[Bug] Chrome & Firefox privacy leakage: search term is sent to ISP without user's consent

CyberTech

CyberTech

Level 44
Verified
Top Poster
Well-known
Forum Veteran
### Credit:
#### Author: duykham
#### Date: 2020-Apr-13

### Affected version:
Firefox 75.0 (64-bit), latest version as of 2020-Apr-13.
Google Chrome v81.0.4044.92 (64-bit) latest version as of 2020-Apr-13.
Platform: Windows 10

(As of my knowledge, until today 2020/05/31, there is no fix yet, later
versions are most likely affected, too).

### Title:
User's search term is accidentally sent to ISP without user's consent.

### Category:
DoH, Privacy

### Severity:
High

### Description:
When an user types a search term (e.g. "a-very-sensitive-word") into the
address bar and enter, the quick search feature will bring up search
results from a search engine (either from Google or DuckDuckGo) which is an
expected behavior.
However, the search term ("a-very-sensitive-word") is also "mistakenly"
sent to one of the (DNS) servers of the user's ISP. The user's privacy is
compromised.

The issue happens even if DoH (DNS over HTTPS) is in place. Even though,
this should not happen in any circumstances, with or without DoH. Any
information users type or search for must not not be sent out (especially
Click to expand...

More information
seclists.org

Full Disclosure: [Bug] Firefox privacy leakage: search term is sent to ISP without user's consent.

seclists.org seclists.org
github.com

blog/firefox/privacy-leakage at master · samduy/blog

Findings, bugs, disclosures, some other stuff... written by me. - samduy/blog
github.com github.com
 
blackice said:
And yet again Chrome doesn’t look so bad :ROFLMAO:
Click to expand...
### Timeline
- 2020/04/13: Sent bug reports to both Firefox (at security () mozilla org)
and [Chrome](1070282 - chromium - An open-source project to help move the web forward. - Monorail).
- 2020/04/14: Google team replied. There was a similar bug ([#479620](
479620 - chromium - An open-source project to help move the web forward. - Monorail)) in their bug-tracking system but no-one had
fixed yet. No responses from Firefox team.
- 2020/05/13: Sent another reminder to Firefox team at email address:
security () mozilla org.
- 2020/05/31: Still no responses from Firefox team.
- 2020/06/01: Bug disclosure to public.
 
Bugs of this kind calls for the use of a good quality router (which can use doH) in between your ISP provided modem and your pc/other devices. ISPs these days provide a locked down modem with their own dns configuration which we can't change. (I argued with my ISP, just to hear what they say, that I have paid for my modem and I need it to run my specific dns configuration, to which they replied that they need to filter some address as per law and they can't do nothing regarding this.) Everything for sake of law..my f**t.
 
oldschool said:
### Timeline
- 2020/04/13: Sent bug reports to both Firefox (at security () mozilla org)
and [Chrome](1070282 - chromium - An open-source project to help move the web forward. - Monorail).
- 2020/04/14: Google team replied. There was a similar bug ([#479620](
479620 - chromium - An open-source project to help move the web forward. - Monorail)) in their bug-tracking system but no-one had
fixed yet. No responses from Firefox team.
- 2020/05/13: Sent another reminder to Firefox team at email address:
security () mozilla org.
- 2020/05/31: Still no responses from Firefox team.
- 2020/06/01: Bug disclosure to public.
Click to expand...
Firefox doesn't care a long time ago about user privacy. They're only interested in making money and marketing with misinformation.
 
The issue happens even if DoH (DNS over HTTPS) is in place. Even though,
this should not happen in any circumstances, with or without DoH.
Click to expand...
You can say that again: DoH + DDG = Fail! The new Windows will take care of it, when DoH will be enabled, but still, this should not be possible, unless ... .
When an user types a search term (e.g. "a-very-sensitive-word") into the address bar
Click to expand...
And what about, when the user searches from the webpage itself and not from the address bar? The search term is still included within the URL. :unsure:
 
oldschool said:
### Timeline
- 2020/04/13: Sent bug reports to both Firefox (at security () mozilla org)
and [Chrome](1070282 - chromium - An open-source project to help move the web forward. - Monorail).
- 2020/04/14: Google team replied. There was a similar bug ([#479620](
479620 - chromium - An open-source project to help move the web forward. - Monorail)) in their bug-tracking system but no-one had
fixed yet. No responses from Firefox team.
- 2020/05/13: Sent another reminder to Firefox team at email address:
security () mozilla org.
- 2020/05/31: Still no responses from Firefox team.
- 2020/06/01: Bug disclosure to public.
Click to expand...
Yeah...I need more sleep. Just caught the title and skimmed.:coffee::coffee::coffee:
 
techdows.com

Firefox to allow users to disable sending of search terms to ISPs, Chrome has no fix for now.

Firefox and Chrome browsers have a privacy flaw where the user typed search terms are sent to DNS servers of ISPs, even when Private browsing mode or Privacy-focused search engine DuckDuckGo is used or DNS over HTTPS (DoH) is enabled. Mozilla with the upcoming version Firefox 79, offers a...
techdows.com techdows.com
You can see Mozilla’s discussion on this issue here. Good news for Firefox users is Mozilla is offering a pref in the Firefox 79, (also available in Firefox 78 beta) to manage this. [...]
Click to expand...
 
In reviewing the documentation on this it doesn't seem as severe as the title makes it out. It is only single word search terms including hyphenated terms. This can easily be mitigated in the short term by not using the url bar to search, or at least not when using single word searches. Good on Firefox for offering to disable it. But, maybe a best practice is to go to the search engine you want to use instead of using the url bar (inconvenient, but minor).
 
Having enabled DNS logging, I'm seeing full domain names (not single-word queries) being sent to my ISP, even though I have DOH in Firefox set to trr 3 (no fallback).
 
So, as far as I understand, a VPN would also be useless since it would encrypt the traffic A to B but the servers still retrieve the end communication input (a.k.a the searched term). Am I right?
 
Robbie said:
So, as far as I understand, a VPN would also be useless since it would encrypt the traffic A to B but the servers still retrieve the end communication input (a.k.a the searched term). Am I right?
Click to expand...
The browser shouldn’t see your ISP prior to talking to your router/modem. Your ISP should only see you pointing at the VPN IP address, and with the browser looking through that tunnel they shouldn’t see the ISP at all?. As far as the browser is concerned the VPN is your ISP? I would think a VPN would help in this situation. Especially if the VPN runs their own recursive servers. But, maybe this is beyond my understanding.
 
Last edited:
South Park said:
Having enabled DNS logging, I'm seeing full domain names (not single-word queries) being sent to my ISP, even though I have DOH in Firefox set to trr 3 (no fallback).
Click to expand...
Install Yoga dns and enable any doh provider ( i prefer next dns), block all tcp/udp over port53. Now dns queries will go through port 443 isp wont be able to see that. another way is to use a router with DOH capability ( DDwrt, asus wrt merlin-provide dot support-, Mikrotik hap ac, mikrotik hap ac2, ) or use linux and install cloudflared.
 
blackice said:
Do you use your ISP’s DNS on your router?
Click to expand...
Unfortunately, yes, because the router is provided and maintained by the building where I live.

JoyousBudweiser said:
Install Yoga dns and enable any doh provider ( i prefer next dns), block all tcp/udp over port53. Now dns queries will go through port 443 isp wont be able to see that. another way is to use a router with DOH capability ( DDwrt, asus wrt merlin-provide dot support-, Mikrotik hap ac, mikrotik hap ac2, ) or use linux and install cloudflared.
Click to expand...
Thanks for the info. I was wondering about something like that or Acrylic DNS.
 

Recently browsing

Members who viewed this thread in the last 5 minutes

You may also like...

Back
Top