In an Collaborative effort, the Security firm Trend Micro and Social Networking Giant Facebook have found attacks generated due to exploitation of Android Same Origin Policy (SOP) Vulnerability, that Trend Micro discovered a few months back. Trend Micro says, they have found that the attacks are carried out on a much larger scale than they thought of to be earlier. The Android SOP vulnerability's code is believed to be based on available publicly available Metasploit Code.
According to Trend Micro Labs blog post,
"This attack targets Facebook users via a link in a particular Facebook page that leads to a malicious site. This page contains obfuscated JavaScript code (see in Figure 1 below), which includes an attempt to load a Facebook URL (seen in Figure 2) in an inner frame. The user will only see a blank page as the pages HTML has been set not to display anything via its div tag (Figure 3), while the inner frame has a size of one pixel (Figure 4)."
Figure 1. Malware code segment upon opening the Facebook page
Figure 2. Corresponding content of opened Facebook page
Figure 3. The main page is set to be invisible
Figure 4. The inner frame has a size of one pixelWhile these routines are being carried out, the SOP bypass is being performed. A remote JavaScript file is loaded from a legitimate cloud storage provider. This file contains the malicious code of this attack:
Figure 5. The malware code segment performs the SOP attack
The JavaScript code allows attackers to carry out the following activities or routines on Facebook:
- Add friends
- Like and follow Facebook pages
- Modify subscriptions
- Authorize a Facebook app to access the users public profile, friends list, birthday information, likes and friends likes
- Steal the victim's access tokens and upload them to their server at http://{BLOCKED}martforchristmas.website/walmart/j/index.php?cid=544fba6ac6988&access_token= $token;
- Collect analytics data (such as victims location, HTTP referrer, etc.) using the legitimate service at https://whos.{BLOCKED}ung.us/pingjs/
Also, the researchers have found a similar attack at http://www.{BLOCKED}php.com/x/toplu.php. and it is believed that both of them are created by the same author because they share several function names, as well as the client_id of the Facebook app.
The Trend Micro Experts found that the client_id involved in this malware was 2254487659 , which belongs to blackberry official app. After some investigation and reaching Blackberry, the company itself confirmed and then the researchers made them a clarification regarding the advantage this malware is taking of the trusted BlackBerry brand name and stealing user's access-tokens, which can be used to make requests to Facebook APIs and read users information or to publish content to Facebook on behalf of a person. Blackberry released this statement:
The mobile malware using the Android SOP Exploit (Android Same Origin Policy Bypass Exploit) is designed to target Facebook users regardless of their mobile device platform. However, it attempts to take advantage of the trusted BlackBerry brand name by using our Facebook web app. BlackBerry is continuously working with Trend Micro and Facebook to detect and mitigate this attack. Note that the issue is not a result of an exploit to Blackberry's hardware, software, or network.
Reportedly, Google has already patched these vulnerabilities. But the researchers say that not all not all users may be able to update their browser and/or Android version. Until device vendors are able to release patches, users will still be at risk.
About the Android SOP Vulnerability
An independent researcher named Rafay Baloch recently discovered a Android SOP vulnerability in Android's built-in browser. The Android SOP vulnerability allows the same origin policy of the browser to be violated, leading to a dangerous universal cross-site scripting (UXSS) attack to take place.
