1897585 - leak/inject sensitive user info in memory

Status: RESOLVED DUPLICATE of bug 298539

(Core :: Security, defect)

Description

[:0xbytecode]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Steps to reproduce:

• 1 create a piece of code to open and read/w memory for firefox with ability to insert pb (im using cheat engine to short time)
  -2 freeze the browser with injecting a bp (on user submit clicked)
  -3 loop over all possible memory locations and grep any sensitive data (can be use filter for only inputs memory loations -im using compare to show the poc as quick as possible- )
  and ya so with this small instructions attacker will steal users data including financial or anything , even saved at browser or not saved all data ongoing http requests will be captured , all in memory will be extracted

Actual results:

steal sensitive data with exploiting realtime click to pause all browser instructions to secure data and leak data to attacker before data get processed,encrypted , or ..

Expected results:

it should be the data get saved in memory in encrypted cotext so if attacker steal it he can't decrypt back .

Comment 1

[:0xbytecode]

Attachment: poc.mp4

poc

Comment 2

[Andrew McCreight [:mccr8]]

Firefox, like most programs, is not designed to defend against an attack with arbitrary memory read capabilities in all of its processes. What we do have is site isolation, which stores web content for different sites in different sandboxed processes, which means that achieving arbitrary read in a single content process should not be sufficient to steal data from another website.

Comment 3

[:0xbytecode]

sorry u didn't get my pov im not talking about steal data from another website., im talking that attacker can create a malware that will execute on user system with someway he get access to users' computer , should firefox encrypt all sensitive data for user and decrypt back on use time only .

in the poc i showed how a malware will be able to steal users credentials , or form request , web injects in memory , if it was encrypted at least in use time to decrypt only it wasn't will lead users data to be compromised , i hope u understand my point .

if u didn't get me , u may know zeus malware or any banking malware , that are very dangerious for users safety , so any developer can create
simple piece of code to read all firefox process pids and get any potential sensitive info .

u probably didn't understand me well, hope u did now ; sorry for bad english

Comment 4

[Andrew McCreight [:mccr8]]

If somebody has full access to your computer, they can also steal all of your cookies, record all of your keystrokes, and possibly replace Firefox with their own malware version. If Firefox can encrypt and decrypt the data, then surely any attacker with this level of access can also do the same. Making things slightly more annoying for an attacker with complete access to your machine is not going to improve security, but it would have a significant cost in terms of performance and engineering.

Comment 5

[:0xbytecode]

its not the point , yes he can steal ur data if has access without need a bug in firefox , but the point for mass victims he can't !
keystrokes , cookies , saved pass, cc stealers tools cannot perform http request capturing , it requires a 0day in ssl/tls , or in firefox to inject proxy , certificate to decrypt .
both keystrokes of saved data doesn't give attackers full sensitive data for victims ,
for example keystrokes is not exact method which will include many uselss stuff , and highly detected By AV , EDRS
for saved data, not all people save their data , and some store them cloudly like 1pass ..etc , and highly detected by av,edr , so useless method for real advanced attack .

actionaly i submitted this report to show the ability to steal all http forms (until tls encrypted) that surely will include sensitive information.
also with ability to inject the forms so it will lead in different responses .
and surely they can inject the response body too , to lead users perform fake payments, trasictions..

hope u take this notes in ur mind , im sure u don't know much about malwares , u have take my advice check what zeus is or tinynuke or spyeye
both of them used some like methods of this and they r patched now , if they wasn't threat as u say , they wasn't be fixed now . and sure there all
lot of backdoors but no one heard of them why ? bcz not same as examples i told u about .

u should mark this as critical flaw , and fix .. otherwise i still able to sell it in raidforums or whatever .

im strongly not agreeing ur decition .
my kinda greets ,

Comment 7

[Yannis Juglaret [:yannis]]

Thanks for reporting your concerns. Here are a few questions that I hope can explain why this does not seem relevant to us, unless you have good answers for them.

(In reply to :0xbytecode from comment #0)

so if attacker steal it he can't decrypt back .

Where would you store the encryption key to ensure that this attacker cannot decrypt the data? And how would you make sure that the decrypted data cannot be read by the attacker at the point where Firefox decrypts the data?

(In reply to :0xbytecode from comment #5)

both of them used some like methods of this and they r patched now
if they wasn't threat as u say , they wasn't be fixed now . and sure there all

Do you have evidence of anything being fixed at browser level though?

(In reply to :0xbytecode from comment #5)

highly detected By AV , EDRS
highly detected by av,edr

As you say, AV and EDR are responsible for detecting and mitigating malicious activity from software running on your computer. So why are you reporting this here? If you found some way to write malware that is not detected by AV and EDR, shouldn't this be reported to AV and EDR companies instead?