Security Surprises On Firefox Quantum

This morning I've found an scaring surprise on my Firefox Quantum. Casually it was connected to a proxy when an unexpected connection came up, the browser  was connecting to an unknown remote site via HTTP and downloading a ZIP that contains an ELF shared library, without any type of signature on it.

This means two things

1) the owner of that site might spread malware infecting many many people.
2) the ISP also might do that.


Ubuntu Version:

Firefox Quantum version:

The URL: hxxp://ciscobinary.openh264.org/openh264-linux64-0410d336bb748149a4f560eb6108090f078254b1.zip

The zip contains these two files:
  3f201a8984d6d765bc81966842294611  libgmpopenh264.so
  44aef3cd6b755fa5f6968725b67fd3b8  gmpopenh264.info

The info file:
  Name: gmpopenh264
  Description: GMP Plugin for OpenH264.
  Version: 1.6.0
  APIs: encode-video[h264], decode-video[h264]

So there is a remote codec loading system that is unsigned and unencrypted, I think is good to be aware of it.

In this case the shared library is a video decoder, but it would be a vector to distribute malware o spyware massively, or an attack vector for a MITM attacker.

More info

• Pentest Recon Tools
• Hacking Tools Software
• Hacker Tools For Mac
• Pentest Tools For Ubuntu
• Game Hacking
• Hacks And Tools
• Hacker Tools Windows
• Pentest Tools Apk
• Hacker Tools For Mac
• Pentest Tools Subdomain
• Hacker Tools Apk
• Hacker Techniques Tools And Incident Handling
• Pentest Tools Website Vulnerability
• Hacker Hardware Tools
• Hacking Tools Usb
• Best Pentesting Tools 2018
• What Are Hacking Tools
• Physical Pentest Tools
• Hacker Tools For Pc
• Hacker Tools
• Github Hacking Tools
• Hacker Tool Kit
• Hacking Tools For Windows Free Download
• Hacks And Tools
• Pentest Tools Bluekeep
• Hacking Tools Software
• Pentest Recon Tools
• Free Pentest Tools For Windows
• Computer Hacker
• Hacker Tools 2019
• Hack Tools Mac
• Pentest Tools Review
• Hacking Tools For Kali Linux
• Hacking Tools For Games
• Hack App
• Pentest Box Tools Download
• Hacker Hardware Tools
• Pentest Tools Subdomain
• Pentest Tools For Ubuntu
• Tools 4 Hack
• Black Hat Hacker Tools
• Hackrf Tools
• Hacking Tools Github
• Computer Hacker
• Pentest Tools List
• Pentest Tools Online
• Termux Hacking Tools 2019
• Hacking Tools Windows
• Nsa Hack Tools
• Easy Hack Tools
• Hacker Tools Hardware
• Hacking Tools And Software
• Hacking Tools Name
• Hacker Tools Online
• Underground Hacker Sites
• Hacker Tool Kit
• Pentest Tools Alternative
• Pentest Tools Windows
• Hacker Tools Github
• Pentest Tools Review
• Hackers Toolbox
• Hacking Tools 2020
• New Hacker Tools