What should I look for when auditing a Firefox extension / plugin?

Question

I've been asked to do a security audit on a Firefox add-on developed by a third party. I am a web developer with a reasonable grasp of JavaScript but am not a browser security expert.

What kinds of things should I be looking for in the source code which might represent a security risk. Also, are there any effective tools for obfuscating browser extension source code?

Answer 1

IMPORTANT: This is in noway a full list of the things you should look for, use this answer as an example, a first step in your path and research on your own. I've had a similar task long time ago. I had to security-wise review the code of a Firefox addon, I'm sure you'll easily find Chrome/other browsers' equivalents. Also have in mind the Extensions in Chrome run in a Sandbox.

---

1. Anything that interacts with local files:

Whenever the FileUtils.File object is created and any of its methods is called

• Check if the local file access is a documented behavior. What are files being accessed? Why? Are they released successfully?

• Check if any local files are being modified. Is that a documented behavior? What are the modified files? Why?

2. Anything that interacts with Windows Registry:

Whenever an instance of nsIWindowsRegKey is created or any of its methods is called

• Is Windows Registry access a documented behavior? What keys are accessed? Why?

• Is Windows Registry modification a documented behavior? Is the modification temporarily? What keys are modified? Why?

3. Anything that interacts with the cookies

Whenever nsICookieService is used

• Is accessing cookies a documented behavior? Why?

• To which domain do these cookies belong? Why?

4.Any commands executed in the user's shell

Whenever nsIProcess is created and any of its methods called (closely watch .run() and .launch())

• Is executing commands a documented behavior? Why?

• What commands are being executed? Where is the output redirected?

5. Any window/tab being accessed

Whenever window is accessed and/or any getElement* method is called (closely watch createElement calls that inject <script> elements.

• Is accessing a web page's DOM a documented behavior? Why?

• What are the elements added/removed/modified? Why?

Answer 2

Whenever you are auditing a new type of application you should look at the other types of vulnerabilities that have been found. A good way of doing this is searching the CVE database. In the case of browser extensions you should look at this Defcon 17 talk: Abusing Firefox Addons. Extensions are given elevated rights, and can be extremely hazardous.

In terms of obfuscation, any JS obfuscator should work. An extension is just .js files in an archive.