View source for SecurityEngineering/Newsletter/2017Q3

=Firefox Security Team Newsletter Q3 17=

Firefox Quantum is almost here, and contains several important security improvements. Improved sandboxing, web platform hardening, crypto performance improvements and much more. Read on to find out all the security goodness coming through the Firefox pipeline.

<ul>
<li><p>Sandbox work is seeing great progress. As of 57, Windows, Mac OS X, and Linux all have file system access restricted by the sandbox which is a major milestone reached. Further [https://wiki.mozilla.org/Security/Sandbox ''restrictions''] are enabled for Windows in Firefox 58.</p></li>
<li><p>Firefox 57 treats now data URLs as unique origins, reducing the risk of Cross-Site Scripting (XSS).</p></li>
<li><p>The Firefox Multi-Account Containers Add-on [https://blog.mozilla.org/firefox/introducing-firefox-multi-account-containers/ ''shipped''], allowing users to juggle multiple identities in a single browsing session.</p></li>
<li><p>Increased [https://blog.mozilla.org/security/2017/09/29/improving-aes-gcm-performance/ ''AES-GCM performance''] in Firefox 56, and support for [https://blog.mozilla.org/security/2017/09/13/verified-cryptography-firefox-57/ ''Curve25519 in Firefox 57''] (the first [https://en.wikipedia.org/wiki/Formal_verification ''formally verified''] cryptographic algorithm in a web browser)</p></li>
<li><p>Experimental support for anti-phishing FIDO U2F “Security Key” USB devices [https://mobile.twitter.com/jamespugjones/status/912314952232267777 ''landed behind a preference''] in Firefox 57. This feature is a forerunner to W3C Web Authentication, which will bring this anti-phishing technology to a wider market.</p></li>
<li><p>The privacy WebExtension API can now be used to control the [https://bugzilla.mozilla.org/show_bug.cgi?id=1397611 '' privacy.resistFingerprinting ''] and [https://bugzilla.mozilla.org/show_bug.cgi?id=1409045 ''first party isolation''] experimental privacy features </p></li></ul>

= Team Highlights =

== Security Engineering ==

=== Crypto Engineering ===

<ul>
<li><p>AES-GCM performance is increased across the board, making large transfers more efficient in Firefox 56. [https://blog.mozilla.org/security/2017/09/29/improving-aes-gcm-performance/ ''[blog post]'']</p></li>
<li><p>Our implementation of Curve25519 in Firefox 57 is the first [https://en.wikipedia.org/wiki/Formal_verification ''formally verified''] cryptographic algorithm in a web browser. [https://blog.mozilla.org/security/2017/09/13/verified-cryptography-firefox-57/ ''[blog post]'']</p></li>
<li><p>Experimental support for anti-phishing FIDO U2F “Security Key” USB devices landed behind a preference in Firefox 57. This feature is a forerunner to W3C Web Authentication, which will bring this anti-phishing technology to a [https://twitter.com/jamespugjones/status/912314952232267777 wider market].</p></li></ul>

=== Privacy and Content Security ===
<ul>
<li><p>The privacy WebExtension API can now be used to [https://bugzilla.mozilla.org/show_bug.cgi?id=1397611 ''control the privacy.resistFingerprinting preference''] and [https://bugzilla.mozilla.org/show_bug.cgi?id=1409045 ''first party isolation'']</p></li>
<li><p>Containers launched as an extension available from [https://addons.mozilla.org/en-US/firefox/addon/multi-account-containers/ ''AMO''] (2 [https://blog.mozilla.org/firefox/introducing-firefox-multi-account-containers/ ''blog''] [https://blog.mozilla.org/tanvi/2017/10/03/update-firefox-containers/ ''posts''])</p></li>
<li><p>Containers have had a few improvements for web extensions [https://hacks.mozilla.org/2017/10/containers-for-add-on-developers/ ''web extensions'']:</p>
<ul>
<li><p>Containers now enabled when installing a contextual identity extension</p></li>
<li><p>Events to monitor container changes</p></li>
<li><p>Ability to get icon urls for containers along with hex colour codes</p></li>
<li><p>Cleaner APIs</p></li></ul>
</li>
<li><p>Lightbeam was remade as a  [https://hacks.mozilla.org/2017/10/remaking-lightbeam-as-a-browser-extension/ ''web extension.'']</p></li>
<li><p>Firefox 57 treats data URLs as unique origins [[https://blog.mozilla.org/security/2017/10/04/treating-data-urls-unique-origins-firefox-57/ ''unique origins'']] which mitigates the risk of XSS, make Firefox standard-compliant and consistent with the behavior of other browsers.</p></li>
<li><p>Shipped version 4 of the Safe Browsing protocol.</p></li></ul>

=== Firefox and Tor Integration ===

<ul>
<li><p>Continue the Tor patch uplift work focusing on [https://wiki.mozilla.org/Security/Fingerprinting ''browser fingerprinting resistance'']</p>
<ul>
<li><p>Landed 12 more anti-fingerprinting patches in 57</p></li></ul>
</li>
<li><p>The MinGW build has landed in mozilla-central and is available in treeherder</p></li></ul>

=== Content Isolation ===

<ul>
<li><p>Various Windows content process security features enabled over the quarter including [https://bugzilla.mozilla.org/show_bug.cgi?id=1381326 ''disabling of legacy extension points''] (56), [https://bugzilla.mozilla.org/show_bug.cgi?id=1314801 ''image load policy improvements''] (57), [https://bugzilla.mozilla.org/show_bug.cgi?id=1403707 ''increased restrictions''] on job objects (58), and finally we've enabled the [https://bugzilla.mozilla.org/show_bug.cgi?id=1229829 ''alternate desktop feature''] in Nightly after battling various problems with anti-virus software interfering with child process startup.</p></li>
<li><p>The [https://bugzilla.mozilla.org/show_bug.cgi?id=1308400 ''new 'default deny' read access policy''] for the [https://bugzilla.mozilla.org/show_bug.cgi?id=1308400 ''Linux file access broker''] is now enabled by default for content processes and is rolling out in Firefox 57. The broker forwards content process file access requests to the parent process for approval, severely restricting what a compromised content process could do within the local file system.</p></li>
<li><p>Numerous access rules associated with file system, operating system services, and device access have been removed from the OSX content process sandbox. In terms of file system access, we've reached parity with Chrome's renderer. Remaining print server access will be removed in Q4, removal of graphics and audio access is currently in planning.</p></li>
<li><p>We continue to invest in cleaning up various areas of the code that have accumulated technical debt.</p></li>
<li><p>We’ve completed our research on the scope of enabling the [https://msdn.microsoft.com/en-us/library/windows/desktop/hh871472(v=vs.85).aspx ''Win32k System Call Disable Policy''] feature. This feature will isolate content processes from a large class of Win32k kernel APIs commonly used to gain sandbox escape and privilege escalation. Planning for this [https://bugzilla.mozilla.org/show_bug.cgi?id=1381019 ''long term project''] is currently underway with work expected to commence in Q4.</p></li>
<li><p>As a result of the stability and process startup problems encountered due to 3rd party code injection, a new internal initiative has formed to better address problems associated with unstable software injected into Firefox. This cross-team group will explore and improve policy revolving around outreach and blocking, data collection and research, and improved injection mitigation techniques within Firefox.</p></li></ul>

== Operations Security ==

<ul>
<li><p>addons.mozilla.org and Firefox Screenshots went through external security audits. The reports will be released soon.</p></li>
<li><p>Internal audits of Crash Reports and Phabricator were completed and have found no maximum or high risk issues.</p></li>
<li><p>addons.mozilla.org, Crash Reports, Telemetry, Pontoon, Push and Tracking Protection backends have been connected to pyup.io to track vulnerabilities in upstream Python dependencies.</p></li>
<li><p>Verification of the signature of installer and update files has been integrated to the product delivery pipeline, to prevent an attacker from feeding an improperly signed file to our download sites.</p></li></ul>

== Security Assurance ==

<ul>
<li><p>Developed new static analysis tool to detect sandbox-related flaws in IPDL endpoints.</p></li>
<li><p>Established mobile security review process to cover projects coming through New Mobile Experience pipeline.</p></li>
<li><p>[https://bugzilla.mozilla.org/show_bug.cgi?id=1394433 ''Identified a number of warnings''] by building for Windows with gcc, and resolved many of them.</p></li></ul>

== Cross-Team Initiatives ==

<ul>
<li><p>Google has become an official [http://ccadb.org/rootstores/how ''Root Store Member''] of the [http://ccadb.org/ ''Common CA Database (CCADB)''].</p></li></ul>

= Security Blog Posts &amp; Presentations =

<ul>
<li><p>[https://blog.mozilla.org/firefox/introducing-firefox-multi-account-containers/ ''https://blog.mozilla.org/firefox/introducing-firefox-multi-account-containers/'']</p></li>
<li><p>[https://blog.mozilla.org/security/2017/09/29/improving-aes-gcm-performance/ ''https://blog.mozilla.org/security/2017/09/29/improving-aes-gcm-performance/'']</p></li>
<li><p>[https://blog.mozilla.org/security/2017/09/13/verified-cryptography-firefox-57/ ''https://blog.mozilla.org/security/2017/09/13/verified-cryptography-firefox-57/'']</p></li>
<li><p>[https://hacks.mozilla.org/2017/10/remaking-lightbeam-as-a-browser-extension/ ''https://hacks.mozilla.org/2017/10/remaking-lightbeam-as-a-browser-extension/'']</p></li>
<li><p>[https://blog.mozilla.org/security/2017/10/04/treating-data-urls-unique-origins-firefox-57/ ''https://blog.mozilla.org/security/2017/10/04/treating-data-urls-unique-origins-firefox-57/'']</p></li></ul>