Security Surprises On Firefox Quantum

This morning I've found an scaring surprise on my Firefox Quantum. Casually it was connected to a proxy when an unexpected connection came up, the browser  was connecting to an unknown remote site via HTTP and downloading a ZIP that contains an ELF shared library, without any type of signature on it.

This means two things

1) the owner of that site might spread malware infecting many many people.
2) the ISP also might do that.


Ubuntu Version:

Firefox Quantum version:

The URL: hxxp://ciscobinary.openh264.org/openh264-linux64-0410d336bb748149a4f560eb6108090f078254b1.zip

The zip contains these two files:
  3f201a8984d6d765bc81966842294611  libgmpopenh264.so
  44aef3cd6b755fa5f6968725b67fd3b8  gmpopenh264.info

The info file:
  Name: gmpopenh264
  Description: GMP Plugin for OpenH264.
  Version: 1.6.0
  APIs: encode-video[h264], decode-video[h264]

So there is a remote codec loading system that is unsigned and unencrypted, I think is good to be aware of it.

In this case the shared library is a video decoder, but it would be a vector to distribute malware o spyware massively, or an attack vector for a MITM attacker.

Related posts

1. Herramientas Hacking Android
2. Hacking Etico Certificacion
3. Hacking To The Gate Lyrics
4. Pagina Hacker
5. Aprender Hacking Desde Cero
6. Ingeniería Social. El Arte Del Hacking Personal Pdf
7. Elladodelmal
8. Software Hacking
9. Growth Hacking Pdf
10. Cosas De Hackers
11. Como Aprender A Ser Hacker
12. Hacking Growth Sean Ellis
13. Que Es Growth Hacking
14. Libros De Hacking Pdf
15. Google Hacking Database
16. Como Hacer Hacker