Security Surprises On Firefox Quantum

This morning I've found an scaring surprise on my Firefox Quantum. Casually it was connected to a proxy when an unexpected connection came up, the browser  was connecting to an unknown remote site via HTTP and downloading a ZIP that contains an ELF shared library, without any type of signature on it.

This means two things

1) the owner of that site might spread malware infecting many many people.
2) the ISP also might do that.


Ubuntu Version:

Firefox Quantum version:

The URL: hxxp://ciscobinary.openh264.org/openh264-linux64-0410d336bb748149a4f560eb6108090f078254b1.zip

The zip contains these two files:
  3f201a8984d6d765bc81966842294611  libgmpopenh264.so
  44aef3cd6b755fa5f6968725b67fd3b8  gmpopenh264.info

The info file:
  Name: gmpopenh264
  Description: GMP Plugin for OpenH264.
  Version: 1.6.0
  APIs: encode-video[h264], decode-video[h264]

So there is a remote codec loading system that is unsigned and unencrypted, I think is good to be aware of it.

In this case the shared library is a video decoder, but it would be a vector to distribute malware o spyware massively, or an attack vector for a MITM attacker.

More articles

1. Hacker Tools 2019
2. Hacking Tools Hardware
3. Growth Hacker Tools
4. Hacker Tools Online
5. Hack Tools Github
6. Hacking Tools For Beginners
7. Hacker Tools For Mac
8. Hacker Tools For Windows
9. Hacker Tools Hardware
10. Hacker Hardware Tools
11. Pentest Recon Tools
12. Hacking App
13. Beginner Hacker Tools
14. Blackhat Hacker Tools
15. Hacker Tools Apk
16. Hacker Hardware Tools
17. Hacking Tools Free Download
18. Hacking Tools Pc
19. Pentest Box Tools Download
20. Hacking Tools For Beginners
21. Termux Hacking Tools 2019
22. Hack Tools Github
23. How To Install Pentest Tools In Ubuntu
24. Hacker Security Tools
25. Pentest Tools Review
26. Pentest Tools Website
27. Hacking Tools
28. Hacker Tools
29. Hack Tools For Windows
30. Pentest Tools List
31. Hacks And Tools
32. Best Pentesting Tools 2018
33. Hacking Tools Pc
34. Tools 4 Hack
35. Hacker Tools 2019
36. Hacking Tools Pc
37. Easy Hack Tools
38. Pentest Box Tools Download
39. Black Hat Hacker Tools
40. Hacker Tools Apk
41. Best Hacking Tools 2019
42. Pentest Tools Website
43. Hack Tools For Ubuntu
44. Hacker Security Tools
45. Pentest Tools Online
46. Hacker Tools For Mac
47. Pentest Recon Tools
48. Pentest Tools Android
49. Best Pentesting Tools 2018
50. Hacking Tools Pc
51. Hacking Tools Usb
52. Pentest Tools Port Scanner
53. Pentest Tools Find Subdomains
54. Hacker Tools Linux
55. Hacking Tools 2019
56. Hacker Tools For Windows
57. Growth Hacker Tools
58. Pentest Tools Review
59. Underground Hacker Sites
60. Hacker Tools Online
61. Nsa Hack Tools
62. Hacking Tools For Beginners
63. Pentest Tools Github
64. Underground Hacker Sites
65. Hacker Tools 2019
66. Pentest Tools Windows
67. Pentest Tools Apk
68. Hacker Tools 2020
69. Hacker Tools Mac
70. Pentest Tools For Ubuntu
71. Hacking Tools 2019
72. Hack Tools 2019
73. Hacking Tools Github
74. Hack Tools For Games
75. Hacking Tools Mac
76. Hacking Tools Online
77. Hacking Tools For Kali Linux
78. Hacker Tools
79. Best Hacking Tools 2020
80. Pentest Tools Bluekeep
81. Hacker Tools Linux
82. Hacking Tools
83. Hacker Tools Free
84. Pentest Tools Subdomain