Today, the team at v12 released a video showing a PoC of Universal Account Takeover affecting Firefox Focus of iOS version.

4 months ago by AmmarSpaces to c/firefox

Today, the team at v12 released a video showing a PoC of Universal Account Takeover affecting Firefox Focus of iOS version.

The PoC were released because it is been almost a year the vuln reported, but it is not patched yet.

The video below is demonstration of the vulnerability. We can see that,your X, Google, Reddit, can be taken over only in one click of a link.

Vulnerability explanation and the partly PoC can be seen here:
https://github.com/...

@firefox

#cybersecurity #infosec #0day #firefox

moonpiedumplings 21 points 4 months ago

This is bad, but I don't really care.

On iOS, all browsers are forced to use the safari/webkit browser engine, which simply isn't as modern in terms of security as actual firefox. There is a reason this bug only affects firefox on iOS, and that's probably why.

Blame Apple. Not Mozilla.

save

path: 0 24164426, hotness: undefined, score: 21, children: 1

XLE 2 points 4 months ago

This is absolutely on Mozilla.

First and foremost, Mozilla knew the bug was present for 11 months and they failed to fix it. They should have pulled the plug on the app, plain and simple.

The linked document is explicit that it is most likely the way Firefox Focus is engineered that allows the exploit to occur.

And you said it yourself: every iOS browser is WebKit. But obviously only this one browser was coded poorly.

save

path: 0 24164426 24166941, hotness: undefined, score: 2, children: 0

mannycalavera 6 points 4 months ago

Aren't all browsers on IOS simply Safari on a wrapper because Apple are cunts? So is this a Firefox wrapping thing? Or a shitty Apple thing?

save

path: 0 24165367, hotness: undefined, score: 6, children: 3

XLE 2 points 4 months ago

It's a Firefox Focus for iOS exclusive:

Firefox Focus is a single-window browser with no tab model. We believe that loading the next document into _self collapses the navigation into the same browsing context that already holds the previous origin, and the race condition then exploits the resulting ambiguity about which origin the committed navigation belongs to. Opening in any other target breaks the origin-inheritance behavior and the attack fails.

save

path: 0 24165367 24166965, hotness: undefined, score: 2, children: 2

victorz 1 point 4 months ago

Firefox Focus doesn't have tabs on iOS? It does on Android.

save

path: 0 24165367 24166965 24175373, hotness: undefined, score: 1, children: 1

XLE 1 point 4 months ago

Apparently, Focus shipped on Android in single window mode too, but they enabled tabs in 2017.

save

path: 0 24165367 24166965 24175373 24175675, hotness: undefined, score: 1, children: 0

snoozzze 2 points 4 months ago

@AmmarSpaces @firefox this seems pretty bad :O

save

path: 0 24163398, hotness: undefined, score: 2, children: 3

AmmarSpaces 3 points 4 months ago

@snoozzze @firefox Yeah, it is pretty bad.

Funny that their use of Mythos didn't fix this vuln, or maybe they only care about their computer Web Browser.

😩

save

path: 0 24163398 24163403, hotness: undefined, score: 3, children: 2

slazer2au 0 points 4 months ago

Because the iOS version of Firefox uses WebKit not Geko. You can blame Apple for the walled garden full of holes for this.

save

path: 0 24163398 24163403 24165209, hotness: undefined, score: 0, children: 1

XLE 7 points 4 months ago

The bug isn't in any other WebKit browser.

save

path: 0 24163398 24163403 24165209 24166973, hotness: undefined, score: 7, children: 0