Android Firefox browser app flaw allows data stealing from SD card

Vulnerability In Android Firefox browser app allows hackers to steal user’s files from the SD Card And Firefox’s Privately Stored Data.

Androidpolice blog reported that security researcher Sebastián Guerrero discovered an Android Firefox browser app vulnerability that allows hackers to access both the contents of the SD card and the browser’s private data.

Once again mobile security is under discussion, the number of cyber threats is dramatically increased, the Android Firefox browser flaw is just the last in order of time and appears a serious menace for the users’ privacy. The expert provided the details to Mozilla and also published a POC video on the hack.

It is important to note that the flaw is exploitable by attackers only in one of the following scenarios:

• The victim installs a malicious application on his mobile device.
• The victim opens a locally stored HTML file that includes the malicious Javascript code in the vulnerable Android Firefox browser.

A representative from Mozilla has clarified that the Android Firefox browser vulnerability has been fixed in Firefox for Android v24, released on September 17th. Sebastián Guerrero has found anyway a way to exploit the vulnerability remotely and decided, also in this case, to responsibly disclose it to Mozilla.

If the original Android Firefox browser vulnerability having already been fixed with v24 the remote attack won’t be effective.Once exploited the Android Firefox browser vulnerability an attacker is able to access data files stored on the SD Card, including user’s login credentials, media files, and navigating information.

The files are accessed through the standard URI syntax “file: //”, but the information is encrypted by Firefox. To avoid the obstacle and access to encrypted the data stored in internal storage hackers also introduce a third-party app which gets the encrypted keys stored on the device.

“However, to protect the most sensitive information, apps can place data in a separate location called internal storage, a private folder for each app that even the user is prevented from accessing directly (unless the device is rooted). The most significant threat from this vulnerability is that the secured location for Firefox is also accessible, which means a hacker will have access to cookies, login credentials, bookmarks, and anything else Mozilla think should be kept safely tucked away.” states Androidpolice blog.

The colleagues at The Hacker News reached Guerrero, following an useful series of answers and questions on the Android Android Firefox browser vulnerability:
Q. Can an attacker host the malicious Javascript code HTML file on a server to exploit the flaw remotely by making victim to visit the website only ?A. The exploit cannot be executed by a remote web page. This flaw works only if you install an application, but there is another vulnerability in Firefox that could allow an attacker to install applications without user’s knowledge. I disclosed it to  the Firefox, but other researcher did the same before me.But it’s possible to host the malicious HTML file somewhere and using some social engineering , attacker can make victim to download and execute the file locally on their Firefox app.

Q. To steal the files from the victim’s SD card, an attacker need to pre-define the file names or folder path in the exploit code ?
A. Nope, there is no need to specify the path, because I’m obtaining the salted folder generated by Firefox at runtime, due to a vulnerability. So I can make a copy of the SDcard, because the path will be always /sdcard, and for the private folder locates at /data/data/org.mozilla. Firefox, I’m obtaining at runtime the salted profile generated.

Q. Where and how stolen files will be uploaded ?
A. You can upload it where you want i.e. Using exploit code we are opening a socket connection against the remote FTP server to upload stolen files.

Q. Is there any CVE ID or Mozilla’s Security Advisories ID defined for the Vulnerability yet ?
A. As far as I know there isn’t a CVE assigned to this vulnerability.