Address Bar Spoofing Vulnerabilities affect a number of Mobile Browsers

guest · Oct 20, 2020

Mobile Browser Bugs Open Safari, Opera Users to Malware
A set of address-spoofing bugs affect users of six different types of mobile browsers
October 20, 2020
https://threatpost.com/mobile-browser-bugs-safari-opera-malware/160326/

A set of address-bar spoofing vulnerabilities that affect a number of mobile browsers open the door for malware delivery, phishing and disinformation campaigns.

The bugs, reported by Rapid7 and independent researcher Rafay Baloch, affect six browsers, ranging from the common (Apple Safari, Opera Touch/Mini and Yandex), to the less common (Bolt Browser, RITS Browser and UC Browser). They allow an attacker to present a fake address for a web page – which is a problem in the mobile world, where a URL is often the only verification of legitimacy that users have before navigating to a website.

“Mobile browsers are a pretty special sort of software that end up acting as a user’s multipass for all types of critical applications in their day-to-day life,” explained Rapid7 research director Tod Beardsley, in a blog post on Tuesday.
Click to expand...

Because of the lack of real estate for security indicators on the mobile screen, browsers usually block developers from altering anything in the address bar.
However, this group of bugs allows attackers to get around such protections.

“The bugs allow attackers to interfere with the timing between page loads and when the browser gets a chance to refresh the address bar,” said Baloch, in a technical paper also posted on Tuesday. “They can cause either a pop-up to appear to come from an arbitrary website or can render content in the browser window that falsely appears to come from an arbitrary website.”
Click to expand...

Rapid7: Vulntober: Multiple Mobile Browser Address Bar Spoofing Vulnerabilities

Today, we're announcing a coordinated vulnerability disclosure publication with our longtime mobile hacker friend, Rafay Baloch. If you'd like to just jump straight to the technical details for these vulnerabilities, I invite you to read his paper here. If you want to know more about why this vulnerability class matters, read on!
Click to expand...

Log in or Sign up

Address Bar Spoofing Vulnerabilities affect a number of Mobile Browsers

guest Guest

Log in or Sign up

Address Bar Spoofing Vulnerabilities affect a number of Mobile Browsers

guest Guest

Useful Searches