A security flaw could have allowed cyber criminals to hijack vulnerable Firefox for Android browsers running on devices joined up to the same Wi-Fi network.
The vulnerability, which has been patched by Mozilla, allowed hackers to force users into visiting sites hosting malicious content, which could subsequently be used to execute phishing attacks or download malware to their devices.
Discovered by ESET security researcher Chris Moberly, the bug lies in Firefox’s Simple Service Discovery Protocol (SSDR), a network protocol for advertisement and the discovery of network services and presence information.
Vulnerable iterations of the Firefox for Android browser, noted as being versions 68.11.0 and below, routinely send out SSDP discovery messages in order to seek out a second-screen device connected to the same local network.
Devices connected to the local network can respond to these messages, providing the location of an eXtensible Markup Language (XML) file containing their configuration details, which Firefox will attempt to access.
“This is where the vulnerability comes in,” Moberly explained on his GitLab page detailing the nature of the exploit.
“Instead of providing the location of an XML file describing a UPnP device, an attacker can run a malicious SSDP server that responds with a specially crafted message pointing to an Android intent URI. Then, that intent will be invoked by the Firefox application itself.”
This fairly straightforward logic bug would allow cyber criminals to click links on other users’ phones via the Firefox browser. Moberly added the vulnerability resembles remote code execution (RCE) in that a remote attacker can trigger the device to perform unauthorised functions with no interaction from the end-user.
Should the bug had been used in the wild, it could have targeted known vulnerabilities in other applications, or it could have been deployed in a way similar to phishing, where a malicious site is thrust upon a victim without their knowledge.
The bug was reported to Mozilla as soon as it was discovered, and the organisation responded immediately, confirming it was not present in the newest version of the browser. Mozilla also opened issues to ensure the offending code was not re-introduced at a later stage.
-
Should AI PCs be part of your next hardware refresh?AI PCs are fast becoming a business staple and a surefire way to future-proof your business
-
Westcon-Comstor and Vectra AI launch brace of new channel initiativesNews Westcon-Comstor and Vectra AI have announced the launch of two new channel growth initiatives focused on the managed security service provider (MSSP) space and AWS Marketplace.
-
Hackers are targeting Ivanti VPN users again – here’s what you need to knowNews Ivanti has re-patched a security flaw in its Connect Secure VPN appliances that's been exploited by a China-linked espionage group since at least the middle of March.
-
Broadcom issues urgent alert over three VMware zero-daysNews The firm says it has information to suggest all three are being exploited in the wild
-
Nakivo backup flaw still present on some systems months after firms’ ‘silent patch’, researchers claimNews Over 200 vulnerable Nakivo backup instances have been identified months after the firm silently patched a security flaw.
-
Everything you need to know about the Microsoft Power Pages vulnerabilityNews A severe Microsoft Power Pages vulnerability has been fixed after cyber criminals were found to have been exploiting unpatched systems in the wild.
-
Billions of IoT devices will need to be secured in the next four years – zero trust could be the key to successNews Researchers have warned more than 28 billion IoT devices will need to be secured by 2028 as attacks on connected devices surge.
-
Cisco claims new smart switches provide next-level perimeter defenseNews Cisco’s ‘security everywhere’ mantra has just taken on new meaning with the launch of a series of smart network switches.
-
Five Eyes cyber agencies issue guidance on edge device vulnerabilitiesNews Cybersecurity agencies including the NCSC and CISA have issued fresh guidance on edge device security.
-
Vulnerability management complexity is leaving enterprises at serious riskNews Fragmented data and siloed processes mean remediation is taking too long
