Security/Reviews/Balrog

2 Total; 0 Open (0%); 2 Resolved (100%); 0 Verified (0%);

• Property "SecReview feature goal" (as page type) with input value "Balrog is rewrite of AUS, which provides application updates to Firefox and other Mozilla products. Its code lives in a github repository.

  Firefox client makes request to AUS service with 8-9 paremeters (eg /update/3/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VERSION%/%DISTRIBUTION%/%DISTRIBUTION_VERSION%/update.xml)

  • Current system AUS
    • Serves updates to Firefox, Thunderbird, Fennec
    • Firefox client makes request to AUS service with 8-9 paremeters (eg

  /update/3/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VERSION%/%DISTRIBUTION%/%DISTRIBUTION_VERSION%/update.xml)

  • • • backend attempts to match a snippet file against parameters
      • if file is found, XML version is returned
    • Lots of snippet files
    • PHP based
  • database backed update server
    • internal LDAP protected server
    • db layer keeps audit logs
  • all backend changes, no changes to client update code
  • minimal ACLs
    • admin app talks to other servers
  • seamonkey may be re-added in the future
  • Target Nightly for now
    • currently takes about 30 min to push a new beta build (with text files)
    • this would decreast to a single API call for a a few seconds to update them all
  • Q2 goal for live in nightly channel" contains invalid characters or is incomplete and therefore can cause unexpected results during a query or annotation process.
  • Property "SecReview alt solutions" (as page type) with input value "The current solution uses a large number of snippet files which are matched against the parameters.

  If a file is matched then the XML version is returned.

  There are now a very large number of snippet files which are very difficult to maintain for multiple products when they have integrated parts - it can take 30 mins to publish a new build." contains invalid characters or is incomplete and therefore can cause unexpected results during a query or annotation process.
• Property "SecReview threats considered" (as page type) with input value "Files are checked as a validity test rather than a security one.

  All access to the Admin nodes is via HTTPS with LDAP credentials. The admin actions are logged.

  Public nodes are as efficient as possible for scalability which also helps protect against DOS." contains invalid characters or is incomplete and therefore can cause unexpected results during a query or annotation process.
• Property "SecReview threat brainstorming" (as page type) with input value "A compromised admin account could be used to upload a JSON blob which points to malware.

  An attacker could intercept the binary request and serve malware on an untrusted network.

  An attacker could discover a request that consumes a significant amount of processing power on the Public nodes which could enable a DOS attack." contains invalid characters or is incomplete and therefore can cause unexpected results during a query or annotation process.