16 lines
494 B
Text
16 lines
494 B
Text
rule LINUX_Browser_Cookie_Theft_Firefox_Paths
|
|
{
|
|
meta:
|
|
description = "Linux: riferimenti a Firefox cookies.sqlite e profili"
|
|
severity = "high"
|
|
fix_notes = "FP fix: aggiunto check ELF - cookies.sqlite e profiles.ini sono presenti in backup/script legittimi"
|
|
|
|
strings:
|
|
$f1 = "/.mozilla/firefox/" ascii
|
|
$f2 = "cookies.sqlite" ascii
|
|
$f3 = "profiles.ini" ascii
|
|
|
|
condition:
|
|
uint32(0) == 0x7f454c46 and
|
|
$f1 and ($f2 or $f3)
|
|
}
|