canmove, Confirmed users, Bureaucrats and Sysops emeriti
2,776
edits
Security/Reviews/WebTelephony: Difference between revisions
Jump to navigation
Jump to search
no edit summary
(Created page with "{{SecReviewInfo |SecReview name=Web Telephony }} {{SecReview}} {{SecReviewActionStatus |SecReview action item status=None }}") |
No edit summary |
||
| Line 1: | Line 1: | ||
{{SecReviewInfo | {{SecReviewInfo | ||
|SecReview name=Web Telephony | |SecReview name=Web Telephony | ||
|SecReview target=<bugzilla> | |||
{ | |||
"id":"747292" | |||
} | |||
</bugzilla> | |||
}} | |||
{{SecReview | |||
|SecReview feature goal=Goals | |||
*allow web content to dial out | |||
*allow content to mediate incoming calls (accept/reject/merge) | |||
*allow content to query transceiver state | |||
Bug: | |||
*B2G Meta telephony bug https://bugzilla.mozilla.org/show_bug.cgi?id=699235 | |||
*Web Telephony meta bug: https://bugzilla.mozilla.org/show_bug.cgi?id=674726 | |||
Pages: | |||
* https://wiki.mozilla.org/B2G/RIL | |||
*Detailed code walkthrough for receive call case: https://wiki.mozilla.org/B2G/Architecture#RIL:_Telephony | |||
* http://hacks.mozilla.org/2012/03/webtelephony-api-and-websms-api-part-of-webapi/ | |||
Changeset | |||
*https://hg.mozilla.org/integration/mozilla-inbound/rev/bac673bc7211 | |||
Source: | |||
*http://mxr.mozilla.org/mozilla-central/source/dom/telephony/ | |||
*https://github.com/mozilla-b2g/android-hardware-ril/blob/master/include/telephony/ril.h | |||
===Data Flow === | |||
Web Telephony is made up of the following components (from lowest level to highest level) | |||
* rild : the proprietary bit of code that talks to the proprietary modem firmware | |||
* rilproxy : the daemon that proxies messages between rild and Gecko (the b2g process) | |||
* Gecko (the b2g process) : implements the higher-level telephony stack | |||
Note that this review does not include the UI application that actually makes and receives the phone calls (e.g. phone.gaiamobile.org). In the case of Gaia these are reviewed as part of a separate review. Note that a b2g device could ship with a completely different dialer application. | |||
===Answered Questions=== | |||
* Do pages have direct access to the audio streams of a phone call? | |||
** No | |||
* Can another application record audio while a call is underway? | |||
** Not sure, but probably not. Currently no, since no API to access audiostreams. | |||
* Are the audio streams buffered anywhere on disk or is there any local record of the call (if so, what data is stored)? | |||
** Not stored on disk at all. API doesn't store any records, although Gaia app would be expected to do so. | |||
Permissions | |||
============= | |||
Only certified apps can access this API | |||
Permissions: Only dialer and homescreen would have this API | |||
|SecReview threat brainstorming=Threat matrix here: | |||
https://wiki.mozilla.org/Security/WebAPI/Web_Telephony | |||
*Unauthorized content accesses the Web Telephony API | |||
App Permissions Model will enforce which apps can access which APIs | |||
B2G security model will enforce permissions model at a process level (ie less privileged process not allowed to send IPDL messages even if permissions check fails at an API level) | |||
Code review - review the checks which enforce this | |||
*Attack from radio network | |||
Code review | |||
Fuzzing | |||
*Bug in Web Telephony stack leads to code execution vulnerability | |||
Code review | |||
Fuzzing | |||
Limiting access to API | |||
*Content spoofing phones dialer app | |||
Sort of a broader B2G issue (all apps could be spoofed) | |||
Only high-privileged content process will have access to send dialer IPDL messages | |||
*Content framing the dialer app | |||
Broader B2G issue | |||
Only high-privileged content process will have access to send dialer IPDL messages | |||
*Denial of Service on Dialer | |||
Would probably require permissions to launch these styles of attacks? | |||
}} | }} | ||
{{SecReviewActionStatus | {{SecReviewActionStatus | ||
|SecReview action item status= | |SecReview action item status=In Progress | ||
|SecReview action items=* Who :: What :: By when (Keep in mind all these things will be bugs that block the review bug, that blocks the feature bug) | |||
pauljt::Security Code review::?? | |||
cdiehl:: Fuzzing AT Commands::?? | |||
pauljt:: Investigate malicious input from phone side::?? | |||
pauljt:: Investigate audio issue further, testing audio, maybe need a function to turn off all audio::?? | |||
}} | }} | ||