Pierluigi Paganini January 09, 2017

A flaw in Brave Browser could be exploited by attackers to trick users into visiting a fake or malicious website to serve either malware or conduct phishing attacks.

Brave is an open source project that promises to block Internet greed and ugliness while improving speed and protecting privacy. Basically, it blocks ads containing pixels and cookies that track users and load stuff onto their devices without their knowledge.

Brave considers security as its topmost priority and runs a Bug bounty program on Hackerone platform. Aaditya Purani, a Security researcher and Ethical Hacker discovered a critical flaw in Brave’s IOS as well as Android applications that would let any attacker tricking users into visiting a fake or malicious website to serve either malware or conduct phishing attacks.

In Simple words, the victim sees a familiar looking URL but the content is not from the same URL but the attacker controlled content.

“We recognize that the address bar is the only reliable security indicator in modern browsers” many experts say.

Affected products are:

• In IOS – Affected is the Latest Version 1.2.16 (16.09.30.10)
• In Android – Affected in Brave Latest version 1.9.56

Brave Security Team fixed this vulnerability within a week and the vulnerability report was disclosed after 3 months of the fix, so currently it does not affect any user.

A complete report was publicly disclosed by the security researcher Aaditya Purani here: https://hackerone.com/reports/175958 and he was rewarded $200 under the bug bounty by Brave Team.

“I created a HTML Code which would spoof address bar of Brave Browser ( bravespoof.html) in the Attachments. As we can understand, the code contains a form which i have created just to demonstrate a look-a-like impact where it asks for username and password of any user. But the real trick is done, by the function f() whose location is equal to https://facebook.com . Additionally, to complete the exploit i used setInterval function to execute the function f continuously after every 10 milliseconds. Hence, ideally after 10 ms the Location would divert the URL as well as the page to display https://facebook.com content or it some cases, it keeps hold the of URL without changing the URL nor the page (which is again a safe case) . But in Brave Browser both fails, In brave when you host the below given HTML code to a web server and visit from either Android or IOS Brave Browser, The URL would get spoofed to https://facebook.com (Even it shows Green lock so victim would believe) but the content remains the one which attackers have placed.” explained Purani.

In past, Aaditya Purani had also reported many other critical vulnerabilities, including a WP Mobile detector Arbitrary file upload and Account Takeover on Beats by Dr.Dre. Bug Bounty programs are serving well for organizations and start-ups to fix their security vulnerabilities, and in return, they acknowledge researchers by paying them bounty or sending them swags.

About the author Aaditya Purani

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs – ESEA data breach, hacking)