Back to list
Mozilla extensions: a security nightmare
Aug 04 2015 01:22PM
Stefan Kanthak (stefan kanthak nexgo de)
Mozilla Thunderbird 38 and newer installs and activates per default
the 'Lightning' extension.
Since extensions live in the (Firefox and) Thunderbird profiles
(which are stored beneath %APPDATA% in Windows) and 'Lightning' comes
with 'Lightning' violates one of the mandatory and basic requirements
of the now 20 year old "Designed for Windows" guidelines and breaks a
security boundary: applications must be installed in %ProgramFiles%
where they are protected against tampering by unprivileged users (and
of course malware running in their user accounts too) since only
privileged users can write there.
Code installed in %APPDATA% (or any other user-writable location) is
but not protected against tampering.
This is a fundamental flaw of (not only) Mozilla's extensions, and a
Separation of code from (user) data also allows to use whitelisting
(see <https://technet.microsoft.com/en-us/library/bb457006.aspx> for
example) to secure Windows desktops and servers: users (and of course
Windows too) don't need to run code stored in their user profiles,
they only need to run the installed programs/applications, so unwanted
software including malware can easily be blocked from running.
JFTR: current software separates code from data in virtual memory and
uses "write xor execute" or "data execution prevention" to
prevent both tampering of code and execution of data.
The same separation and protection can and of course needs to be
applied to code and data stored in the file system too!
The Lightning extension for Windows but defeats the tamper protection
and code/data separation provided by Windows:
1. its calbasecomps.dll can be replaced or overwritten with an
arbitrary DLL which DllMain() is executed every time this DLL is
used to load and call arbitrary DLLs via js-ctypes.
is confined by (Firefox and) Thunderbird and subject to the
Disable profile local installation of extensions in Mozilla products,
enable ONLY application global installation of extensions.
[ reply ]
Copyright 2010, SecurityFocus