[Bug] Chrome & Firefox privacy leakage: search term is sent to ISP without user's consent

[CyberTech]

### Credit:
#### Author: duykham
#### Date: 2020-Apr-13

### Affected version:
Firefox 75.0 (64-bit), latest version as of 2020-Apr-13.
Google Chrome v81.0.4044.92 (64-bit) latest version as of 2020-Apr-13.
Platform: Windows 10

(As of my knowledge, until today 2020/05/31, there is no fix yet, later
versions are most likely affected, too).

### Title:
User's search term is accidentally sent to ISP without user's consent.

### Category:
DoH, Privacy

### Severity:
High

### Description:
When an user types a search term (e.g. "a-very-sensitive-word") into the
address bar and enter, the quick search feature will bring up search
results from a search engine (either from Google or DuckDuckGo) which is an
expected behavior.
However, the search term ("a-very-sensitive-word") is also "mistakenly"
sent to one of the (DNS) servers of the user's ISP. The user's privacy is
compromised.

The issue happens even if DoH (DNS over HTTPS) is in place. Even though,
this should not happen in any circumstances, with or without DoH. Any
information users type or search for must not not be sent out (especially

More information

Full Disclosure: [Bug] Firefox privacy leakage: search term is sent to ISP without user's consent.

seclists.org

blog/firefox/privacy-leakage at master · samduy/blog

Findings, bugs, disclosures, some other stuff... written by me. - samduy/blog

github.com

 

[blackice]

And yet again Chrome doesn’t look so bad

 

[upnorth]

And yet again Chrome doesn’t look so bad

Affected version:
Firefox 75.0 (64-bit), latest version as of 2020-Apr-13.
Google Chrome v81.0.4044.92 (64-bit) latest version as of 2020-Apr-13.

 

[oldschool]

And yet again Chrome doesn’t look so bad

### Timeline
- 2020/04/13: Sent bug reports to both Firefox (at security () mozilla org)
and [Chrome](1070282 - chromium - An open-source project to help move the web forward. - Monorail).
- 2020/04/14: Google team replied. There was a similar bug ([#479620](
479620 - chromium - An open-source project to help move the web forward. - Monorail)) in their bug-tracking system but no-one had
fixed yet. No responses from Firefox team.
- 2020/05/13: Sent another reminder to Firefox team at email address:
security () mozilla org.
- 2020/05/31: Still no responses from Firefox team.
- 2020/06/01: Bug disclosure to public.

 

[Brahman]

Bugs of this kind calls for the use of a good quality router (which can use doH) in between your ISP provided modem and your pc/other devices. ISPs these days provide a locked down modem with their own dns configuration which we can't change. (I argued with my ISP, just to hear what they say, that I have paid for my modem and I need it to run my specific dns configuration, to which they replied that they need to filter some address as per law and they can't do nothing regarding this.) Everything for sake of law..my f**t.

 

[ForgottenSeer 85179]

### Timeline
- 2020/04/13: Sent bug reports to both Firefox (at security () mozilla org)
and [Chrome](1070282 - chromium - An open-source project to help move the web forward. - Monorail).
- 2020/04/14: Google team replied. There was a similar bug ([#479620](
479620 - chromium - An open-source project to help move the web forward. - Monorail)) in their bug-tracking system but no-one had
fixed yet. No responses from Firefox team.
- 2020/05/13: Sent another reminder to Firefox team at email address:
security () mozilla org.
- 2020/05/31: Still no responses from Firefox team.
- 2020/06/01: Bug disclosure to public.

Firefox doesn't care a long time ago about user privacy. They're only interested in making money and marketing with misinformation.

 

[TairikuOkami]

The issue happens even if DoH (DNS over HTTPS) is in place. Even though,
this should not happen in any circumstances, with or without DoH.

You can say that again: DoH + DDG = Fail! The new Windows will take care of it, when DoH will be enabled, but still, this should not be possible, unless ... .

When an user types a search term (e.g. "a-very-sensitive-word") into the address bar

And what about, when the user searches from the webpage itself and not from the address bar? The search term is still included within the URL.

 

[Freki123]

• 2020/06/01: Public disclosure.
• 2020/06/02: A person from Firefox team replied. They are responding to the issue at (1642623 - User's search term is accidentally sent to ISP without user's consent.).

blog/firefox/privacy-leakage at master · samduy/blog

Findings, bugs, disclosures, some other stuff... written by me. - samduy/blog

github.com

 

[blackice]

Sleepily missed that. Doesn’t matter for me, my router forces it’s DNS resolver on all requests.

 

[blackice]

### Timeline
- 2020/04/13: Sent bug reports to both Firefox (at security () mozilla org)
and [Chrome](1070282 - chromium - An open-source project to help move the web forward. - Monorail).
- 2020/04/14: Google team replied. There was a similar bug ([#479620](
479620 - chromium - An open-source project to help move the web forward. - Monorail)) in their bug-tracking system but no-one had
fixed yet. No responses from Firefox team.
- 2020/05/13: Sent another reminder to Firefox team at email address:
security () mozilla org.
- 2020/05/31: Still no responses from Firefox team.
- 2020/06/01: Bug disclosure to public.

Yeah...I need more sleep. Just caught the title and skimmed.

 

[Ink]

Firefox doesn't care a long time ago about user privacy. They're only interested in making money and marketing with misinformation.

If it's a bug that affects both Chrome and Firefox, then aren't you spreading misinformation about Firefox?

 

[ForgottenSeer 85179]

If it's a bug that affects both Chrome and Firefox, then aren't you spreading misinformation about Firefox?

This wasn't about this bug here but generally about Mozilla.
But even without that fact, Mozilla answer a lot too late. This just confirm how bad they handle security.
Also see Firefox and Chromium Security | Madaidan's Insecurities

 

[silversurfer]

Firefox to allow users to disable sending of search terms to ISPs, Chrome has no fix for now.

Firefox and Chrome browsers have a privacy flaw where the user typed search terms are sent to DNS servers of ISPs, even when Private browsing mode or Privacy-focused search engine DuckDuckGo is used or DNS over HTTPS (DoH) is enabled. Mozilla with the upcoming version Firefox 79, offers a...

techdows.com

You can see Mozilla’s discussion on this issue here. Good news for Firefox users is Mozilla is offering a pref in the Firefox 79, (also available in Firefox 78 beta) to manage this. [...]

 

[blackice]

In reviewing the documentation on this it doesn't seem as severe as the title makes it out. It is only single word search terms including hyphenated terms. This can easily be mitigated in the short term by not using the url bar to search, or at least not when using single word searches. Good on Firefox for offering to disable it. But, maybe a best practice is to go to the search engine you want to use instead of using the url bar (inconvenient, but minor).

 

[South Park]

Having enabled DNS logging, I'm seeing full domain names (not single-word queries) being sent to my ISP, even though I have DOH in Firefox set to trr 3 (no fallback).

 

[RoboMan]

So, as far as I understand, a VPN would also be useless since it would encrypt the traffic A to B but the servers still retrieve the end communication input (a.k.a the searched term). Am I right?

 

[blackice]

So, as far as I understand, a VPN would also be useless since it would encrypt the traffic A to B but the servers still retrieve the end communication input (a.k.a the searched term). Am I right?

The browser shouldn’t see your ISP prior to talking to your router/modem. Your ISP should only see you pointing at the VPN IP address, and with the browser looking through that tunnel they shouldn’t see the ISP at all?. As far as the browser is concerned the VPN is your ISP? I would think a VPN would help in this situation. Especially if the VPN runs their own recursive servers. But, maybe this is beyond my understanding.

 

[blackice]

Having enabled DNS logging, I'm seeing full domain names (not single-word queries) being sent to my ISP, even though I have DOH in Firefox set to trr 3 (no fallback).

Do you use your ISP’s DNS on your router?

 

[Brahman]

Having enabled DNS logging, I'm seeing full domain names (not single-word queries) being sent to my ISP, even though I have DOH in Firefox set to trr 3 (no fallback).

Install Yoga dns and enable any doh provider ( i prefer next dns), block all tcp/udp over port53. Now dns queries will go through port 443 isp wont be able to see that. another way is to use a router with DOH capability ( DDwrt, asus wrt merlin-provide dot support-, Mikrotik hap ac, mikrotik hap ac2, ) or use linux and install cloudflared.

 

[South Park]

Do you use your ISP’s DNS on your router?

Unfortunately, yes, because the router is provided and maintained by the building where I live.

Install Yoga dns and enable any doh provider ( i prefer next dns), block all tcp/udp over port53. Now dns queries will go through port 443 isp wont be able to see that. another way is to use a router with DOH capability ( DDwrt, asus wrt merlin-provide dot support-, Mikrotik hap ac, mikrotik hap ac2, ) or use linux and install cloudflared.

Thanks for the info. I was wondering about something like that or Acrylic DNS.