Firefox Security Sid Stamm <sid@mozilla.com>
Browser as a Protector • Protect Site Content • Safe Platform • Third-Party Features • Keeping your Secrets
Content Restrictions Content Security Policy
Content Restrictions Document “Good” behavior... Suppress the “Bad”
Grabbing the Reins Content Restrictions • Content Rules & Regulations • Specify a “Normal Behavior” Policy • Catch and Block Violations <HTML> Content Policy Specify Rules Enforce Rules
Step 1: Smooth Edges Content Restrictions • Scripts served in files (not inline) - “javascript:” URIs - <tag on*=...> event registration - text nodes in <script> tags • Establish Code / Data Separation - eval(“foo”) and friends
Step 2: Restrictions on Content Content Restrictions • Block requests for all resources ... unless explicitly allowed by a policy!
CSP: Policies Content Restrictions • HTTP Response Header X-CONTENT-SECURITY -POLICY • Directives to enforce listed within
Speed Bump Content Restrictions <meta http-equiv=....>? • Designers may not have access to HTTP • T wo entities want restrictions • Multiple policies?
Speed Bump Content Restrictions Intersecting Policies Given Policies P1 and P2: Pe = {u | P1 allows u AND P2 allows u}
Speed Bump Content Restrictions <meta http-equiv=....>? • policy in-band is too dangerous • Multiple header instances!
CSP: Directives Content Restrictions report-uri source directives policy-uri options
CSP: Source Directives Content Restrictions allow (default for these) img-src font-src media-src xhr-src script-src frame-ancestors object-src style-src frame-src
Speed Bump Content Restrictions ‘self’ ... in pieces? https://‘self’:443 ‘self’://foo.com foo.com:‘self’
‘self’ Content Restrictions ‘self‘ -> http://foo.com:80 bar.com:8080 -> http://bar.com:8080 http://foo.com -> http://foo.com:80 bar.com -> http://bar.com:80
Speed Bump Content Restrictions Redirects http://foo.com http://bar.com http://duh.com
Step 3: Profit • Sites only request explicitly allowed Content Restrictions resources • Injected inline scripts don’t run • Content homogenization (mixed content control) • Cross-domain CSRF reduction • Violation reports = early alert
CSP: Use Case 1 Content Restrictions allow ‘self’ • Site wants all content to come from the same source (scheme, host, port)
CSP: Use Case 2 Content Restrictions allow ‘self’; frame-src ads.net • Site wants all content to come from the same source (scheme, host, port), except content in iframes may be served by a third-party advertising network.
CSP: Use Case 3 Content Restrictions allow ‘self’; img-src *; object-src *.teevee.com; script-src myscripts.com • Auction site wants to allow images from anywhere, plugin content from a trusted media provider network, and scripts only from its server hosting sanitized JavaScript
CSP: Use Case 4 Content Restrictions allow https://*.x.com; • Example site wants to force all content to be served via HTTPS on port 443, from any subdomain of example.com
Wait! That breaks my site! Content Restrictions • Good Option: convert your site • Less Good Option: disable parts of CSP
Ramping Up Content Restrictions • Disable some restrictions via options • Report-Only mode • “Writing a Policy” guide • “Converting your Site” guide • Maybe a policy recommendation tool?
Safe Platform Safe Platform
Wrappers • XPCNativeWrapper Safe Platform
Wrappers • ChromeObjectWrapper Safe Platform
Wrappers • SafeJSObjectWrapper Safe Platform JS
Wrappers • CrossOriginWrapper Safe Platform
Safe Platform Safe Platform Out of Process Plug-Ins
Third-Party Features Add-Ons
Third-Party Features XPCOM and IDL
XPCOM and IDL Third-Party Features Source: http://www.ibm.com/developerworks/java/library/os-xpcomfirefox/
Third-Party Features Untamed Add-Ons
Third-Party Features Jetpack
Jetpack Third-Party Features API module module Jetpack My module Backend Add-On module (XPCOM) module module
Jetpack Third-Party Features API module module Jetpack My module Backend Add-On module (XPCOM) module module JavaScript
Jetpack Third-Party Features API module module Jetpack My Capabilities : module 1. http://foo.com Backend Add-On module 2. graphics (XPCOM) 3. menus module module
Keeping your Secrets Features and Your Privacy
Keeping your Secrets History Sniffing https://wiki.mozilla.org/User:Sidstamm/CSS_History_Sniffing_Links http://dbaron.org/mozilla/visited-privacy
Keeping your Secrets Private Browsing (roll-back time)
Keeping your Secrets NPAPI Hooks Private Browsing, Clear Recent History, etc
Keeping your Secrets Browser Traces
Browser as a Protector • Protect Site Content • Safe Platform • Third-Party Features • Keeping your Secrets
Recommend
More recommend
