1489950 - Firefox Focus for Android v6.1.1 allow attackers to modify apps without affecting their signature

Status: RESOLVED FIXED

(Focus :: General, defect)

Description

[Bean3ai]

Attachment: fiefox Focus.jpg

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36

Steps to reproduce:

Checking the Firefox for Android App`s signature information, I notice that Firefox Focus for Android v6.1.1 is using signature scheme version 1. App`s signature information screenshots attached.


Actual results:

It is a serious vulnerability that could allow attackers to modify installed apps without affecting their signature. This vulnerability (designated as CVE-2017-13156, and also called the Janus vulnerability) affects versions of Android from 5.1.1 to 8.0


Expected results:

For compatibility reasons, developer could use a mixed signature (version 1 and 2) scheme.

Comment 1

[Bean3ai]

Attachment: focus v1.jpg

Comment 2

[Kevin Brosnan [Ex-Mozilla]]

Good write up of the issue. The CVE database links don't do a good job of describing the vuln. https://blog.trendmicro.com/trendlabs-security-intelligence/janus-android-app-signature-bypass-allows-attackers-modify-legitimate-apps/

Comment 3

[:sdaswani]

will also wait for a rating from the security team before prioritizing this work.

Comment 4

[Daniel Veditz [:dveditz]]

ulfr: does your team/Autograph do the signing for android apps?

Comment 5

[Julien Vehent]

We do (at least for some). V2/V3 signature support is in the backlog. AAB adoption may impact this.

Comment 6

[Kevin Brosnan [Ex-Mozilla]]

This is release engineering work that is independent of GV. Possibly this bug should be moved to them?

Comment 7

[Liz Henry (:lizzard) (relman/hg->git project)]

Catlee can you help find someone in releng who might work on this?

Comment 8

[Chris AtLee [:catlee]]

as per comment #5, signing of Android apps is handled by Autograph. I think the work rests with :ulfr's team, unless we decide to bring signing back into something like a releng scriptworker.

Comment 9

[Greg G]

APK v2 and v3 sig support is a Q3 OKR for :ulfr

Comment 10

[Greg G]

Fixed for all APKs in bug 1613113 and bug 1669487