Categories: HackingSecurity

Android Firefox browser app flaw allows data stealing from SD card

Vulnerability In Android Firefox browser app allows hackers to steal user’s files from the SD Card And Firefox’s Privately Stored Data.

Androidpolice blog reported that security researcher Sebastián Guerrero discovered an Android Firefox browser app vulnerability that allows hackers to access both the contents of the SD card and the browser’s private data.
Once again mobile security is under discussion, the number of cyber threats is dramatically increased, the Android Firefox browser flaw is just the last in order of time and appears a serious menace for the users’ privacy. The expert provided the details to Mozilla and also published a POC video on the hack.

It is important to note that the flaw is exploitable by attackers only in one of the following scenarios:

  • The victim installs a malicious application on his mobile device.
  • The victim opens a locally stored HTML file that includes the malicious Javascript code in the vulnerable Android Firefox browser.

 

 

A representative from Mozilla has clarified that the Android Firefox browser vulnerability has been fixed in Firefox for Android v24, released on September 17th. Sebastián Guerrero has found anyway a way to exploit the vulnerability remotely and decided, also in this case, to responsibly disclose it to Mozilla.

If the original Android Firefox browser vulnerability having already been fixed with v24 the remote attack won’t be effective.Once exploited the Android Firefox browser vulnerability an attacker is able to access data files stored on the SD Card, including user’s login credentials, media files, and navigating information.
The files are accessed through the standard URI syntax “file: //”, but the information is encrypted by Firefox. To avoid the obstacle and access to encrypted the data stored in internal storage hackers also introduce a third-party app which gets the encrypted keys stored on the device.
“However, to protect the most sensitive information, apps can place data in a separate location called internal storage, a private folder for each app that even the user is prevented from accessing directly (unless the device is rooted). The most significant threat from this vulnerability is that the secured location for Firefox is also accessible, which means a hacker will have access to cookies, login credentials, bookmarks, and anything else Mozilla think should be kept safely tucked away.” states Androidpolice blog.

The colleagues at The Hacker News reached Guerrero, following an useful series of answers and questions on the Android Android Firefox browser vulnerability:

Q. Can an attacker host the malicious Javascript code HTML file on a server to exploit the flaw remotely by making victim to visit the website only ?A. The exploit cannot be executed by a remote web page. This flaw works only if you install an application, but there is another vulnerability in Firefox that could allow an attacker to install applications without user’s knowledge. I disclosed it to  the Firefox, but other researcher did the same before me.But it’s possible to host the malicious HTML file somewhere and using some social engineering , attacker can make victim to download and execute the file locally on their Firefox app.

Q. To steal the files from the victim’s SD card, an attacker need to pre-define the file names or folder path in the exploit code ?
A. Nope, there is no need to specify the path, because I’m obtaining the salted folder generated by Firefox at runtime, due to a vulnerability. So I can make a copy of the SDcard, because the path will be always /sdcard, and for the private folder locates at /data/data/org.mozilla. Firefox, I’m obtaining at runtime the salted profile generated.
Q. Where and how stolen files will be uploaded ?
A. You can upload it where you want i.e. Using exploit code we are opening a socket connection against the remote FTP server to upload stolen files.
Q. Is there any CVE ID or Mozilla’s Security Advisories ID defined for the Vulnerability yet ?
A. As far as I know there isn’t a CVE assigned to this vulnerability.

Pierluigi Paganini

(Security Affairs –  Android, hacking, Android Firefox browser)

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.

Published by
Pierluigi Paganini
Tags: AndroidAndroid Firefox browserFirefoxHackingmobilesecurity
12 years ago

Recent Posts

Apple fixed first actively exploited zero-day in 2026

Apple fixed an exploited zero-day in iOS, macOS, and other devices that allowed attackers to…

4 hours ago

Multiple Endpoint Manager bugs patched by Ivanti, including remote auth bypass

Ivanti patched over a dozen Endpoint Manager flaws, including a high-severity auth bypass that let…

8 hours ago

<gwmw style="display: none; background-color: transparent;"></gwmw>Volvo Group hit in massive Conduent data breach<gwmw style="display: none; background-color: transparent;"></gwmw>

A Conduent breach exposed data of nearly 17,000 Volvo Group North America employees as the…

19 hours ago

Reynolds ransomware uses BYOVD to disable security before encryption

Researchers discovered Reynolds ransomware, which uses BYOVD technique to disable security tools and evade detection…

24 hours ago

SSHStalker botnet targets Linux servers with legacy exploits and SSH scanning

A new Linux botnet, SSHStalker, has infected about 7,000 systems using old 2009-era exploits, IRC…

1 day ago

U.S. CISA adds Microsoft Office and Microsoft Windows flaws to its Known Exploited Vulnerabilities catalog<gwmw style="display: none; background-color: transparent;"></gwmw>

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft Office and Microsoft Windows flaws to…

1 day ago

This website uses cookies.