytics, Crashlytics

### Targeted Platforms

iOS

### Relevant Log Output

```shell

```

### If using Swift Package Manager, the project's Package.resolved

Expand Package.resolved snippet

```json

Replace this line with the contents of your Package.resolved.

```

### If using CocoaPods, the project's Podfile.lock

Expand Podfile.lock snippet

```yml

Replace this line with the contents of your Podfile.lock!

```

Start by reviewing the GoogleAppMeasurement and GoogleDataTransport binaries and the reported Library/Caches/google-sdks-events/GDTCORFlatFileStorage/gdt_event_data path alongside the NowSecure findings. Determine whether the MD5/SHA-1 calls, cached ES256 JWT, and listed domains are expected for Analytics and Crashlytics; done requires an official clarification or supported mitigation.

Written by the indexing model from the issue text.