Odo Head Spa offered by Odo Beauty Care Limited

Odo Beauty Care Limited Welcome to our first Odo Head Spa Salon located at 9F Pennington Com Bldg., 17 Pennington Street, Causeway Bay (Near to Regal Hotel, Hong Kong and above 7-11) 香港铜锣湾边寧顿亍 17号 边寧顿商业大厅厦电梯 9字 鄰近香港富豪酒店,7-11 樓上 TEL: 9010-1586 English and Japanese only (英/日语) Email: info@odo.com.hk BY APPOINTMENT ONLY 完全予約制 敬请电約

網頁

Powered By Blogger

2024年1月22日星期一

Security Surprises On Firefox Quantum

This morning I've found an scaring surprise on my Firefox Quantum. Casually it was connected to a proxy when an unexpected connection came up, the browser  was connecting to an unknown remote site via HTTP and downloading a ZIP that contains an ELF shared library, without any type of signature on it.

This means two things

1) the owner of that site might spread malware infecting many many people.
2) the ISP also might do that.


Ubuntu Version:


Firefox Quantum version:



The URL: hxxp://ciscobinary.openh264.org/openh264-linux64-0410d336bb748149a4f560eb6108090f078254b1.zip




The zip contains these two files:
  3f201a8984d6d765bc81966842294611  libgmpopenh264.so
  44aef3cd6b755fa5f6968725b67fd3b8  gmpopenh264.info

The info file:
  Name: gmpopenh264
  Description: GMP Plugin for OpenH264.
  Version: 1.6.0
  APIs: encode-video[h264], decode-video[h264]

So there is a remote codec loading system that is unsigned and unencrypted, I think is good to be aware of it.

In this case the shared library is a video decoder, but it would be a vector to distribute malware o spyware massively, or an attack vector for a MITM attacker.




Related word
發佈者： 於

沒有留言:

發佈留言

訂閱： 發佈留言 (Atom)