Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I am asking these question because I am not very familiar with JavaScript or the Firefox plugin/extension system. The specific context is the Mailvelope pgp extension but the questions are general and would apply to all extensions.
Can another extension access memory in use or previously used by another extension?
Can another extension act as an MITM keylogger? Can JavaScript from another page/tab that is open?
Can another extension modify the code of another (e.g. on disk)
This question should be moved back to stackoverflow firefox-addon tag.
Yes an extension can get access to another, see this topic: https://stackoverflow.com/questions/22057888/controlling-a-firefox-extension-via-javascript/22099148#22099148
I'm not sure what you mean by "Can javascript from another page/tab that is open?"
Im also not sure what you mean by "Can another extension act as an MITM keylogger?"
Code of Firefox addons does not run in tabs, it runs in the whole browser scope, so it can access tabs, pages, and it can log keys, that come into the browser. You can make it log keys on the OS level with js-ctypes: https://developer.mozilla.org/en-US/docs/Mozilla/js-ctypes/Standard_OS_Libraries
An extension can modify the code of another, it would first look for the addon by the addons id, then it would unpack the xpi file if it is an xpi, then edit it, then repack the xpi. The changes will not take place until browser restart though. If the addon is not packed as xpi it can just edit the files in the folder, but again the code will not take affect till browser restart. OR if it's restartless until re-enable of the addon.
Can another extension access memory in use or previously used by another extension?
@Noitdart covered this - yes.
Can another extension modify the code of another (eg, on disk)?
Again @Noitdart covered this but in case it's not clear, it would be possible to modify the code of another addon without requiring a restart. I.e. no disk is required to modify the code because the other addon has access to "executable" (interpretable) memory. By the same token, a malicious addon can modify any part of Firefox that it chooses to, either at run-time or through on-disk modifications to critical files.
The main mitigation of this risk (assuming you're not going to inspect all the add-on's code yourself) is that in answer to @georgie, there is a vetting process before an addon is allowed onto the official add-ons website.
Further security improvements are likely soon when Mozilla begin requiring all add-ons to be digitally signed before Firefox will load them. That's not going to help against a targeted attack but would give Mozilla an easy way to block execution of malicious add-ons/developers once a few unlucky people have discovered malicious behaviour in an add-on.
I don't think there is a risk of on-the-wire replacement of an add-on's code when it comes from Mozilla because they should be using TLS for all of that but I've not personally inspected their delivery system code. Again, the use of digital signatures will help protect against attacks relating to the malicious modification of an add-ons code during remote storage or delivery.
The other questions are a little less well defined but in addition to @Noitdart's explanation of add-on code execution scope some of the information below might be helpful.
Normally, Javascript in a web page is prevented from accessing the browser or addon code/data directly - it's remote code so can't be trusted. However, there are ways that a website can send simple data messages to an addon if that addon permits it. Before anything malicious at the system level can occur, it would need to be programmed into the addon code. So there is no such thing as strictly malicious interaction from the web page (assuming no security flaws in add-on or browser code) but there is a possibility of interaction which a malicious add-on may use as a trigger to do something bad.
Again going back to previous comments, because a malicious add-on can do anything it wants, it does not require any specific Javascript to exist in a targeted website (it can just add the malicious code into the site whenever it wants to).
