Re: Mozilla extensions: a security nightmare

[Mario Vilas <mvilas () gmail com>]

%APPDATA% is within the user's home directory - by default it should not be
writeable by other users. If this is the case then the problem is one of
bad file permissions, not the location.

Incidentally, many other browsers and tons of software also store
executable code in %APPDATA%.

I think "security nightmare" may be a bit of an overstatement here. I'll
refrain from panicking about this "issue" for the time being.

On Tuesday, August 4, 2015, Stefan Kanthak <stefan.kanthak () nexgo de> wrote:

> Hi @ll,
>
> Mozilla Thunderbird 38 and newer installs and activates per default
> the 'Lightning' extension.
>
> Since extensions live in the (Firefox and) Thunderbird profiles
> (which are stored beneath %APPDATA% in Windows) and 'Lightning' comes
> (at least for Windows) with a DLL and some Javascript, Thunderbird
> with 'Lightning' violates one of the mandatory and basic requirements
> of the now 20 year old "Designed for Windows" guidelines and breaks a
> security boundary: applications must be installed in %ProgramFiles%
> where they are protected against tampering by unprivileged users (and
> of course malware running in their user accounts too) since only
> privileged users can write there.
>
> Code installed in %APPDATA% (or any other user-writable location) is
> but not protected against tampering.
> This is a fundamental flaw of (not only) Mozilla's extensions, and a
> security nightmare.
>
> Separation of code from (user) data also allows to use whitelisting
> (see <https://technet.microsoft.com/en-us/library/bb457006.aspx> for
> example) to secure Windows desktops and servers: users (and of course
> Windows too) don't need to run code stored in their user profiles,
> they only need to run the installed programs/applications, so unwanted
> software including malware can easily be blocked from running.
>
> JFTR: current software separates code from data in virtual memory and
>       uses "write xor execute" or "data execution prevention" to
>       prevent both tampering of code and execution of data.
>       The same separation and protection can and of course needs to be
>       applied to code and data stored in the file system too!
>
> The Lightning extension for Windows but defeats the tamper protection
> and code/data separation provided by Windows:
>
> 1. its calbasecomps.dll can be replaced or overwritten with an
>    arbitrary DLL which DllMain() is executed every time this DLL is
>    loaded;
>
> 2. its (XUL/chrome) Javascripts can be replaced or overwritten and
>    used to load and call arbitrary DLLs via js-ctypes.
>
>    Only non-XUL/chrome Javascript is less critical since its execution
>    is confined by (Firefox and) Thunderbird and subject to the
>    restrictions imposed by these programs for non-XUL/chrome Javascript.
>
>
> Mitigation(s):
> ~~~~~~~~~~~~~~
>
> Disable profile local installation of extensions in Mozilla products,
> enable ONLY application global installation of extensions.
>
> stay tuned
> Stefan Kanthak
>
> _______________________________________________
> Sent through the Full Disclosure mailing list
> https://nmap.org/mailman/listinfo/fulldisclosure
> Web Archives & RSS: http://seclists.org/fulldisclosure/


-- 
“There's a reason we separate military and the police: one fights the enemy
of the state, the other serves and protects the people. When the military
becomes both, then the enemies of the state tend to become the people.”

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/