topic

browser security

WUP! There It Is

Privacy and Security Issues in QQ Browser

Figure 3: Example man-in-the-middle attack on QQ Browser’s self-updater by first injecting a vulnerable Web installer and then injecting our arbitrary program. A benign program that displays “Oh Hai There” was used as the payload, but any arbitrary program such as spyware or malware could be injected.

This report describes privacy and security issues with the Windows and Android versions of QQ Browser. Our research shows that both versions of the application transmit personally identifiable data without encryption or with easily decrypted encryption, and do not adequately protect the software update process.

March 28, 2016

App Security & Privacy