6 ms·

Letting users block injected third-party DLLs in Firefox

103 points by nateb2022 3y ago

CuriousCosmic 3y ago
I'd be curious whether the DLLs for graphics drivers count as 3rd party or not as the only non-windows DLLs I saw on my `about:third-party` page were nvwgf2umx.dll and nvldumdx.dll which are both part of Nvidia's gpu drivers (presumably for hardware acceleration).
- rzzzt 3y ago
  I also see Intel IGD and AMD stuff in the list on my machine. According to the article, they are considered to be 3rd party libraries: "other uses include hardware drivers" and "any DLL not digitally signed by Mozilla or part of the OS" are the relevant quotes.
  - DiabloD3 3y ago
    So why are AMD, Intel, and Nvidia shipping improperly designed DLLs as part of their drivers? That's a larger red flag than anything involving Firefox. I know some people consider proper binary signing difficult on Windows and find the UAC prompts annoying, but those are multi-billion dollar companies, I'm pretty sure they can figure it out. If anything, Firefox shouldn't be the one doing this, Windows itself should be preventing loading of unsigned/improperly signed DLLs without a UAC prompt.
    - deleted 3y ago
      [deleted]
    - Dalewyn 3y ago
      Windows already blocks installation and execution of drivers that aren't signed by Microsoft under their WHQL[1] program. You can turn the blocking off, but that's a deliberate choice made as a sysadmin or power user. Drivers from Intel/Nvidia/AMD are signed by Microsoft, WHQL certified, and are not part of Windows, so as far as Mozilla is concerned they are third-party drivers. [1]: https://learn.microsoft.com/en-us/windows-hardware/drivers/install/whql-release-signature https://learn.microsoft.com/en-us/windows-hardware/drivers/i...
      - delfinom 3y ago
        WHQL isn't required btw, but Microsoft does require drivers to have a valid EV code signing cert to be loaded by the OS. WHQL is only required for distribution in Windows Update.
    - formerly_proven 3y ago
      > So why are AMD, Intel, and Nvidia shipping improperly designed DLLs as part of their drivers? That's a larger red flag than anything involving Firefox. What do you mean by "improperly designed DLLs"? The presence of these is totally normal because most of the graphics drivers are implemented in user-mode and loaded into whatever process uses Direct3D or another graphics API. If you block these, you won't be able to use 3D APIs.
    - pjc50 3y ago
      > why are AMD, Intel, and Nvidia shipping improperly designed DLLs as part of their drivers? Nvidia are notoriously .. not good, but a substantial part of the 3D API runs client-side userspace, and a substantial part of the huge NVIDIA "geforce experience" is a set of game-specific patches, because NVIDIA have their own opinions on how to optimise for framerate. It also provides a whole bunch of features! There's an entire overlay screen you can bring up with screenshot/video recording options, camera effects for screenshots, etc. (also top tip even if you don't have NVIDIA - try pressing Win-G in random applications to see if they count as "games" which will let you use the DirectX screen recorder provided by Windows) > Windows itself should be preventing loading of unsigned/improperly signed DLLs without a UAC prompt. That's the "UAP" model and its successor, which provide mobile-like actual app isolation. Otherwise you (or rather, processes running as your user account or above) can generally just inject at runtime any DLL into any process.
    - dncornholio 3y ago
      Who says they are improperly designed? We don't even know what DLL's causes the crashes yet. Don't jump to conclusions.
    - matheusmoreira 3y ago
      > So why are AMD, Intel, and Nvidia shipping improperly designed DLLs as part of their drivers? It's part of their "value add" I guess. Nvidia drivers will literally patch video games behind the scenes. It's so insane I can't believe it even works.
      - josefx 3y ago
        Games have a long history of being buggy messes and video card drivers have a long history of patching around those issues. Even Windows does, Microsoft actively checked if SimCity 2000 was running because without special treatment it would crash on newer Windows Versions due to an allocator bug.
- tallanvor 3y ago
  I'm curious what is causing them to be loaded - on my system Firefox shows that no 3rd party DLLs have been injected.
  - whoopdedo 3y ago
    Windows shell extensions such as context menu handlers. Along with my GPU driver I have injections from LibreOffice, 7-Zip, and Notepad++ to name a few. You'd think they'd only need to hook into Explorer.exe but alas no, they show up in every process. I guess because of the file picker dialog which is an embedded Explorer window running in the host process. And perhaps a reason why Mozilla wants to hurry and get off of Windows 7.
vtlygtxyf 3y ago
[dead]
krackers 3y ago
On OSX, Chromium used to do something similar before hardened runtime became a thing: https://chromium.googlesource.com/chromium/src/+/578c7a852a4ecd586d46c6ba42ef8c77430d435e/chrome/common/mac/cfbundle_blocker.mm https://chromium.googlesource.com/chromium/src/+/578c7a852a4...
userbinator 3y ago
Should Mozilla (or any other group) get to decide what I can or cannot do to a process running on my hardware, even if it originated from them? Things like this make me feel uneasy because it seems to be sitting on the edge of a slippery slope. Another example of these "silently user-hostile" applications is VirtualBox; it spawns multiple processes in a similar way, and even resists attempts to debug it if it's already running. I remember being incensed enough by it complaining about my --- patched to make the OS work for me and no others --- system DLLs not matching its internal whitelist and not starting, but not after I exercised the same skills to patch out those checks in it.
- rzzzt 3y ago
  It looks like you get to decide which DLL can stay and which one will be blocked from loading. When do you expect the shiny ball of control to be taken away from users?
- CJefferson 3y ago
  I don't understand how you can be so negative. The title literally says it is giving users that power. This is empowering you, by giving you the ability to see which DLLs are being injected into Firefox. They do block some by default, certainly, but only ones which in practice just crash Firefox (often because they are old).
  - userbinator 3y ago
    To need to be "giving" something that should be, for lack of better phrasing, a given, is not a good sign. They do block some by default, certainly, but only ones which in practice just crash Firefox (often because they are old). Is there a way to unblock them as easily as blocking them?
    - drdaeman 3y ago
      I can't test this, but I suppose it should be as easy as going to about:third-party and clicking a button next to a blocked entry. Probably preemptively learning about how to reset this if Firefox won't start anymore. As long as it's all end user-controlled, I suppose the only issue is awareness that this feature exists and how it's controlled (this is the first time I've read about it). Also, it feels somewhat weird to have this function in an application rather than at the OS level (or as a independent process firewall application) - but I suppose this is fine.
floomk 3y ago
This seems like a job for the operating system or antivirus software. Not of a browser.
- pixl97 3y ago
  Windows does a pretty good job of failing to be a user controlled operating system. Also that AV is far more apt to be guilty of injecting some bullshit into the process space.
  - floomk 3y ago
    > Windows does a pretty good job of failing to be a user controlled operating system. Then the OS has spoken. Having user space applications pretend to include security barriers that can be easily circumvented is not the way. > Also that AV is far more apt to be guilty of injecting some bullshit into the process space. Many AVs have a terrible track record, yes. Perhaps if Mozilla actually cared they should start their own and try to do better? At least it would run as a privileged process and have some chance at success.
    - asadotzler 3y ago
      MS does a fine engough job with Defender that I don't think this is needed. What we need is for the last of the third party AV vendors to die.
londons_explore 3y ago
Note that these third party DLL's are a frequent cause of crashes and bugs. The user sees "firefox has crashed". But the reality is that your antivirus dll has crashed inside firefox, and firefox is getting the blame for being crappy software.
- daveguy 3y ago
  Can Firefox not be protected with standard error handling procedures and abstraction to not crash a page or the whole browser when a plugin goes wrong? Chrome has plugins and it rarely crashes with the plugins I typically use. Originally, I had to switch from Firefox because of unstable plugins (although I have come back on mobile, because at least they gave plugins). How is Chrome able to encapsulate, but Firefox isn't? And why shouldn't that be blamed on the browser itself? Maybe I am confusing "extensions" and "plugins". If so, how are they different?
  - londons_explore 3y ago
    > Can Firefox not be protected with standard error handling procedures Unfortunately, the way these third party injected DLL's work, they have full access to all memory within the firefox process. When they go wrong, they can corrupt or change anything, so it is pretty hard to protect against them. > Chrome has plugins and it rarely crashes with the plugins I typically use. Chrome doesn't allow 3rd party DLL's either. Chrome plugins run inside the javascript VM. They made the change 5+ years ago, and it really helped stopping crashes.
    - daveguy 3y ago
      Thank you for the clarification on the inner workings of both Firefox and Chrome! I hope Firefox moves to making blocked 3rd party dlls the default. Apparently the major chrome plugins have been able to work around it.
      - londons_explore 3y ago
        It's notable that most third party DLL's usually aren't made for chrome/firefox specifically. They inject into every program. They're normally things like the a gaming mouse which has a DLL that injects into every windows process to make the mouse light change colour when you hover over a text field. Or a 'firewall' that injects into every process to try and find HTTPS encryption keys so it can scan HTTPS content in realtime. Or a 'password protected folders' feature that will pop up a dialog box if any program tries to read a file in a protected folder and ask for the unlock password. And all 3 of those can easily crash in Firefox. The gaming mouse doesn't understand that firefox renderers live in a sandbox, so when it tries to send a message to the mouse to change the light color that breaches the sandbox causing a crash. The 'firewall' assumes the https encryption key will be in memory of the process making the TCP connection - but in a multi-process architecture that may not be the case - so crashes. The 'password protected folders' makes a dialog box, but hangs the calling thread until the user types the password. Because firefox is multi-process, they have a hang detector which thinks the process has locked up so kills it, and the user thinks it crashed. All in all, these 'kinda plugins for windows, but not using any official API' are a bad idea when they interact with code they have never been tested to work with. Thats the real problem.
hiccuphippo 3y ago
Is there any documentation on injecting DLLs into Firefox?

103 points by nateb2022 3y ago

I'd be curious whether the DLLs for graphics drivers count as 3rd party or not as the only non-windows DLLs I saw on my `about:third-party` page were nvwgf2umx.dll and nvldumdx.dll which are both part of Nvidia's gpu drivers (presumably for hardware acceleration).

rzzzt 3y ago
I also see Intel IGD and AMD stuff in the list on my machine. According to the article, they are considered to be 3rd party libraries: "other uses include hardware drivers" and "any DLL not digitally signed by Mozilla or part of the OS" are the relevant quotes.
- DiabloD3 3y ago
  So why are AMD, Intel, and Nvidia shipping improperly designed DLLs as part of their drivers? That's a larger red flag than anything involving Firefox. I know some people consider proper binary signing difficult on Windows and find the UAC prompts annoying, but those are multi-billion dollar companies, I'm pretty sure they can figure it out. If anything, Firefox shouldn't be the one doing this, Windows itself should be preventing loading of unsigned/improperly signed DLLs without a UAC prompt.
  - deleted 3y ago
    [deleted]
  - Dalewyn 3y ago
    Windows already blocks installation and execution of drivers that aren't signed by Microsoft under their WHQL[1] program. You can turn the blocking off, but that's a deliberate choice made as a sysadmin or power user. Drivers from Intel/Nvidia/AMD are signed by Microsoft, WHQL certified, and are not part of Windows, so as far as Mozilla is concerned they are third-party drivers. [1]: https://learn.microsoft.com/en-us/windows-hardware/drivers/install/whql-release-signature https://learn.microsoft.com/en-us/windows-hardware/drivers/i...
    - delfinom 3y ago
      WHQL isn't required btw, but Microsoft does require drivers to have a valid EV code signing cert to be loaded by the OS. WHQL is only required for distribution in Windows Update.
  - formerly_proven 3y ago
    > So why are AMD, Intel, and Nvidia shipping improperly designed DLLs as part of their drivers? That's a larger red flag than anything involving Firefox. What do you mean by "improperly designed DLLs"? The presence of these is totally normal because most of the graphics drivers are implemented in user-mode and loaded into whatever process uses Direct3D or another graphics API. If you block these, you won't be able to use 3D APIs.
  - pjc50 3y ago
    > why are AMD, Intel, and Nvidia shipping improperly designed DLLs as part of their drivers? Nvidia are notoriously .. not good, but a substantial part of the 3D API runs client-side userspace, and a substantial part of the huge NVIDIA "geforce experience" is a set of game-specific patches, because NVIDIA have their own opinions on how to optimise for framerate. It also provides a whole bunch of features! There's an entire overlay screen you can bring up with screenshot/video recording options, camera effects for screenshots, etc. (also top tip even if you don't have NVIDIA - try pressing Win-G in random applications to see if they count as "games" which will let you use the DirectX screen recorder provided by Windows) > Windows itself should be preventing loading of unsigned/improperly signed DLLs without a UAC prompt. That's the "UAP" model and its successor, which provide mobile-like actual app isolation. Otherwise you (or rather, processes running as your user account or above) can generally just inject at runtime any DLL into any process.
  - dncornholio 3y ago
    Who says they are improperly designed? We don't even know what DLL's causes the crashes yet. Don't jump to conclusions.
  - matheusmoreira 3y ago
    > So why are AMD, Intel, and Nvidia shipping improperly designed DLLs as part of their drivers? It's part of their "value add" I guess. Nvidia drivers will literally patch video games behind the scenes. It's so insane I can't believe it even works.
    - josefx 3y ago
      Games have a long history of being buggy messes and video card drivers have a long history of patching around those issues. Even Windows does, Microsoft actively checked if SimCity 2000 was running because without special treatment it would crash on newer Windows Versions due to an allocator bug.
tallanvor 3y ago
I'm curious what is causing them to be loaded - on my system Firefox shows that no 3rd party DLLs have been injected.
- whoopdedo 3y ago
  Windows shell extensions such as context menu handlers. Along with my GPU driver I have injections from LibreOffice, 7-Zip, and Notepad++ to name a few. You'd think they'd only need to hook into Explorer.exe but alas no, they show up in every process. I guess because of the file picker dialog which is an embedded Explorer window running in the host process. And perhaps a reason why Mozilla wants to hurry and get off of Windows 7.

vtlygtxyf 3y ago

[dead]

krackers 3y ago

On OSX, Chromium used to do something similar before hardened runtime became a thing: https://chromium.googlesource.com/chromium/src/+/578c7a852a4ecd586d46c6ba42ef8c77430d435e/chrome/common/mac/cfbundle_blocker.mm https://chromium.googlesource.com/chromium/src/+/578c7a852a4...

userbinator 3y ago

Should Mozilla (or any other group) get to decide what I can or cannot do to a process running on my hardware, even if it originated from them? Things like this make me feel uneasy because it seems to be sitting on the edge of a slippery slope. Another example of these "silently user-hostile" applications is VirtualBox; it spawns multiple processes in a similar way, and even resists attempts to debug it if it's already running. I remember being incensed enough by it complaining about my --- patched to make the OS work for me and no others --- system DLLs not matching its internal whitelist and not starting, but not after I exercised the same skills to patch out those checks in it.

rzzzt 3y ago
It looks like you get to decide which DLL can stay and which one will be blocked from loading. When do you expect the shiny ball of control to be taken away from users?
CJefferson 3y ago
I don't understand how you can be so negative. The title literally says it is giving users that power. This is empowering you, by giving you the ability to see which DLLs are being injected into Firefox. They do block some by default, certainly, but only ones which in practice just crash Firefox (often because they are old).
- userbinator 3y ago
  To need to be "giving" something that should be, for lack of better phrasing, a given, is not a good sign. They do block some by default, certainly, but only ones which in practice just crash Firefox (often because they are old). Is there a way to unblock them as easily as blocking them?
  - drdaeman 3y ago
    I can't test this, but I suppose it should be as easy as going to about:third-party and clicking a button next to a blocked entry. Probably preemptively learning about how to reset this if Firefox won't start anymore. As long as it's all end user-controlled, I suppose the only issue is awareness that this feature exists and how it's controlled (this is the first time I've read about it). Also, it feels somewhat weird to have this function in an application rather than at the OS level (or as a independent process firewall application) - but I suppose this is fine.

floomk 3y ago

This seems like a job for the operating system or antivirus software. Not of a browser.

pixl97 3y ago
Windows does a pretty good job of failing to be a user controlled operating system. Also that AV is far more apt to be guilty of injecting some bullshit into the process space.
- floomk 3y ago
  > Windows does a pretty good job of failing to be a user controlled operating system. Then the OS has spoken. Having user space applications pretend to include security barriers that can be easily circumvented is not the way. > Also that AV is far more apt to be guilty of injecting some bullshit into the process space. Many AVs have a terrible track record, yes. Perhaps if Mozilla actually cared they should start their own and try to do better? At least it would run as a privileged process and have some chance at success.
  - asadotzler 3y ago
    MS does a fine engough job with Defender that I don't think this is needed. What we need is for the last of the third party AV vendors to die.

londons_explore 3y ago

Note that these third party DLL's are a frequent cause of crashes and bugs. The user sees "firefox has crashed". But the reality is that your antivirus dll has crashed inside firefox, and firefox is getting the blame for being crappy software.

daveguy 3y ago
Can Firefox not be protected with standard error handling procedures and abstraction to not crash a page or the whole browser when a plugin goes wrong? Chrome has plugins and it rarely crashes with the plugins I typically use. Originally, I had to switch from Firefox because of unstable plugins (although I have come back on mobile, because at least they gave plugins). How is Chrome able to encapsulate, but Firefox isn't? And why shouldn't that be blamed on the browser itself? Maybe I am confusing "extensions" and "plugins". If so, how are they different?
- londons_explore 3y ago
  > Can Firefox not be protected with standard error handling procedures Unfortunately, the way these third party injected DLL's work, they have full access to all memory within the firefox process. When they go wrong, they can corrupt or change anything, so it is pretty hard to protect against them. > Chrome has plugins and it rarely crashes with the plugins I typically use. Chrome doesn't allow 3rd party DLL's either. Chrome plugins run inside the javascript VM. They made the change 5+ years ago, and it really helped stopping crashes.
  - daveguy 3y ago
    Thank you for the clarification on the inner workings of both Firefox and Chrome! I hope Firefox moves to making blocked 3rd party dlls the default. Apparently the major chrome plugins have been able to work around it.
    - londons_explore 3y ago
      It's notable that most third party DLL's usually aren't made for chrome/firefox specifically. They inject into every program. They're normally things like the a gaming mouse which has a DLL that injects into every windows process to make the mouse light change colour when you hover over a text field. Or a 'firewall' that injects into every process to try and find HTTPS encryption keys so it can scan HTTPS content in realtime. Or a 'password protected folders' feature that will pop up a dialog box if any program tries to read a file in a protected folder and ask for the unlock password. And all 3 of those can easily crash in Firefox. The gaming mouse doesn't understand that firefox renderers live in a sandbox, so when it tries to send a message to the mouse to change the light color that breaches the sandbox causing a crash. The 'firewall' assumes the https encryption key will be in memory of the process making the TCP connection - but in a multi-process architecture that may not be the case - so crashes. The 'password protected folders' makes a dialog box, but hangs the calling thread until the user types the password. Because firefox is multi-process, they have a hang detector which thinks the process has locked up so kills it, and the user thinks it crashed. All in all, these 'kinda plugins for windows, but not using any official API' are a bad idea when they interact with code they have never been tested to work with. Thats the real problem.

hiccuphippo 3y ago

Is there any documentation on injecting DLLs into Firefox?