A good amount of money has been stolen from my bank account bypassing the double factor authentication.

ZioMario · Tuesday at 2:36 PM

rootbert said:
If I would place a bet, I'd say you are victim to an exploit of CVE-2025-11708

Can u help me to find the test to check if Firefox installed on my Android phone is affected by this bug ? And this bug allows to disable the bank app and to read all the informations stored on the phone ?

ZioMario · Tuesday at 2:38 PM

MrBSD said:
Not all banking apps are checking for IMEI number, but if they dont, thats a huge security risk right there. You have to understand that banking apps are not classic android apps. They tie to your phone IMEI, email address, and even phone number. On top of that, many of them are calculating unique identifier number that gets tied to your phone, and they calculate that number based on phone number, imei...etc. As long as your Pinephone has a valid IMEI number, you can use it. Check IMEI number by typing *#06* on phone keypad and validate it here.

The Pinephone running Linux is a real phone with IMIEI and other features... if it could run Android, it would allow to install the banking app, which would be running on an exotic environment. And therefore, it has some differences that could disturb hackers,who certainly wouldn't expect a user to use something so odd, so that their attack could fail miserably. The whole point here is that the base operating system is no longer Android, but Linux. So the technique of disabling the banking app is doomed to fail, I think because Android will run in some kind of Sandbox. And even the versions of the applications installed will change from Android to Linux,at least for the host os.

rootbert · Tuesday at 2:40 PM

ZioMario said:
Can u help me to find the test to check if Firefox installed on my Android phone is affected by this bug ? And this bug allows to disable the bank app and to read all the informations stored on the phone ?

simply check the version installed. But I thought you used a browser on FreeBSD to do your banking?

hruodr · Tuesday at 2:51 PM

blackbird9 said:
There is a review of some of the available free secure dns servers here:-

I use unbound. Is it not better?

blackbird9 · Tuesday at 2:54 PM

CVE-2025-11708 Impact, Exploitability, and Mitigation Steps | Wiz

Understand the critical aspects of CVE-2025-11708 with a detailed vulnerability assessment, exploitation potential, affected technologies, and remediation guidance.

www.wiz.io

How nice of them to exploit the bug.

"Mozilla has addressed this vulnerability in Firefox 144, Firefox ESR 140.4, Thunderbird 144, and Thunderbird ESR 140.4. Users are advised to update to these versions or later to mitigate the risk"

In firefox: help->about firefox.

Firefox on my freebsd 14.3R box says it's version is 144.0. So I have the fix.

blackbird9 · Tuesday at 3:00 PM

hruodr said:
I use unbound. Is it not better?

I use unbound with secure dns... at least, I hope it's secure... see https://blog.des.no/tag/dns

ZioMario · Tuesday at 3:05 PM

blackbird9 said:
CVE-2025-11708 Impact, Exploitability, and Mitigation Steps | Wiz

Understand the critical aspects of CVE-2025-11708 with a detailed vulnerability assessment, exploitation potential, affected technologies, and remediation guidance.

www.wiz.io

How nice of them to exploit the bug.

"Mozilla has addressed this vulnerability in Firefox 144, Firefox ESR 140.4, Thunderbird 144, and Thunderbird ESR 140.4. Users are advised to update to these versions or later to mitigate the risk"

In firefox: help->about firefox.

Firefox on my freebsd 14.3R box says it's version is 144.0. So I have the fix.

I have 144.0. I have the fix. So he used another approach...Before I was worried about the version of Firefox installed on my Android phone. Isn't this relevant ? Because the bank app is installed on Android. Remember that he (or she ?) took the control of the bank app installed on Android.

blackbird9 · Tuesday at 3:09 PM

ZioMario said:
I have 144.0. I have the fix. So he used another approach...Before I was worried about the version of Firefox installed on my Android phone. Isn't this relevant ? Because the bank app is installed on Android. Remember that he (or she ?) took the control of the bank app installed on Android.

I would have thought it was unrelated unless that bank app runs a headless instance of firefox under the covers... like electron..

blackbird9 · Tuesday at 3:11 PM

But did you have 144 on the freebsd system when the hack happened, or have you done a pkg upgrade since then?

Rock · Tuesday at 3:31 PM

MrBSD said:
Your sim card, your phone, your email address, and everything you have is compromised.

my sim card is digital. To clone it the hacker has to get hand in my phone, not an iphone, by the way.

ZioMario · Tuesday at 3:42 PM

blackbird9 said:
But did you have 144 on the freebsd system when the hack happened, or have you done a pkg upgrade since then?

You are right. I've upgraded the packages (also Firefox,that I remember forced me to restart),yesterday at late night. I made a mistake. The fact is that I'm porting the panfrost driver on FreeBSD 15.0 and I did it unconsciously. Now I can't be sure if I had the bugged version.

eternal_noob · Tuesday at 4:09 PM

That's why i told you to make backups earlier.

Post in thread 'A good amount of money has been stolen from my bank account bypassing the double factor authentication.'

Sunday at 11:00 PM

That's understandable but you might erase traces by accident if you play around. At least make a backup of both your phone and computer before.

cy@ · Tuesday at 4:19 PM

ZioMario said:
Can u help me to find the test to check if Firefox installed on my Android phone is affected by this bug ? And this bug allows to disable the bank app and to read all the informations stored on the phone ?

It's evident by simply reading the CVE description. The CVSS score isn't too terrible.

astyle · Tuesday at 4:21 PM

ZioMario said:
I have 144.0. I have the fix. So he used another approach...Before I was worried about the version of Firefox installed on my Android phone. Isn't this relevant ? Because the bank app is installed on Android. Remember that he (or she ?) took the control of the bank app installed on Android.

Double-check the dates and versions of the software in use at the time. This is one reason why you're supposed to install updates all the time on your phone.

ZioMario · Tuesday at 4:23 PM

eternal_noob said:
That's why i told you to make backups earlier.

Post in thread 'A good amount of money has been stolen from my bank account bypassing the double factor authentication.'

Sunday at 11:00 PM

That's understandable but you might erase traces by accident if you play around. At least make a backup of both your phone and computer before.

eternal_noob

I was focused to the evidences of his crime. The upgrade of Firefox wasn't included.

astyle · Tuesday at 4:26 PM

ZioMario said:
For backups I meant the evidences of his crime.

It is actually on you to pay attention and know what transactions are yours and which ones are NOT, and highlight that. Takes some effort, I know, but it is that important.

ZioMario · Tuesday at 4:27 PM

astyle said:
Double-check the dates and versions of the software in use at the time. This is one reason why you're supposed to install updates all the time on your phone.

That's a good point. I was focused and I'm yet focused to Firefox installed on Android,not on FreeBSD. Because the fact that he disabled the bank app makes me think that the vulnerability that really matter is there.

ngnicholson · Tuesday at 4:28 PM

The only way to really find out what has happened is to let the professionals do a forensic examination of the phone & computer. Unless it is mega bucks the banks will not do this.

ZioMario · Tuesday at 4:37 PM

To my surprise on Android Firefox is at version 144.0 !

ZioMario · Tuesday at 4:39 PM

ngnicholson said:
The only way to really find out what has happened is to let the professionals do a forensic examination of the phone & computer. Unless it is mega bucks the banks will not do this.

Partially true in my opinion. Because here there are a lot of experienced and smart guys very able to make realistic and nice hypothesys. And inside all the things we say,there are a lot of little pieces of truth.

ZioMario · Tuesday at 4:41 PM

ngnicholson said:
The only way to really find out what has happened is to let the professionals do a forensic examination of the phone & computer. Unless it is mega bucks the banks will not do this.

Sure. They do their work. We are here to learn,share and try to understand. Its enough and its a lot.

ZioMario · Tuesday at 4:44 PM

astyle said:
Double-check the dates and versions of the software in use at the time. This is one reason why you're supposed to install updates all the time on your phone.

How can I check which version of Firefox I used, let's say, october 15 ?

eternal_noob · Tuesday at 4:47 PM

Check the backups.

hruodr · Tuesday at 5:07 PM

blackbird9 said:
I use unbound with secure dns... at least, I hope it's secure... see https://blog.des.no/tag/dns

I do not do that. I do not use any forwarder, but the built in list of authoritative nameservers for the root zone.

astyle · Tuesday at 5:59 PM

eternal_noob said:
Check the backups.

I would check the release history of Firefox, and see which version was released around that date. It's fairly safe to assume that OP had a somewhat older version. Sometimes people skip a few releases before updating, but I don't expect people to keep very good notes on what version they actually used. A 'version older than a specific release' is usually a good assumption.