Categories: HackingSecurity

Android Firefox browser app flaw allows data stealing from SD card

Vulnerability In Android Firefox browser app allows hackers to steal user’s files from the SD Card And Firefox’s Privately Stored Data.

Androidpolice blog reported that security researcher Sebastián Guerrero discovered an Android Firefox browser app vulnerability that allows hackers to access both the contents of the SD card and the browser’s private data.
Once again mobile security is under discussion, the number of cyber threats is dramatically increased, the Android Firefox browser flaw is just the last in order of time and appears a serious menace for the users’ privacy. The expert provided the details to Mozilla and also published a POC video on the hack.

It is important to note that the flaw is exploitable by attackers only in one of the following scenarios:

  • The victim installs a malicious application on his mobile device.
  • The victim opens a locally stored HTML file that includes the malicious Javascript code in the vulnerable Android Firefox browser.

 

 

A representative from Mozilla has clarified that the Android Firefox browser vulnerability has been fixed in Firefox for Android v24, released on September 17th. Sebastián Guerrero has found anyway a way to exploit the vulnerability remotely and decided, also in this case, to responsibly disclose it to Mozilla.

If the original Android Firefox browser vulnerability having already been fixed with v24 the remote attack won’t be effective.Once exploited the Android Firefox browser vulnerability an attacker is able to access data files stored on the SD Card, including user’s login credentials, media files, and navigating information.
The files are accessed through the standard URI syntax “file: //”, but the information is encrypted by Firefox. To avoid the obstacle and access to encrypted the data stored in internal storage hackers also introduce a third-party app which gets the encrypted keys stored on the device.
“However, to protect the most sensitive information, apps can place data in a separate location called internal storage, a private folder for each app that even the user is prevented from accessing directly (unless the device is rooted). The most significant threat from this vulnerability is that the secured location for Firefox is also accessible, which means a hacker will have access to cookies, login credentials, bookmarks, and anything else Mozilla think should be kept safely tucked away.” states Androidpolice blog.

The colleagues at The Hacker News reached Guerrero, following an useful series of answers and questions on the Android Android Firefox browser vulnerability:

Q. Can an attacker host the malicious Javascript code HTML file on a server to exploit the flaw remotely by making victim to visit the website only ?A. The exploit cannot be executed by a remote web page. This flaw works only if you install an application, but there is another vulnerability in Firefox that could allow an attacker to install applications without user’s knowledge. I disclosed it to  the Firefox, but other researcher did the same before me.But it’s possible to host the malicious HTML file somewhere and using some social engineering , attacker can make victim to download and execute the file locally on their Firefox app.

Q. To steal the files from the victim’s SD card, an attacker need to pre-define the file names or folder path in the exploit code ?
A. Nope, there is no need to specify the path, because I’m obtaining the salted folder generated by Firefox at runtime, due to a vulnerability. So I can make a copy of the SDcard, because the path will be always /sdcard, and for the private folder locates at /data/data/org.mozilla. Firefox, I’m obtaining at runtime the salted profile generated.
Q. Where and how stolen files will be uploaded ?
A. You can upload it where you want i.e. Using exploit code we are opening a socket connection against the remote FTP server to upload stolen files.
Q. Is there any CVE ID or Mozilla’s Security Advisories ID defined for the Vulnerability yet ?
A. As far as I know there isn’t a CVE assigned to this vulnerability.

Pierluigi Paganini

(Security Affairs –  Android, hacking, Android Firefox browser)

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.

Published by
Pierluigi Paganini
Tags: AndroidAndroid Firefox browserFirefoxHackingmobilesecurity
11 years ago

Recent Posts

Over 1,400 CrushFTP internet-facing servers vulnerable to CVE-2024-4040 bug

Over 1,400 CrushFTP internet-facing servers are vulnerable to attacks exploiting recently disclosed CVE-2024-4040 vulnerability. Over…

2 hours ago

Sweden’s liquor supply severely impacted by ransomware attack on logistics company

A ransomware attack on a Swedish logistics company Skanlog severely impacted the country's liquor supply. …

4 hours ago

CISA adds Cisco ASA and FTD and CrushFTP VFS flaws to its Known Exploited Vulnerabilities catalog

CISA adds Cisco ASA and FTD and CrushFTP VFS vulnerabilities to its Known Exploited Vulnerabilities…

15 hours ago

CISA adds Microsoft Windows Print Spooler flaw to its Known Exploited Vulnerabilities catalog

U.S. CISA added the Windows Print Spooler flaw CVE-2022-38028 to its Known Exploited Vulnerabilities catalog.…

21 hours ago

DOJ arrested the founders of crypto mixer Samourai for facilitating $2 Billion in illegal transactions

The U.S. Department of Justice (DoJ) announced the arrest of two co-founders of a cryptocurrency mixer…

22 hours ago

Google fixed critical Chrome vulnerability CVE-2024-4058

Google addressed a critical Chrome vulnerability, tracked as CVE-2024-4058, that resides in the ANGLE graphics…

1 day ago

This website uses cookies.