Firefox bug lets you hijack nearby mobile browsers via WiFi

guest · Sep 21, 2020

Firefox bug lets you hijack nearby mobile browsers via WiFi
Mozilla says users should update as soon as possible to Firefox v79 for Android
September 18, 2020
https://www.zdnet.com/article/firefox-bug-lets-you-hijack-nearby-mobile-browsers-via-wifi/

Mozilla has fixed a bug that can be abused to hijack all the Firefox for Android browsers on the same WiFi network and force users to access malicious sites, such as phishing pages.
The bug was discovered by Chris Moberly, an Australian security researcher working for GitLab.

The actual vulnerability resides in the Firefox SSDP component. SSDP stands for Simple Service Discovery Protocol and is the mechanism through which Firefox finds other devices on the same network in order to share or receive content (i.e., such as sharing video streams with a Roku device).
Click to expand...

Sample exploitation scenario
To better understand how this bug could be weaponized, imagine a scenario where a hacker walks into an airport or mall, connects to the WiFi network, and then launches a script on their laptop that spams the network with malformed SSDP packets.

Any Android owner using a Firefox browser to navigate the web during this kind of attack would have his mobile browser hijacked and taken to a malicious site, or forced to install a malicious Firefox extension.
Earlier this week, Moberly published proof-of-concept code that could be used to carry out such attacks.
Click to expand...

ESET: Mozilla fixes flaw that let attackers hijack Firefox for Android via Wi‑Fi

Attackers could have exploited the flaw to steal victims’ login credentials or install malware on their devices
Click to expand...

reasonablePrivacy · Sep 22, 2020

I had 80-beta installed and updated to 81-beta after reading this.

Log in or Sign up

Firefox bug lets you hijack nearby mobile browsers via WiFi

guest Guest

reasonablePrivacy Registered Member

Log in or Sign up

Firefox bug lets you hijack nearby mobile browsers via WiFi

guest Guest

reasonablePrivacy Registered Member

Useful Searches