The latest version 5.26.0 of the DuckDuckGo Privacy Browser for Android which has over 5 million downloads is allowing hackers to execute URL spoofing attacks by exploiting a spoofing flaw in the address bar.
The vulnerability which attacks the app users has been discovered by the security researcher, Dhiraj Mishra, who immediately reported the flaw to the concerned security department via the associated bug bounty program provided by the vulnerability coordination and bug bounty platform, 'HackerOne'.
In a conversation with BleepingComputer, Dhiraj told, "this vulnerability was submitted to the browser security team via HackerOne on October 31st, 2018 initially this bug was marked as high the discussion went till May 27th, 2019, and they concluded this 'doesn't seem to be a serious issue' and marked the bug as informative, however, I was awarded a swag from DuckDuckGo."
In the vulnerable DuckDuckGo Privacy Browser for Android, the attackers execute this URL spoofing attack after altering the URL which is displayed onto the address bar of the infected web browser which is configured to trick victims into believing that the website being browsed is monitored by an authenticated source. However, in reality, the website would be controlled by the attackers carrying out the spoofing attack.
There is a high probability of the oblivious users to be unknowingly redirected to web addresses disguised as authenticated web portals which in actuality would be assisting malicious actors in accumulating the data of their potential victims either by phishing or by injecting malware into their systems through malvertising campaigns.
Earlier, in May, Arif Khan, security researcher, on detecting a similar vulnerability in the UC browser said, "URL Address Bar spoofing is the worst kind of phishing attack possible. Because ..