13 ms·

Improved Process Isolation in Firefox 100

• brian_herman 4y ago
  Nice job firefox team!
  • deleted 4y ago
    [deleted]
• ldng 4y ago
  Is that what definitively broke uMatrix ?
  • rhn_mk1 4y ago
    While uMatrix is somewhat broken (lets things through on some "special" refreshes), it's not totally broken. Or am I seeing something else?
  • ComputerGuru 4y ago
    Extremely unlikely, as uMatrix doesn't do any direct systems programming.
  • pabs3 4y ago
    uMatrix is unmaintained, I wonder if there is a replacement for it...
    • ldng 4y ago
      Not any as efficient that I'm aware of (happy to be proven wrong)
      • joveian 4y ago
        Not as efficient but uBlock Origin in advanced mode lets you get fairly close, although not with quite as fine grained control from the main UI (however you do get very detailed control via the logger and directly writing rules). The one thing I've had an issue with is that replacing a frame with a link to popup the frame in a new window seems to not work the same, at least last I checked maybe a year ago (the easily available method didn't do quite the same thing as uMatrix and I gave up before figuring out if it was possible to get uBO to do the same thing via some means). This mostly means that I've had to run google javascript on sites with embedded YouTube that I didn't before, but otherwise there hasn't been much difference in practice once I got used to the uBO way of doing things. The other major issue for me is the lack of the "ruleset recipes" as far as I can tell that means you need to reload a bunch of times if you start blocked an only allow certain stuff (such as the YouTube videos) for a particular session. I have left more scripts always enabled because of that even when I don't need them much of the time.
  • computerfriend 4y ago
    What about uMatrix is broken?
    • ldng 4y ago
      It now shows as deactivated by default on every new page
• whitepoplar 4y ago
  What's the state of browser security these days? Does Chrome still have a lead over Safari and Firefox?
  • jimrandomh 4y ago
    Yes, it does, at least if you go by how much money the sketchy vulnerability brokers are offering to pay. On https://zerodium.com/program.html https://zerodium.com/program.html a Chrome RCE+LPE is "Up to $500k", while the other browsers are all less.
    • leoc 4y ago
      I guess that that partly reflects its greater market share though.
      • guilhas 4y ago
        And that attackers also focus more on the higher market share Chrome is also not immune, very recently had a serious flaw "actively exploited" https://www.bleepingcomputer.com/news/security/google-chrome-emergency-update-fixes-zero-day-used-in-attacks/ https://www.bleepingcomputer.com/news/security/google-chrome...
      • mlinksva 4y ago
        I wonder how those $ amounts are arrived at, I don't see in FAQ. Maybe a third party study of potential factors and prices (quick search I'm not finding anything promising)? Surely market share/adoption is very significant, but something else must explain e.g., 2.5x more for Apache RCE than Nginx RCE?
        • Hackbraten 4y ago
          There are several factors that may affect per-app supply and demand. - How expensive is it to discover a new vulnerability in a given app? (This may depend on code base maturity but also on choice of programming language, its inherent memory safety, and supply chain.) - What privileges does a typical installation of the app grant once RCE is achieved? - How hard is it to write a working exploit for a newly-discovered vulnerability, taking into account the security architecture that protects the app? - Given a zero-day exploit, how many times will you have the opportunity to use it? How quickly will other parties discover it, is the vendor willing to provide patches, how long it is going to take, how much do the updates cost, and how difficult is it to upgrade the software in the field? - Apps and computers tend to come in packs, and attackers love to move laterally. What opportunities would an attacker gain from lateral movement after gaining persistence in a given system? - Market share and adoption may be skewed, as attackers may be interested in specific targets such as journalists or politicians, who may form a specific demographic with particular adoption rates, which can differ from those of the general population.
• SemanticStrengh 4y ago
  • deleted 4y ago
    [deleted]
• _wldu 4y ago
  I firmly believe that isolation is the future of endpoint security and I like experimenting with Mandatory Access Control (MAC) on Linux. Tomoyo is my favorite major MAC/LSM in the Linux kernel. If you have a newer kernel (5.13 or greater), you may like to experiment with landlock. It's pretty cool and unlike FireJail, no suid required. Here's a landlock wrapper for Firefox: https://github.com/62726164/misc/blob/main/go/landlock/firefox/main.go https://github.com/62726164/misc/blob/main/go/landlock/firef... I'd like to learn more about open source/free Windows and MacOS MAC tools. If you know of any, please post about your experience with them. Edit: This Windows functionality seems similar to seccomp and pledge: https://docs.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-process_mitigation_system_call_disable_policy https://docs.microsoft.com/en-us/windows/win32/api/winnt/ns-...
  • lewantmontreal 4y ago
    Wow that looks cool. I really want to install apps without entrusting my entire hard drive to them.
    • rockdoe 4y ago
      Unix applications run as a user, so it's not like they have that permission. Looking at that profile, it restricts write access to the home directory to only the Firefox profile and some config files. I guess that makes sense, but you'd have to be aware of it when uploading and downloading stuff (it would only work from a specific designated folder).
      • kaba0 4y ago
        And where are all the valuable files stored like family pictures, other browsers’ cache, ssh keys etc.? In the same user’s home dir, so in practice most desktop apps do have uncontrolled access to everything on the harddrive as per the now quite old xkcd comic ( https://xkcd.com/1200/ https://xkcd.com/1200/ ). Ideally, a “shadow” Download folder would be accessible to the process, and its content would be mirrored one-way into the real Downloads folder. Upload should display a file chooser dialog which runs in an entirely different process, and the chosen files should be in effect copied to the process’s file handles list.
• pcwalton 4y ago
  This is a bit buried at the bottom, but: > For Linux users, we removed the connection from content processes to the X11 Server, which stops attackers from exploiting the unsecured X11 protocol. It's hard to overstate how much of a benefit this is in terms of security for those on Linux. Any application with access to the X11 socket effectively has the keys to the kingdom, because it can hijack other applications, including those running at higher privileges, at will. (There have been halfhearted attempts to address this over the years, but nothing that's been effective or widely adopted.) The only real solution for desktop app security on Linux is to forbid direct access to X11 entirely, and so it's a huge deal that Firefox is now able to do this. In general, doing this sort of thing is a monumental undertaking for large applications like Firefox. Kudos to my former colleagues for pulling it off.
  • ntnsndr 4y ago
    Is this why my Firefox window went black randomly for a few seconds today?
    • Caspy7 4y ago
      In my experience, most of the time black drawing like that is associated with GPU driver issues.
  • enriquto 4y ago
    Does this mean that I will no longer be able to ssh -X myvm firefox ? This is my way of browsing and I feel much safer than running it raw.
    • Hackbraten 4y ago
      That should still work. They didn’t isolate all the Firefox processes from X11. Only the content processes are affected, i.e. the processes whose attack surface is rather massive. But the content processes are still going to deliver their finished work items to the GPU process for rendering. The GPU process retains all the rights it needs, including talking to X11.
    • 4y ago
• ComputerGuru 4y ago
  It's a real shame that platform native widgets had to be sacrificed for this to work. The easy way out was to switch to arbitrary app-drawn widgets across all platforms (which Firefox did for all basic DOM HTML elements); the "we'll do one better" alternative is to use app-drawn imitations of the system-native widgets (a la Qt) which Firefox is now doing for the scrollbar. But no one ever gets these widgets right (unnatural scrolling, non-identical behavior when clicking in the gapped region, different scrollable-to-nonscrollable widget ratios, colors not respecting certain subtle theming choices, etc, etc. I wonder if there was an alternative specifically for the scrollbar here - some way of obtaining an outer "shell" (via win32k, but then basically "orphaning" it so that you can't do anything besides kill it when you're finished) that just provides the window with an empty scrollable element that is then populated by the restricted process. That ship has really sailed though; I think the days of native widgets are quickly coming to an end.
  • chrisseaton 4y ago
    The OS should provide a safe API for how to draw native widgets and how they behave. Then you can draw your own anywhere.
    • kevingadd 4y ago
      fwiw, Windows does have an API (called uxtheme, I believe) that you can use to draw native widgets.
      • rossy 4y ago
        Firefox already used uxtheme for that. A lot of programs and toolkits do, since the heavyweight HWND-based comctl32 controls aren't suitable for things like browsers because they're slow, hard to render without flicker, there's a limit on how many you can have, they don't play well with effects like opacity and transform3d() and so on. Even Internet Explorer did[1]. I guess uxtheme is unsuitable for win32k lockdown for some reason, probably because it's GDI-based. [1]: https://devblogs.microsoft.com/oldnewthing/20050211-00/?p=36473 https://devblogs.microsoft.com/oldnewthing/20050211-00/?p=36...
• ellis0n 4y ago
  Process isolation improvement never ends. Firefox 100, FF 1000, FF Universe... will be improved and hacked again. Why?
• gernb 4y ago
  Maybe I'll finally be able to consider Firefox secure as Chrome by design instead of just praying. It's been a 14 years
  • aaaaaaaaata 4y ago
    You've got years more to wait, I'm afraid.
    • notriddle 4y ago
      What's remaining?
      • rockdoe 4y ago
        My understanding is that same-old memory safety errors in C++ are still the main source of initial exploits for these browsers. Chromium has been looking at things like MiraclePtr, whereas Mozilla has been moving to Rust and RLBox (and Chromium is trying the former, too): https://security.googleblog.com/2021/09/an-update-on-memory-safety-in-chrome.html https://security.googleblog.com/2021/09/an-update-on-memory-... I think I agree with the other poster saying that "practically speaking there's probably not a ton of difference". There used to be a wider gap, but both browsers have all the important stuff now, with any differences being much more incremental. I assume neither is going to get rid of their shitty old C++ codebase anytime soon, which would be the real win. For sandboxing you're also restricted by what the OS offers in the first place. So expect innovation on Android, or ARM macOS, not Chrome/Firefox on Windows.
• Dwedit 4y ago
  So here we have a feature of Windows 8/10, which prevents the system calls of Win32U/Win32K from being called. When you write a Windows program, you call APIs from User32.dll, GDI32.dll, and Kernel32.dll. Those are the user mode libraries, and the main entry point to call the Windows API functions. What's actually inside of those? User32 and GDI32 are pretty much stubs. Mostly, they have a small amount of code, then proceed to call functions in Win32U.dll. Then Win32U.dll makes system calls, causing Win32k (Kernel Mode) to carry out the functions. So everything from BeginPaint to GetWindowText is going to be a system call that's placed from within Win32U, then handled by Win32K. Meanwhile, Kernel32.dll is a user-mode library (despite the name being "kernel32"), which mostly makes calls to NTDLL.dll. Then NTDLL makes system calls that get handled by kernel-mode components. The isolation thing that Mozilla is using here does not stop the NTDLL system calls that Kernel32.dll uses, just the calls to Win32U/Win32K (GDI32.dll and User32.dll). So there needs to be other mitigation methods in place for the Kernel32/NTDLL stuff, such as reduced user privileges. But preventing all the Win32U/Win32K stuff from being called does greatly reduce the attack surface.
  • dblohm7 4y ago
    Just to be clear: a ton of kernel32 stuff was already locked down prior to win32k being shut off. (I used to work on the author’s team)
    • Dwedit 4y ago
      How does the Kernel32 lock-down stuff work? I can think of several things you could do to Kernel32 to try to lock it down: * Patch out all the entry points of Kernel32 you don't want to be used. Then patch out their corresponding entry points out of NTDLL. Then remove the code that invokes the system calls inside of NTDLL. Yes, you can just simply overwrite user mode code willy-nilly as long as you have write access to the process memory. (Regular programs use the entry points. Someone trying to do something fancy might skip the entry points. If your hackers are using things like ROP chains and gadgets, chances are they don't care about entry points.) * Create some kind of NT security context so that nothing interesting works anymore. I don't know how this works, but many NT functions want a security context passed in. * When you are executing code, and you have no idea where Kernel32 is, you can read the module list out of the TEB, and that finds you Kernel32 and NTDLL. Maybe something that could thwart that, but not break code. In the end though, what could stop the process from attempting to SYSENTER from somewhere besides NTDLL?
• winnipeg 4y ago
  Linux / X11 arch and monolithic desktop arch in general will never suffice if endpoint security matters (for multi app desktop envs)
• theodric 4y ago
  I'm so glad they're working on this instead of unimportant minutiae like copy/cut frequently outright refusing to deposit its contents in the system clipboard on all three major platforms, or the browser simply freezing for up to ten minutes after the system wakes up from sleep while it syncs all changes made since then.