Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've been asked to do a security audit on a Firefox add-on developed by a third party. I am a web developer with a reasonable grasp of JavaScript but am not a browser security expert.

What kinds of things should I be looking for in the source code which might represent a security risk. Also, are there any effective tools for obfuscating browser extension source code?

share|improve this question
add comment

2 Answers

up vote 10 down vote accepted

IMPORTANT: This is in noway a full list of the things you should look for, use this answer as an example, a first step in your path and research on your own. I've had a similar task long time ago. I had to security-wise review the code of a Firefox addon, I'm sure you'll easily find Chrome/other browsers' equivalents. Also have in mind the Extensions in Chrome run in a Sandbox.


1. Anything that interacts with local files:

Whenever the FileUtils.File object is created and any of its methods is called

  • Check if the local file access is a documented behavior. What are files being accessed? Why? Are they released successfully?

  • Check if any local files are being modified. Is that a documented behavior? What are the modified files? Why?

2. Anything that interacts with Windows Registry:

Whenever an instance of nsIWindowsRegKey is created or any of its methods is called

  • Is Windows Registry access a documented behavior? What keys are accessed? Why?

  • Is Windows Registry modification a documented behavior? Is the modification temporarily? What keys are modified? Why?

3. Anything that interacts with the cookies

Whenever nsICookieService is used

  • Is accessing cookies a documented behavior? Why?

  • To which domain do these cookies belong? Why?

4.Any commands executed in the user's shell

Whenever nsIProcess is created and any of its methods called (closely watch .run() and .launch())

  • Is executing commands a documented behavior? Why?

  • What commands are being executed? Where is the output redirected?

5. Any window/tab being accessed

Whenever window is accessed and/or any getElement* method is called (closely watch createElement calls that inject <script> elements.

  • Is accessing a web page's DOM a documented behavior? Why?

  • What are the elements added/removed/modified? Why?

share|improve this answer
    
Many thanks for your answer. I look forward to any additions if you manage to locate the pdf ;) –  user21859 Mar 13 '13 at 14:53
    
Should we be also looking at the mozIStorageService? –  TheRookierLearner Apr 20 '13 at 23:58
add comment

Whenever you are auditing a new type of application you should look at the other types of vulnerabilities that have been found. A good way of doing this is searching the CVE database. In the case of browser extensions you should look at this Defcon 17 talk: Abusing Firefox Addons. Extensions are given elevated rights, and can be extremely hazardous.

In terms of obfuscation, any JS obfuscator should work. An extension is just .js files in an archive.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.