6 ms·

Browser Fuzzing at Mozilla

232 points by gbrown_ 6y ago

f430 6y ago
does mozilla or chrome have some sort of sandbox containership?
- danlugo92 6y ago
  "firefox containers"
  - sp332 6y ago
    That only "sandboxes" websites from each other, not from the system. Firefox has a sandbox but it's not Firefox Containers.
- sstangl 6y ago
  Yes, Firefox uses the same sandbox as Chromium. https://wiki.mozilla.org/Security/Sandbox/Specifics https://wiki.mozilla.org/Security/Sandbox/Specifics
  - est31 6y ago
    Note that there are some holes in the Firefox sandbox that don't exist in the Chromium one: https://bugzilla.mozilla.org/show_bug.cgi?id=1129492 https://bugzilla.mozilla.org/show_bug.cgi?id=1129492
- cjohansson 6y ago
  yes but only for Windows it seems
  - saagarjha 6y ago
    Firefox uses seccomp-bpf on Linux and the platform sandbox on macOS.
butz 6y ago
Might be a bit off topic, but does building Firefox from source use your default profile, or is it separate?
- cpeterso 6y ago
  A local build of Firefox can use any profile you like, but by default, the “mach run” build script will create a separate new profile for testing.
- jwatt 6y ago
  It depends on which branch you checked out before you built. By default you'll normally end up with a checkout of 'mozilla-central', in which case it will use a separate profile.
eigenvalue 6y ago
They don’t seem to be using a fuzzer that uses a “smart” way of creating new inputs based on previous inputs that revealed novel execution paths, as done in the AFL fuzzer ( https://en.m.wikipedia.org/wiki/American_fuzzy_lop_(fuzzer) https://en.m.wikipedia.org/wiki/American_fuzzy_lop_(fuzzer) ). I wonder why that is— that always struck me as a particular elegant approach, and I know AFL has been used to find tons of bugs in various popular open source projects. There was a popular article on HN a while back where AFL even “learned” how to generate valid jpg image file headers.
- andrei 6y ago
  I believe they use libfuzzer to test isolated components [0], but seems like they wanted to specifically focus on browser fuzzing for this post (it's probably more interesting, too). [0]: https://firefox-source-docs.mozilla.org/tools/fuzzing/fuzzing_interface.html https://firefox-source-docs.mozilla.org/tools/fuzzing/fuzzin...
- _j3sse 6y ago
  The state space is too large for these algorithms to be effective on Firefox as a whole, and there are many libraries we just don't care about when browser fuzzing. eg. if AFL/libFuzzer manages to hit a path that makes an input appear as gz encoded, the "novel" zlib coverage is very attractive to the algorithm, but that's a very inefficient way to fuzz zlib. Most of these libraries are targeted specifically by OSS-Fuzz [0] and their integration into Firefox is fuzzed with libFuzzer using the fuzzing interface andrei mentioned. 0: https://google.github.io/oss-fuzz/ https://google.github.io/oss-fuzz/
  - dkdk8283 6y ago
    What about the decrease in paid security professionals?
  - lqqq 6y ago
    AFL is not that smart. If you only do bit flippings on the inputs, then fuzzing a JavaScript engine/dom engine will take forever. The "domino" (Mozilla internal tool) looks quite powerful as it generates semantically correct dom. Sadly, it is not open source. Google has a tool designed specifically to fuzz JavaScript engines, Fuzzilli[1], which hackers have been using for bug hunting. [1]: https://github.com/googleprojectzero/fuzzilli https://github.com/googleprojectzero/fuzzilli
aaron695 6y ago
Fuzzing is probably the only AI that's actually in general use so far. Most of the others AIs are more the product really, like Chess I guess?
- romanows 6y ago
  Well, let's ask. "Hey Google, is what is AI used in?". My Google Home responded that AI is used in virtual assistants and autonomous flying among other things. She sent me a link with more info on my phone. So it sounds like it might have some other uses :P
  - aaron695 6y ago
    10,000 people working on Alexa and every time I use my Firestick it can't even search the right data, that's before we even start talking about the voice recognition quality. I wish we had virtual assistants so it could tell me a media player that actually works like it's 2021. A good Fuzzer would probably replace a few 100 of these workers. Amazon Says It Has Over 10,000 Employees Working on Alexa - https://www.wsj.com/articles/amazon-says-it-has-over-10-000-employees-working-on-alexa-echo-1542138284 https://www.wsj.com/articles/amazon-says-it-has-over-10-000-...
    - saagarjha 6y ago
      I think you have serious misconceptions of the capabilities a fuzzer has.
      - aaron695 6y ago
        I'm aware 10,000 workers is part hyperbole and mostly not coders more like HR, managing, translations and marketing but I'm pretty sure you could kill off 100 people without hurting the product given how it stands so even if the fuzzer did nothing it could replace 100 people. But it could test UI both voice and graphical, test inputs, test codebase, test load balancing, find security issues, it could help with marketing and translations. I also think a fuzzer could beat a manager at doing their job, but that's probably cynicism. You'd be better using the fuzzer at getting useless managers re-assigned.

232 points by gbrown_ 6y ago

f430 6y ago

does mozilla or chrome have some sort of sandbox containership?

danlugo92 6y ago
"firefox containers"
- sp332 6y ago
  That only "sandboxes" websites from each other, not from the system. Firefox has a sandbox but it's not Firefox Containers.
sstangl 6y ago
Yes, Firefox uses the same sandbox as Chromium. https://wiki.mozilla.org/Security/Sandbox/Specifics https://wiki.mozilla.org/Security/Sandbox/Specifics
- est31 6y ago
  Note that there are some holes in the Firefox sandbox that don't exist in the Chromium one: https://bugzilla.mozilla.org/show_bug.cgi?id=1129492 https://bugzilla.mozilla.org/show_bug.cgi?id=1129492
cjohansson 6y ago
yes but only for Windows it seems
- saagarjha 6y ago
  Firefox uses seccomp-bpf on Linux and the platform sandbox on macOS.

butz 6y ago

Might be a bit off topic, but does building Firefox from source use your default profile, or is it separate?

cpeterso 6y ago
A local build of Firefox can use any profile you like, but by default, the “mach run” build script will create a separate new profile for testing.
jwatt 6y ago
It depends on which branch you checked out before you built. By default you'll normally end up with a checkout of 'mozilla-central', in which case it will use a separate profile.

eigenvalue 6y ago

They don’t seem to be using a fuzzer that uses a “smart” way of creating new inputs based on previous inputs that revealed novel execution paths, as done in the AFL fuzzer ( https://en.m.wikipedia.org/wiki/American_fuzzy_lop_(fuzzer) https://en.m.wikipedia.org/wiki/American_fuzzy_lop_(fuzzer) ). I wonder why that is— that always struck me as a particular elegant approach, and I know AFL has been used to find tons of bugs in various popular open source projects. There was a popular article on HN a while back where AFL even “learned” how to generate valid jpg image file headers.

andrei 6y ago
I believe they use libfuzzer to test isolated components [0], but seems like they wanted to specifically focus on browser fuzzing for this post (it's probably more interesting, too). [0]: https://firefox-source-docs.mozilla.org/tools/fuzzing/fuzzing_interface.html https://firefox-source-docs.mozilla.org/tools/fuzzing/fuzzin...
_j3sse 6y ago
The state space is too large for these algorithms to be effective on Firefox as a whole, and there are many libraries we just don't care about when browser fuzzing. eg. if AFL/libFuzzer manages to hit a path that makes an input appear as gz encoded, the "novel" zlib coverage is very attractive to the algorithm, but that's a very inefficient way to fuzz zlib. Most of these libraries are targeted specifically by OSS-Fuzz [0] and their integration into Firefox is fuzzed with libFuzzer using the fuzzing interface andrei mentioned. 0: https://google.github.io/oss-fuzz/ https://google.github.io/oss-fuzz/
- dkdk8283 6y ago
  What about the decrease in paid security professionals?
- lqqq 6y ago
  AFL is not that smart. If you only do bit flippings on the inputs, then fuzzing a JavaScript engine/dom engine will take forever. The "domino" (Mozilla internal tool) looks quite powerful as it generates semantically correct dom. Sadly, it is not open source. Google has a tool designed specifically to fuzz JavaScript engines, Fuzzilli[1], which hackers have been using for bug hunting. [1]: https://github.com/googleprojectzero/fuzzilli https://github.com/googleprojectzero/fuzzilli

aaron695 6y ago

Fuzzing is probably the only AI that's actually in general use so far. Most of the others AIs are more the product really, like Chess I guess?

romanows 6y ago
Well, let's ask. "Hey Google, is what is AI used in?". My Google Home responded that AI is used in virtual assistants and autonomous flying among other things. She sent me a link with more info on my phone. So it sounds like it might have some other uses :P
- aaron695 6y ago
  10,000 people working on Alexa and every time I use my Firestick it can't even search the right data, that's before we even start talking about the voice recognition quality. I wish we had virtual assistants so it could tell me a media player that actually works like it's 2021. A good Fuzzer would probably replace a few 100 of these workers. Amazon Says It Has Over 10,000 Employees Working on Alexa - https://www.wsj.com/articles/amazon-says-it-has-over-10-000-employees-working-on-alexa-echo-1542138284 https://www.wsj.com/articles/amazon-says-it-has-over-10-000-...
  - saagarjha 6y ago
    I think you have serious misconceptions of the capabilities a fuzzer has.
    - aaron695 6y ago
      I'm aware 10,000 workers is part hyperbole and mostly not coders more like HR, managing, translations and marketing but I'm pretty sure you could kill off 100 people without hurting the product given how it stands so even if the fuzzer did nothing it could replace 100 people. But it could test UI both voice and graphical, test inputs, test codebase, test load balancing, find security issues, it could help with marketing and translations. I also think a fuzzer could beat a manager at doing their job, but that's probably cynicism. You'd be better using the fuzzer at getting useless managers re-assigned.