Puffin Web Browser Pop Up Recursion Vulnerability - DOS

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh-wRCidSZEw9Zmc6fpWfFhJ9u8OAhDXYFasaGcpQcL1S7zwgetOlKbfxvb0X6fHXoFS4i5cVNBTo0wwmfw-QuvotoTHXwrXNRUaeAQU0AKAxhNVigQGBBIAnrVf2x_Z968UrZwT__9xfk/s1600/mzl.lomvgfho.png" imageanchor="1" style="background-color: white; color: #666666; font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px; margin-left: 1em; margin-right: 1em; text-decoration: none;"><img border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh-wRCidSZEw9Zmc6fpWfFhJ9u8OAhDXYFasaGcpQcL1S7zwgetOlKbfxvb0X6fHXoFS4i5cVNBTo0wwmfw-QuvotoTHXwrXNRUaeAQU0AKAxhNVigQGBBIAnrVf2x_Z968UrZwT__9xfk/s1600/mzl.lomvgfho.png" style="border-width: 0px; padding: 10px;" width="320" /></a></div><table><tbody><tr><td class="webkit-line-number" value="1"></td><td class="webkit-line-content"><span class="webkit-html-tag">During my recent security research on "<b>Puffin Web Browser</b>" I found several security bugs with "<b>Puffin Web Browser</b>" ranging from low to high risk issues. My recent post "<a href="http://www.rafayhackingarticles.net/2014/07/puffin-web-browser-address-bar-spoofing.html" target="_blank">Puffin Web Browser Address Bar Spoofing</a>" already talked about a high risk vulnerability inside Puffin Web browser. </span><br /><span class="webkit-html-tag"><br /></span><span class="webkit-html-tag">However, today I would like to discuss about a low/medium risk issue known as "<b>Pop Up Recursion</b>" vulnerability resulting in a Denial Of Service. This is a known issue and in past has been already addressed in browsers such as Google Chrome, however Puffin Web Browser is still affected by the issue.  </span><br /><a name='more'></a><br /><h4>Vulnerability</h4>The vulnerability occurred due to mishandling of location.reload function, as it keeps reloading the document, however the issue more likely is present inside of not limiting the pop ups or simply offering no way to ignore further prompts. <br /><span class="webkit-html-tag"><b><br />Expected Result</b></span><br /><span class="webkit-html-tag"><b><br /></b>Puffin Web Browser should have opened a new window with single alert box.<br /><b><br />What actually happened? </b></span><br /><span class="webkit-html-tag"><br /></span><span class="webkit-html-tag">Puffin Web Browser recursively opens up new window on pressing the ok button and there is no way to prevent the page from creating additional pop ups just like Chrome, IE etc. </span><br /><b><br /></b><span class="webkit-html-tag"><b>Puffin Web Browser</b></span><br /><div class="separator" style="clear: both; text-align: center;"><br /></div><span class="webkit-html-tag"></span><br /><div class="separator" style="clear: both; text-align: center;"><span class="webkit-html-tag"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgqNQ8Hjr6yQHSF86P7w7q8FedQJ-xtiGBboWmkag9ow7fdvqcbsVZHCIA7426byNfZEFuiXhvSk5v-tPXdq3KSxB8twLqSoH1hRZFDI3ZLGnS_vTwvR5zV_MHhs7vSV_5fd9m0HVPcWZk/s1600/Screenshot_2014-07-17-09-53-47.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="157" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgqNQ8Hjr6yQHSF86P7w7q8FedQJ-xtiGBboWmkag9ow7fdvqcbsVZHCIA7426byNfZEFuiXhvSk5v-tPXdq3KSxB8twLqSoH1hRZFDI3ZLGnS_vTwvR5zV_MHhs7vSV_5fd9m0HVPcWZk/s1600/Screenshot_2014-07-17-09-53-47.png" width="320" /></a></span></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: left;">On pressing the "OK" button, it would reload the copy a current document in a new tab, on pressing "OK" on the second window, it would reload another copy of the current document in a new tab, this would keep growing until the browser finally crashes. </div><div class="separator" style="clear: both; text-align: center;"><span class="webkit-html-tag"><br /></span></div><div class="separator" style="clear: both; text-align: left;"><span class="webkit-html-tag"><b>Chrome</b></span></div><br /><div class="separator" style="clear: both; text-align: center;"><span class="webkit-html-tag"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhgXeZXD6se-N8cMfeEckB51FKUqTbqZIE8RunXieDne_-HG7D6xLmlxPyrkzFjDVmbPPiJs-FsrQosAi01upjKnAMuShZjOdTEdwg2VAjJZLnRVVfCW-FTaIk6oAZtU63KmESti832N7Q/s1600/Screenshot_2014-07-17-09-53-31.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="194" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhgXeZXD6se-N8cMfeEckB51FKUqTbqZIE8RunXieDne_-HG7D6xLmlxPyrkzFjDVmbPPiJs-FsrQosAi01upjKnAMuShZjOdTEdwg2VAjJZLnRVVfCW-FTaIk6oAZtU63KmESti832N7Q/s1600/Screenshot_2014-07-17-09-53-31.png" width="320" /></a></span></div><br />In "Chrome" for android, this effect is limited by offering a checkbox to prevent the current document from creating additional dialogs.<br /><br /><h4>POC</h4><span style="font-weight: normal;">The following is the simple proof of concept:</span><br /><div><div><b><html></b></div><div><b><title>Puffin Web Browser Pop Up Recursion DOS</title></b></div><div><b><body></b></div><div><b><script></b></div><div><b>window = <span style="color: #cc0000;">window.open(location.reload('http://rafayhackingarticles.net'));</span></b></div><div><b>window.alert(window)</b></div><div><b></script></b></div><div><b></body></b></div><div><b></html></b></div></div></td></tr></tbody></table><h4>Fix</h4>Puffin Web Browser team has acknowledged the issue and have promised to fix them in next versions.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhZ84xUI9Q0cQMY3mxSBvN3Sr6WMcaiqU8QNlAG4d-Ujfn6mnaF1fs8pNoltcrPrtOqWEeecGWFavzwS0Uz7TeU-nbQ3uQ_DAaxZfvO0RSfrQpBH_0ZH75_gPBSxcIE_6d05WH9xBjO07w/s1600/dos.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="180" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhZ84xUI9Q0cQMY3mxSBvN3Sr6WMcaiqU8QNlAG4d-Ujfn6mnaF1fs8pNoltcrPrtOqWEeecGWFavzwS0Uz7TeU-nbQ3uQ_DAaxZfvO0RSfrQpBH_0ZH75_gPBSxcIE_6d05WH9xBjO07w/s1600/dos.png" width="577" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: left;"><br /></div><br /></div>

Puffin Web Browser Pop Up Recursion Vulnerability - DOS

During my recent security research on " Puffin Web Browser " I found several security bugs with " Puffin Web Browser " r...

+ Read more »

Puffin Web Browser Address Bar Spoofing Vulnerability

<div dir="ltr" style="text-align: left;" trbidi="on"><div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh-wRCidSZEw9Zmc6fpWfFhJ9u8OAhDXYFasaGcpQcL1S7zwgetOlKbfxvb0X6fHXoFS4i5cVNBTo0wwmfw-QuvotoTHXwrXNRUaeAQU0AKAxhNVigQGBBIAnrVf2x_Z968UrZwT__9xfk/s1600/mzl.lomvgfho.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh-wRCidSZEw9Zmc6fpWfFhJ9u8OAhDXYFasaGcpQcL1S7zwgetOlKbfxvb0X6fHXoFS4i5cVNBTo0wwmfw-QuvotoTHXwrXNRUaeAQU0AKAxhNVigQGBBIAnrVf2x_Z968UrZwT__9xfk/s1600/mzl.lomvgfho.png" width="320" /></a></div><br />During my recent research on Mobile browsers i have managed to find couple of interesting vulnerabilities such as SOP bypass, Denial of service and Address bar spoofing vulnerability which are worth doing a writeup. However, In the following writeup I would discuss about an "<b>Address Bar Spoofing Vulnerability</b>" present inside of a well known mobile browser for both Android and iOS known as <b>"Puffin Web Browser". </b><br /><a name='more'></a><br /><h4>Description</h4>Let's take a look at an official description of Puffin Web Browser.<br /><br /><i>Puffin Web Browser is a wicked fast Mobile Flash Browser. Once users experience the thrill of using Puffin, regular Mobile Internet just feels like torture. Puffin Free is the free version of Puffin family, and supports Adobe Flash during the daytime everyday</i>. Puffin Web Browser comes into two different flavours, a free version and a paid version.<br /><h4>Popularity </h4>According to recent stats by <a href="https://play.google.com/store/apps/details?id=com.cloudmosa.puffin&hl=en" rel="nofollow" target="_blank">Google play</a>, the approximate installs for "Puffin Web Browser Free" are some where between the range of 5 Million to 10 Million installs.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhzBDnD6BM_LTYqbXp639dtpgaXhrTkvA4dj8u2u3pDZfMpKD2G4KRAWxUj1VegQTp8N0SSk7PtGI8WZ9KY2vgI9fQaZZbYLSid400g_7b7UNguxjReot-Pn9-1riu40pWK7V9SSHNFlXI/s1600/aaa.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="104" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhzBDnD6BM_LTYqbXp639dtpgaXhrTkvA4dj8u2u3pDZfMpKD2G4KRAWxUj1VegQTp8N0SSk7PtGI8WZ9KY2vgI9fQaZZbYLSid400g_7b7UNguxjReot-Pn9-1riu40pWK7V9SSHNFlXI/s1600/aaa.png" width="577" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: left;">Whereas, according to another popular Android market "<a href="http://www.mobogenie.com/apps/index.html" rel="nofollow" target="_blank">Mobogenie</a>", the approximate installs for "Puffin Web Browser Free" are more than 5 Million. </div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEihE9oN0gWtmXZVMtsP9qTGZfpBPTCC6fPbnNOm28QDbKNPmGnS2VmQYo6xiry-TyBHih2oLqK3J9RRTzgoOPtVCJTHkdtl1PDcE0Gj5PfzM8khGvvRnzSIVlSNzc5ktmVUmvawgqlokic/s1600/Untitled.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="136" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEihE9oN0gWtmXZVMtsP9qTGZfpBPTCC6fPbnNOm28QDbKNPmGnS2VmQYo6xiry-TyBHih2oLqK3J9RRTzgoOPtVCJTHkdtl1PDcE0Gj5PfzM8khGvvRnzSIVlSNzc5ktmVUmvawgqlokic/s1600/Untitled.png" width="577" /></a></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><u>This makes the total userbase of Puffin Web Browser more than 10 million</u>.</div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"></div><h4>Vulnerability</h4></div><div class="separator" style="clear: both; text-align: left;">An "Address Bar Spoofing" vulnerability was addressed in "Puffin Web Browser" due to mishandling of javaScript's window.open function which is used to open a secondary browser window. This could be exploited by tricking the users into supplying senstive information such as username/passwords etc due to the fact that the address bar would display a legitimate URL, however it would be hosted on the attacker's page. </div><div class="separator" style="clear: both; text-align: left;"></div><h4>Proof Of Concept</h4><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><div class="separator" style="clear: both; text-align: left;">The following piece of javaScript code was used as a proof of concept by modifying <b>"David Vieria's" </b> POC to suit our needs and to demonstrate the vulnerability to the vendor. </div><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><blockquote class="tr_bq" style="clear: both;"><script><br />document.getElementById('one').onclick = function() {<br />myWindow=window.open('http://rafayhackingarticles.net/','RHA','width=300,height=300,location=yes');<br />myWindow.document.write("<html><head></head><body><b>This page is still being hosted on rhainfosec.com, however the domain is pointing to rafayhackingarticles.net.</b><br><br><iframe src=\"http://www.rafayhackingarticles.net/\");></iframe></scri+pt></body></html>");<br />myWindow.focus();<br />return false;<br />}<br /></script></blockquote><br /><div class="separator" style="clear: both;"></div><div class="separator" style="clear: both;"><b>Steps To Reproduce</b></div><div class="separator" style="clear: both;"><br /></div><b>1) </b>Visit the following page from "Puffin Free Web Browser" -<b><a href="http://www.rhainfosec.com/test/" rel="" target="_blank">www.rhainfosec.com/test/</a></b><br /><b>2)</b> Click on the "demo" button.<br /><b>3) </b>A new window would pop up with the address bar pointing to <b>rafayhackingarticles.ne</b>t, however the page is still hosted on <b>rhainfosec.com. </b><br /><b><br /></b>In case of a real attack scenario, an attacker could create a fake login of facebook.com for instance and since the address bar would still be pointing to facebook.com, the victim would not<br /><h4>Demonstration</h4><iframe allowfullscreen="" frameborder="0" height="375" mozallowfullscreen="" src="//player.vimeo.com/video/99202667" webkitallowfullscreen="" width="500"></iframe><br /><h4>Impact</h4>The impact in my opinion is huge since this vulnerability could be abused in launching targetted and more effective phishing attacks, <u>which places 10 million users at risk.</u><br /><h4>Fix</h4>The vulnerability was submitted on 10'th of june, I received an initial response that they would let us know about the schedule, however after multiple emails, we didn't receive any response. Therefore, I decided to go for full disclosure and urge the users to beware.<br /><div class="separator" style="clear: both; text-align: center;"></div><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhXspcDBjGUx29MEZZPP07cO08SUaWPSvDPJbGGnnMNhG_lrubCR-cC3tTYOul6XHs3W-ohYjced6X5Y6UudjCQdzhNiCakwFx7gMBXkXGukRvpl8keCjZ98pG8Wt_Nl3qiGMCahtKjPiI/s1600/Untitled.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="284" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhXspcDBjGUx29MEZZPP07cO08SUaWPSvDPJbGGnnMNhG_lrubCR-cC3tTYOul6XHs3W-ohYjced6X5Y6UudjCQdzhNiCakwFx7gMBXkXGukRvpl8keCjZ98pG8Wt_Nl3qiGMCahtKjPiI/s1600/Untitled.png" width="577" /></a></div><div class="separator" style="clear: both; text-align: left;">As mentioned before, I have found several other vulnerabilities in mobile browsers, as soon as they get fixed I would blog about it. Kudos to<b> David Vieria</b> for his guidance. </div><h4>Timeline</h4><b>6/10/2014</b> - I reported the vulnerability.<br /><b>6/13/2014 </b>- Initial response.<br /><b>6/26/2014</b> - I asked again if they are willing to fix it.<br /><b>7/14/2014 </b>- Blogged about this issue.  </div>

Puffin Web Browser Address Bar Spoofing Vulnerability

During my recent research on Mobile browsers i have managed to find couple of interesting vulnerabilities such as SOP bypass, Denial of serv...

+ Read more »

Nokia Asha Series Lock Screen Bypass

<div dir="ltr" style="text-align: left;" trbidi="on"><div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhA9rYaVkzDro8o6BXcCID0aSxlYBdWGKeV91blW9CpozTM1hdii5zRfTBtvV-_Wud03f0au1Vd-18EJ9fDPcjwSXawPi5BpQqKIO4cjU-1gwmbaXBTRvJUMpE0ONz7_a9BZjK43F0vL3A/s1600/296216,xcitefun-nokia-asha-311-2.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="284" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhA9rYaVkzDro8o6BXcCID0aSxlYBdWGKeV91blW9CpozTM1hdii5zRfTBtvV-_Wud03f0au1Vd-18EJ9fDPcjwSXawPi5BpQqKIO4cjU-1gwmbaXBTRvJUMpE0ONz7_a9BZjK43F0vL3A/s1600/296216,xcitefun-nokia-asha-311-2.jpg" width="320" /></a></div><br />There have been a lot of lock screen bypasses lately in almost every mobile deice such as iPhone, Samsung galaxy, HTC etc and if you observe carefully most of them rely upon abusing the "<b>Emergency Calling</b>" option some how. <b>Hammad Shamsi</b> a Security researcher from RHAinfoSec has found a lockscreen bypass which resides in all the latest versions of Nokia Asha series. The bypass occurred due to mishandling of SOS button (Emergency Panic Button) which is present in all Nokia Asha Series and is used to perform the emergency calls.<br /><a name='more'></a><h4>How to Reproduce?</h4></div>Here are the steps to reproduce, in case you are curious:<br /><br /><b>i)</b> First, set up the lock code to lock the screen.<br /><b>ii)</b> Next, type any number on the unlock screen.<br /><b>iii) </b>Next, press the SOS button followed the green button and you are sent to recent call lists.<br /><br />This could be furthur abused into gaining complete phonebook access, add/delete a number, turning bluetooth on/off etc. <b>Hammad</b>, has created a series of three video which demonstrates how you could go about accomplishing it.<br /><h4>Nokia Asha Lock Screen Bypass - Video #1</h4><br /><iframe allowfullscreen="" frameborder="0" height="667" mozallowfullscreen="" src="//player.vimeo.com/video/100345598" webkitallowfullscreen="" width="500"></iframe><br /> <h4>Nokia Asha Lock Screen Bypass - Video #2</h4><br /><iframe allowfullscreen="" frameborder="0" height="667" mozallowfullscreen="" src="//player.vimeo.com/video/100345603" webkitallowfullscreen="" width="500"></iframe><br /><h4>Nokia Asha Lock Screen Bypass - Video #3</h4><iframe allowfullscreen="" frameborder="0" height="750" mozallowfullscreen="" src="//player.vimeo.com/video/100345604" webkitallowfullscreen="" width="500"></iframe> <br /><br /><h4>Reward</h4>Hammad was awarded Nokia Lumia 1520, though mobile bugs are not a part of their bug bounty programs, however an exception was made while taking the impact of the bug in location.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiM_0bhSW6LTFVJcVuThYkA3MAZBA-8K0gKyrKEmh0MyecTLbKqs_u9VVcMqovbvnyD1BCDfvDqJ01xgifl6627d3LgP65SLx98cDdjBbHNYxZ4N9w4P87GDM9_gFViiJ3Y2TH60oVg-WY/s1600/10536599_10204654169533824_1587056244_n.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="640" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiM_0bhSW6LTFVJcVuThYkA3MAZBA-8K0gKyrKEmh0MyecTLbKqs_u9VVcMqovbvnyD1BCDfvDqJ01xgifl6627d3LgP65SLx98cDdjBbHNYxZ4N9w4P87GDM9_gFViiJ3Y2TH60oVg-WY/s1600/10536599_10204654169533824_1587056244_n.jpg" width="462" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: left;">I on behalf of all RHAinfoSec Team members would like to congratulate him and would like to wish him best of luck for future researches. </div><h4>Timeline</h4><b>25/04/14 - </b>The vulnerability was reported.<br /><b>30/04/14  - </b>Initial response from Nokia notifying that they are working on a fix.<br /><b>1/06/14  - </b>Nokia lumia was received.<br /><b>7/07/14  - </b>The issue was fixed.<br /><b>7/12/2014 - </b>Writeup was released. </div>

Nokia Asha Series Lock Screen Bypass

There have been a lot of lock screen bypasses lately in almost every mobile deice such as iPhone, Samsung galaxy, HTC etc and if you observe...

+ Read more »