10 ms·

An example of exploiting two fixed vulnerabilities in Firefox on Windows

rahuldottech 7y ago
The thing is, most of these exploits also affect Tor browser, because it's built upon Firefox. Other than using a VM or a live distro like Tails , is there any other way for OR users to be safer when running the regular Tor browser bundle, such as by utilising third-party sandbox software?
- deleted 7y ago
  [deleted]
- spacephysics 7y ago
  Most likely not, because then the user is dependent on the sandboxing capabilities of the software. Having a VM-level sandbox, although still technically possible to escape, would be far more difficult for an adversary.
  - skrebbel 7y ago
    Wouldn't running it in eg Sandboxie address the biggest risk? I mean, sure, probably Sandboxie can be escaped, but what malicious script that's busy adding my computer to it's botnet is going to assume that my Firefox running in a sandbox?
- stiray 7y ago
  While still on windows I was using this, for browser, software installs,... sandboxie.com/ It wont prevent execution but will prevent escaping to the real os.
- rashkov 7y ago
  It’s a bit of a leap to assume that TOR is vulnerable here, considering it disables JavaScript which is necessary for this exploit to work. Let’s not get carried away here please, there’s no need to stoke fears about TOR in this instance.
  - vbezhenar 7y ago
    TOR Browser does not disable JavaScript. It would be pretty useless with disabled JavaScript to be honest, a lot of the websites nowadays require JavaScript to work.
  - deleted 7y ago
    [deleted]
  - tyingq 7y ago
    " Why is NoScript configured to allow JavaScript by default in Tor Browser? Isn't that unsafe? We configure NoScript to allow JavaScript by default in Tor Browser because many websites will not work with JavaScript disabled." https://www.torproject.org/docs/faq.html.en#TBBJavaScriptEnabled https://www.torproject.org/docs/faq.html.en#TBBJavaScriptEna...
  - chefandy 7y ago
    Tor Browser Bundle does not outright disable JS at the settings level— it comes bundled with NoScript installed (and enabled by default,) but it can purposefully be wholly or partially disabled by the user with a couple of toolbar clicks. "Let’s not get carried away here please, there’s no need to stoke fears about TOR in this instance." You seem to be jumping to the opposite conclusion with your comment, which I'd argue is an even worse idea with security software. Considering that TBB is based on the vulnerable software package and the vulnerability could directly circumvent what TBB is attempting to accomplish, assuming there isn't a reasonable attack vector seems imprudent, rather than an appropriately measured response. If I had a serious privacy concern such as reporting on the activity of a government known for murdering its critics, I certainly would think twice if the only thing preventing remote attack code from executing in a vulnerable envrionment on my machine was a browser plugin.
- willvarfar 7y ago
  You can use whonix, which runs the browser in a VM that can only connect to the tor proxy in a second VM. It’s not claiming to be truly secure, but it is several extra layers that an attacker would have to get through
- ErikCorry 7y ago
  Most likely you are _less safe_ using Tor than using a regular Firefox or Chrome with no VPN, because using Tor automatically means nation state attackers are going to target you. So you have to do extra work just to break even. Google EgotisticalGiraffe for details.
  - rahuldottech 7y ago
    There's no way this is true. Even if nation state actors _are_ more likely to target you just for using Tor, even if it's for completely regular browsing, Tor provides a lot of additional protection and anonymity.
    - DyslexicAtheist 7y ago
      I initially got hung up on the GP assertion that users are most likely better off with Firefox. It depends on the threat model. But after thinking about it for a while, I agree with GP. Those people thinking about such topics constantly might not be the average user. I would not feel safe installing Tor on my parents computer and telling them it is safer to do all their browsing now with Tor. Threat models matter otherwise we'll end up applying wrong security tools: *"use Signal. use tor." when the right thing would have been to meet in person wearing a fake mustache, and keep a pebble in your shoe to change your walk. GP's advise makes sense for anyone who does not know what Tor is (most people). They are off better if we symlink their "Internet Button" from the desktop to Firefox, install uBlock and NanoDefender for them. If they're still adventurous teach them about creating/editing "multitab containers" (though I bet we've lost most of them by now).
      - dmos62 7y ago
        > GP's advise makes sense for anyone who does not know what Tor is Whether or not someone knows of Tor doesn't influence her threat model or privacy requirements, and therefore doesn't influence what measures can help. Other than that, I agree that you have to be aware of the threat model and what given tools provide.
    - deleted 7y ago
- stefan_ 7y ago
  Since the goal of many Tor Browser exploits is deanonymization, your first measure should be to not have the browser machine connected to a real network at all. Get a Raspberry or similar to proxy all traffic through Tor.
  - gruez 7y ago
    This is not necessary because the tor browser bundle is already designed not to leak its traffic.
    - stefan_ 7y ago
      Which, of course, is entirely worthless if you exploited the browser bundle.
- bepvte 7y ago
  Tor disables Ion last I checked, so this comment is not true
- kevingadd 7y ago
  Disable javascript, for starters
mr_woozy 7y ago
Is it fixed as of what version?
- est31 7y ago
  CVE-2019-11708 is fixed in Firefox 67.0.4 and CVE-2019-9810 is fixed in Firefox 66.0.1. https://www.mozilla.org/en-US/security/advisories/mfsa2019-19/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-1... https://www.mozilla.org/en-US/security/advisories/mfsa2019-09/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-0...
  - mr_woozy 7y ago
    danka danka
hu3 7y ago
I get permission denied when trying to view the bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1559858 https://bugzilla.mozilla.org/show_bug.cgi?id=1559858
- saagarjha 7y ago
  Access to security bugs is usually restricted.
  - hu3 7y ago
    Makes sense. Thanks for clarifying.
  - qxnqd 7y ago
    Even to bugs that have already been fixed?
    - jfk13 7y ago
      There's generally (and sensibly) some delay between fixing the bug and opening up the report.
      - tedunangst 7y ago
        It's been six months.
est31 7y ago
> It uses CVE-2019-9810 for getting code execution in both the content process as well as the parent process and CVE-2019-11708 to trick the parent process into browsing to an arbitrary URL. I wonder why is the privileged parent process even allowed to execute unsigned Javascript from the network? IIRC it already has eval support turned off. I get that it's hard to get rid of privileged Javascript completely (Servo thankfully made the choice early on to not do that at all), but is there any feature that requires downloading & executing Javascript from the network in the privileged parent process?
- kevingadd 7y ago
  Signed javascript isn't really a concept that exists anywhere. I'd love it if it did, it's a gaping hole in the internet security model. Mainline FF loads lots of unsigned user-controlled JS as-is (prefs.js, for example) so the closest thing you get is signing on entire extension bundles. There is the Subresource Integrity mechanism (https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...) as a stopgap for this but it doesn't really provide something useful in this case because the load target has to be known in advance and you can't provide a hash for top-level content in the URL.
  - est31 7y ago
    Add ons must be signed by Mozilla I think. Also, add ons that have privileged access require a special signature that Mozilla only uses for their own add ons. That's what I meant with signed Javascript. Anyway, this wasn't my main point. It's why you load and execute Javascript from the network in the first place in the content process. It feels to me that banning JS loading would have helped here a great deal and would make exploitation of similar bugs much harder.
toyg 7y ago
What’s so special about this old vulnerability targeting the few people who turn on bigInt support (it’s disabled by default, I believe)...?
geofft 7y ago
Note this is not a 0-day, this is a fully-worked-out example of exploiting two vulnerabilities fixed in May and June of this year. Worth reading for knowledge, but as an end user, just make sure you've restarted your browser at least once since June and haven't turned off auto-update.
- leeoniya 7y ago
  https://archive.is/20130414124019/http://ha.ckers.org/blog/20070803/mozilla-says-ten-fucking-days/ https://archive.is/20130414124019/http://ha.ckers.org/blog/2...
  - Natfan 7y ago
    That link 404s, here's one that works: https://web.archive.org/web/20150102232217/ha.ckers.org/blog/20070803/mozilla-says-ten-fucking-days/ https://web.archive.org/web/20150102232217/ha.ckers.org/blog...
  - geofft 7y ago
    That's from 2007, so, has that been true? I'd certainly expect that to be both true and unremarkable these days.
- taf2 7y ago
  I love auto update but am amazed by how many times I have run into a customer reporting an strange issue only find out they have not upgraded their browser in over a year because of some admin policy that prevents auto update...
  - nirvdrum 7y ago
    Just in case you were unaware, Firefox has extended support releases [1] for environments where rapid releases are too much hassle. This is a supported option from Mozilla whereby you get security fixes but the feature set doesn't change for 42 weeks. Which is to say that ESRs aren't some odd admin policy, but rather part of the supported Firefox line and widely used in bigger companies. Apologies if you were aware and were talking about some other admin policy. I've run into other devs that weren't aware, so thought I'd share. 1 - https://support.mozilla.org/en-US/kb/choosing-firefox-update-channel https://support.mozilla.org/en-US/kb/choosing-firefox-update...
DangerousPie 7y ago
Can we add something to the title to clarify that these bugs were fixed months ago? Eg. "(fixed in June)"? It's still an interesting post, but nowhere near as worrying for Firefox users as it sounds.
- dang 7y ago
  Ok, added above.
crumbshot 7y ago
Interested readers should check out the author's earlier work exploiting CVE-2019-9810: https://github.com/0vercl0k/CVE-2019-9810 https://github.com/0vercl0k/CVE-2019-9810 And their fantastically detailed writeup of a PoC they wrote for that vulnerability: https://doar-e.github.io/blog/2019/06/17/a-journey-into-ionmonkey-root-causing-cve-2019-9810/ https://doar-e.github.io/blog/2019/06/17/a-journey-into-ionm... This exploit is different in that they use the arbitrary read/write primitive gained by CVE-2019-9810 to flip a couple of bits and patch out a few instructions with the effect of removing the security boundary between a normal web page and XPCOM. The interesting difference in this exploitation approach is there's no need for ROP chains and shellcode, as you have all the XPCOM components available to use. Once they're in that privileged context in the content process, they escape its sandbox by exploiting CVE-2019-11708. This works by sending an particular IPC message to the parent process, that causes a web page of the exploiter's choice to load in that process. In this case, the choice is to exploit CVE-2019-9810 again, then use XPCOM components to drop an executable to disk and run it. Awesome work, and a real pleasure to read, it's satisfying to see such well-commented and clear exploit code.

The thing is, most of these exploits also affect Tor browser, because it's built upon Firefox. Other than using a VM or a live distro like Tails , is there any other way for OR users to be safer when running the regular Tor browser bundle, such as by utilising third-party sandbox software?

deleted 7y ago
[deleted]
spacephysics 7y ago
Most likely not, because then the user is dependent on the sandboxing capabilities of the software. Having a VM-level sandbox, although still technically possible to escape, would be far more difficult for an adversary.
- skrebbel 7y ago
  Wouldn't running it in eg Sandboxie address the biggest risk? I mean, sure, probably Sandboxie can be escaped, but what malicious script that's busy adding my computer to it's botnet is going to assume that my Firefox running in a sandbox?
stiray 7y ago
While still on windows I was using this, for browser, software installs,... sandboxie.com/ It wont prevent execution but will prevent escaping to the real os.
rashkov 7y ago
It’s a bit of a leap to assume that TOR is vulnerable here, considering it disables JavaScript which is necessary for this exploit to work. Let’s not get carried away here please, there’s no need to stoke fears about TOR in this instance.
- vbezhenar 7y ago
  TOR Browser does not disable JavaScript. It would be pretty useless with disabled JavaScript to be honest, a lot of the websites nowadays require JavaScript to work.
- deleted 7y ago
  [deleted]
- tyingq 7y ago
  " Why is NoScript configured to allow JavaScript by default in Tor Browser? Isn't that unsafe? We configure NoScript to allow JavaScript by default in Tor Browser because many websites will not work with JavaScript disabled." https://www.torproject.org/docs/faq.html.en#TBBJavaScriptEnabled https://www.torproject.org/docs/faq.html.en#TBBJavaScriptEna...
- chefandy 7y ago
  Tor Browser Bundle does not outright disable JS at the settings level— it comes bundled with NoScript installed (and enabled by default,) but it can purposefully be wholly or partially disabled by the user with a couple of toolbar clicks. "Let’s not get carried away here please, there’s no need to stoke fears about TOR in this instance." You seem to be jumping to the opposite conclusion with your comment, which I'd argue is an even worse idea with security software. Considering that TBB is based on the vulnerable software package and the vulnerability could directly circumvent what TBB is attempting to accomplish, assuming there isn't a reasonable attack vector seems imprudent, rather than an appropriately measured response. If I had a serious privacy concern such as reporting on the activity of a government known for murdering its critics, I certainly would think twice if the only thing preventing remote attack code from executing in a vulnerable envrionment on my machine was a browser plugin.
willvarfar 7y ago
You can use whonix, which runs the browser in a VM that can only connect to the tor proxy in a second VM. It’s not claiming to be truly secure, but it is several extra layers that an attacker would have to get through
ErikCorry 7y ago
Most likely you are _less safe_ using Tor than using a regular Firefox or Chrome with no VPN, because using Tor automatically means nation state attackers are going to target you. So you have to do extra work just to break even. Google EgotisticalGiraffe for details.
- rahuldottech 7y ago
  There's no way this is true. Even if nation state actors _are_ more likely to target you just for using Tor, even if it's for completely regular browsing, Tor provides a lot of additional protection and anonymity.
  - DyslexicAtheist 7y ago
    I initially got hung up on the GP assertion that users are most likely better off with Firefox. It depends on the threat model. But after thinking about it for a while, I agree with GP. Those people thinking about such topics constantly might not be the average user. I would not feel safe installing Tor on my parents computer and telling them it is safer to do all their browsing now with Tor. Threat models matter otherwise we'll end up applying wrong security tools: *"use Signal. use tor." when the right thing would have been to meet in person wearing a fake mustache, and keep a pebble in your shoe to change your walk. GP's advise makes sense for anyone who does not know what Tor is (most people). They are off better if we symlink their "Internet Button" from the desktop to Firefox, install uBlock and NanoDefender for them. If they're still adventurous teach them about creating/editing "multitab containers" (though I bet we've lost most of them by now).
    - dmos62 7y ago
      > GP's advise makes sense for anyone who does not know what Tor is Whether or not someone knows of Tor doesn't influence her threat model or privacy requirements, and therefore doesn't influence what measures can help. Other than that, I agree that you have to be aware of the threat model and what given tools provide.
  - deleted 7y ago
stefan_ 7y ago
Since the goal of many Tor Browser exploits is deanonymization, your first measure should be to not have the browser machine connected to a real network at all. Get a Raspberry or similar to proxy all traffic through Tor.
- gruez 7y ago
  This is not necessary because the tor browser bundle is already designed not to leak its traffic.
  - stefan_ 7y ago
    Which, of course, is entirely worthless if you exploited the browser bundle.
bepvte 7y ago
Tor disables Ion last I checked, so this comment is not true
kevingadd 7y ago
Disable javascript, for starters

mr_woozy 7y ago

Is it fixed as of what version?

est31 7y ago
CVE-2019-11708 is fixed in Firefox 67.0.4 and CVE-2019-9810 is fixed in Firefox 66.0.1. https://www.mozilla.org/en-US/security/advisories/mfsa2019-19/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-1... https://www.mozilla.org/en-US/security/advisories/mfsa2019-09/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-0...
- mr_woozy 7y ago
  danka danka

hu3 7y ago

I get permission denied when trying to view the bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1559858 https://bugzilla.mozilla.org/show_bug.cgi?id=1559858

saagarjha 7y ago
Access to security bugs is usually restricted.
- hu3 7y ago
  Makes sense. Thanks for clarifying.
- qxnqd 7y ago
  Even to bugs that have already been fixed?
  - jfk13 7y ago
    There's generally (and sensibly) some delay between fixing the bug and opening up the report.
    - tedunangst 7y ago
      It's been six months.

est31 7y ago

> It uses CVE-2019-9810 for getting code execution in both the content process as well as the parent process and CVE-2019-11708 to trick the parent process into browsing to an arbitrary URL. I wonder why is the privileged parent process even allowed to execute unsigned Javascript from the network? IIRC it already has eval support turned off. I get that it's hard to get rid of privileged Javascript completely (Servo thankfully made the choice early on to not do that at all), but is there any feature that requires downloading & executing Javascript from the network in the privileged parent process?

kevingadd 7y ago
Signed javascript isn't really a concept that exists anywhere. I'd love it if it did, it's a gaping hole in the internet security model. Mainline FF loads lots of unsigned user-controlled JS as-is (prefs.js, for example) so the closest thing you get is signing on entire extension bundles. There is the Subresource Integrity mechanism (https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...) as a stopgap for this but it doesn't really provide something useful in this case because the load target has to be known in advance and you can't provide a hash for top-level content in the URL.
- est31 7y ago
  Add ons must be signed by Mozilla I think. Also, add ons that have privileged access require a special signature that Mozilla only uses for their own add ons. That's what I meant with signed Javascript. Anyway, this wasn't my main point. It's why you load and execute Javascript from the network in the first place in the content process. It feels to me that banning JS loading would have helped here a great deal and would make exploitation of similar bugs much harder.

toyg 7y ago

What’s so special about this old vulnerability targeting the few people who turn on bigInt support (it’s disabled by default, I believe)...?

geofft 7y ago

Note this is not a 0-day, this is a fully-worked-out example of exploiting two vulnerabilities fixed in May and June of this year. Worth reading for knowledge, but as an end user, just make sure you've restarted your browser at least once since June and haven't turned off auto-update.

leeoniya 7y ago
https://archive.is/20130414124019/http://ha.ckers.org/blog/20070803/mozilla-says-ten-fucking-days/ https://archive.is/20130414124019/http://ha.ckers.org/blog/2...
- Natfan 7y ago
  That link 404s, here's one that works: https://web.archive.org/web/20150102232217/ha.ckers.org/blog/20070803/mozilla-says-ten-fucking-days/ https://web.archive.org/web/20150102232217/ha.ckers.org/blog...
- geofft 7y ago
  That's from 2007, so, has that been true? I'd certainly expect that to be both true and unremarkable these days.
taf2 7y ago
I love auto update but am amazed by how many times I have run into a customer reporting an strange issue only find out they have not upgraded their browser in over a year because of some admin policy that prevents auto update...
- nirvdrum 7y ago
  Just in case you were unaware, Firefox has extended support releases [1] for environments where rapid releases are too much hassle. This is a supported option from Mozilla whereby you get security fixes but the feature set doesn't change for 42 weeks. Which is to say that ESRs aren't some odd admin policy, but rather part of the supported Firefox line and widely used in bigger companies. Apologies if you were aware and were talking about some other admin policy. I've run into other devs that weren't aware, so thought I'd share. 1 - https://support.mozilla.org/en-US/kb/choosing-firefox-update-channel https://support.mozilla.org/en-US/kb/choosing-firefox-update...

DangerousPie 7y ago

Can we add something to the title to clarify that these bugs were fixed months ago? Eg. "(fixed in June)"? It's still an interesting post, but nowhere near as worrying for Firefox users as it sounds.

dang 7y ago
Ok, added above.

crumbshot 7y ago

Interested readers should check out the author's earlier work exploiting CVE-2019-9810: https://github.com/0vercl0k/CVE-2019-9810 https://github.com/0vercl0k/CVE-2019-9810 And their fantastically detailed writeup of a PoC they wrote for that vulnerability: https://doar-e.github.io/blog/2019/06/17/a-journey-into-ionmonkey-root-causing-cve-2019-9810/ https://doar-e.github.io/blog/2019/06/17/a-journey-into-ionm... This exploit is different in that they use the arbitrary read/write primitive gained by CVE-2019-9810 to flip a couple of bits and patch out a few instructions with the effect of removing the security boundary between a normal web page and XPCOM. The interesting difference in this exploitation approach is there's no need for ROP chains and shellcode, as you have all the XPCOM components available to use. Once they're in that privileged context in the content process, they escape its sandbox by exploiting CVE-2019-11708. This works by sending an particular IPC message to the parent process, that causes a web page of the exploiter's choice to load in that process. In this case, the choice is to exploit CVE-2019-9810 again, then use XPCOM components to drop an executable to disk and run it. Awesome work, and a real pleasure to read, it's satisfying to see such well-commented and clear exploit code.