SlideShare a Scribd company logo

Abusing, Exploiting and Pwning with Firefox Add-ons

The paper is about abusing and exploiting Firefox add-on Security model and explains how JavaScript functions, XPCOM and XPConnect interfaces, technologies like CORS and WebSocket, Session storing and full privilege execution can be abused by a hacker for malicious purposes. The widely popular browser add-ons can be targeted by hackers to implement new malicious attack vectors resulting in confidential data theft and full system compromise. This paper is supported by proof of concept add-ons which abuse and exploits the add-on coding in Firefox 17, the release which Mozilla boasts to have a more secure architecture against malicious plugins and add-ons. The proof of concept includes the implementation of a Local keylogger, a Remote keylogger, stealing Linux password files, spawning a Reverse Shell, stealing the authenticated Firefox session data, and Remote DDoS attack. All of these attack vectors are fully undetectable against anti-virus solutions and can bypass protection mechanisms.

1 of 18
Download to read offline
Abusing, Exploiting and
Pwning with Firefox Add-ons
                                                                          Ajin Abraham
                                                                        www.ajinabraham.com
                                                                       www.keralacyberforce.in
                                                                            ajin25@gmail.com

Abstract
This paper discuss about a number of ways through which hackers can use Mozilla Firefox as a
platform to run there malicious piece of code with all the privileges and features as that
supported by any native programming languages. Also there is an advantage that these
malicious codes remain stealthy and undetected against anti-virus solutions. Malicious Firefox
add-ons can be coded to serve this purpose. Mozilla Firefox Browser Engine acts just like a
compiler or interpreter to execute your codes without much security concerns. The coding
technologies for add-on development can be abused and exploited to create malicious add-ons.
This paper explains how Firefox’s insecure policies and add-on development technologies like
JavaScript, CORS, Web Socket, XPCOM and XPConnect can be abused by a hacker for malicious
purposes. The widely popular browser add-ons can be utilized by hackers to implement new
malware attack vectors. This paper is supported by proof of concept add-ons which are
developed by exploiting the weakness in Firefox add-on coding. The proof of concept includes
the implementation of a local keylogger, a remote keylogger, spawning a reverse shell, stealing
the Firefox user session data, stealing Linux password files and Distributed Denial of Service
(DDoS) Attack. All of these attack vectors are fully undetectable against anti-virus solutions and
can bypass filters or protection mechanisms.

Introduction
Firefox is an awesome web browser by Mozilla foundation. It is used by millions of people all
around the world. According to w3shools.com Firefox stands second in world in terms of usage.




                                                                              AJIN ABRAHAM      1
Kerala Cyber Force
Learn | Contribute | Share
It got millions of feature rich add-ons to
                                                           meet ones needs and taste. Add-ons are
                                                           small pieces of software that adds new
                                                           features or functionality to the Firefox
                                                           browser. It extends, modify and control
                                                           browser behavior. Firefox got a lot of
                                                           developers devoted in add-on development
                                                           around the world. To help the developers to
                                                           carry out add-on development in an easier
                                                           way, Firefox supports variety of powerful
                                                           languages for add-on development.
Fig 1: Browser Usage Statistics

The add-ons are developed with the help of HTML, CSS, XHTML, XML, js-ctypes, Web Workers,
XBL, XUL, XPCOM, and JavaScript with XPConnect. The paper will discuss about the exploitable
coding features in XPCOM interface, WebSocket, CORS, JavaScript and XPConnect offered by
Firefox along with successful abusing and exploitation of these with the proof of concept add-
ons.



Firefox add-on Structure
An add-on is just a zipped file with its extension (.zip) changed to (.xpi).

                                      The Fig 2 shows the structure of a Firefox add-on. This
                                      structuring of the components of the add-on is
                                      conventional. It’s not mandatory that one should follow this
                                      structuring. But the essential and bare minimal files for
                                      developing an add-on are “chrome.manifest”, “install.rdf”,
                                      “overlay.xul”, and “overlay.js”.




Fig 2: Add-on directory structure




                                                                               AJIN ABRAHAM     2
Kerala Cyber Force
Learn | Contribute | Share
Purpose of these files is as follows:

chrome.manifest : Registers the location of the contents with the Chrome engine.

overlay.xul : This files defines the GUI elements to be added to the browser window.

install.rdf : Gives general information about the extension like name, description version etc.

overlay.js : This file consist of the scripts/codes that runs in the browser engine.



Firefox Add-on Security Model
The Firefox platform has no mechanisms to restrict the privileges of add-ons. The add-on code
is fully trusted by Firefox. The installation of malicious add-ons can result in full system
compromise. There is no security measure to restrict the intercommunication between add-
ons. As a result an add-on can alter or modify another add-on in the background. There is no
security policy or sandboxing ability of XPConnect and XPCOM components which is a serious
flaw in the security model. Firefox does not have any type of restrictions on malformed Cross
Origin Resource Sharing and socket creation. Some exploitable vulnerabilities are platform
independent.

However addons.mozilla.org where add-ons are officially hosted, perform reviews of all add-
ons submitted. Add-ons with malicious functionality will be rejected in the review, same goes
for add-ons executing remote code. An extension on addons.mozilla.org can have three states:

      Fully reviewed: the add-on passed the review without any serious issues.

      Preliminarily reviewed: the add-on was found to be safe to use but has serious issues or simply
       isn't mature enough yet.

      Not reviewed: the add-on has only been submitted recently and not reviewed yet, use at your
       own risk.

Even though it’s possible to host a malicious add-on in Firefox add-ons website, but it is not
under the scope of this paper. We will only discuss about some methods through which we can
abuse add-on coding technologies to build malicious add-ons and methods used by hackers to
spread them.




                                                                                   AJIN ABRAHAM      3
Kerala Cyber Force
Learn | Contribute | Share
Exploitable Features of Firefox add-on Coding




Fig 3: The Mozilla Platform

Add-ons are the best part of Firefox. Firefox got feature rich and extensible add-on support.
Firefox supports variety of powerful languages for add-on development including HTML, CSS,
XHTML, XML, js-ctypes, Web Workers, WebSocket, CORS, XBL, XUL, XPCOM and JavaScript with
XPConnect. In this paper we are concentrating on XUL, XPCOM, XPConnect and JavaScript. XUL
(XML User Interface) is used to provide user interface to the add-ons. XPCOM (Cross platform
Component Object Model) much alike ActiveX is a cross-platform component model which
features multiple language bindings and IDL (Interface Description Language) descriptions
enabling developers to incorporate their custom functionality into the framework and connect
it with other components. It can be used to interact with low layer libraries like network, I/O,
file system, etc. XPCOM components support multiple programming languages such as C++,
Java, Python and JavaScript. XPConnect (Cross Platform Connect) is a technology which enables
simple interoperation between XPCOM and JavaScript.

There are not mechanism to restrict the privileges and execution scope of add-ons. JavaScript
functions can hook into the browser interface every time Firefox loads. They can collect
keystrokes from Firefox browser interface. The JavaScript XMLHttpRequest object can be used
to exchange data with a server in background. The JavaScript with XPConnect used for file
management, process & thread management which can be used to execute windows
                                                                             AJIN ABRAHAM     4
Kerala Cyber Force
Learn | Contribute | Share
executable (.exe) and for performing file operations without any restrictions. CORS and
WebSocket can be used to create numerous bogus requests to a server.



Exploiting the Weakness
So now consider some of the exploiting scenario.

   •     By abusing the JavaScript function “document.addEventListener();”, we can implement a
         Keylogger.

   •     We can pack and execute malicious Windows executable (.exe) files by abusing the File
         I/O operations supported by XPConnect.

   •     We can hook malicious codes into the Firefox browser interface and execute them every
         time the browser loads.

   •     We can steal Firefox session data with malicious add-on.

   •     Add-ons can access the contents of confidential files in the system without any
         restrictions.

   •     With XHR object we can exchange data between the victim and the server.

   •     By abusing CORS and WebSocket we can shot numerous bogus request to DDoS a Web
         Site.



Proof of Concept (PoC)
To demonstrate the potential security risk caused by malicious Firefox add-ons, I had
implemented some proof of concept add-ons.

         Xenotix KeylogX
         Xenotix Remote Keylogger
         Xenotix Session Stealer
         Xenotix Linux Password Stealer
         Xenotix Reverse Connect
         Xenotix DDoSer

All of these add-ons are fresh and fully undetectable against Anti-virus solutions.
                                                                               AJIN ABRAHAM   5
Kerala Cyber Force
Learn | Contribute | Share
Xenotix KeylogX
It is a Keylogger add-on for Mozilla Firefox which can capture keystrokes and log it into a file. It
can hook into the browser interface and capture keystrokes from all the opened tabs in Firefox.




Fig 4: Abusing JavaScript Functions

The Keylogger add-on is implemented by abusing JavaScript functions like
“document.addEventListener();” for hooking into the browser interface to capture the
keystrokes and file management features of XPConnect for creating a log file. The weakness of
Firefox is that it does not implement any security privilege policy or restrictions on content
extraction from webpages and file creation by add-ons. The add-on is platform independent
and is tested under Windows and Linux.



Fully Undetectable




Fig 5: Virus Total Scan results of Xenotix KeylogX
                                                                                AJIN ABRAHAM      6
Kerala Cyber Force
Learn | Contribute | Share

Recommended

Hacking Tizen: The OS of everything - Whitepaper
Hacking Tizen: The OS of everything - WhitepaperHacking Tizen: The OS of everything - Whitepaper
Hacking Tizen: The OS of everything - WhitepaperAjin Abraham
 
Hacking Samsung's Tizen: The OS of Everything - Hack In the Box 2015
Hacking Samsung's Tizen: The OS of Everything - Hack In the Box 2015Hacking Samsung's Tizen: The OS of Everything - Hack In the Box 2015
Hacking Samsung's Tizen: The OS of Everything - Hack In the Box 2015Ajin Abraham
 
Abusing Exploiting and Pwning with Firefox Addons
Abusing Exploiting and Pwning with Firefox AddonsAbusing Exploiting and Pwning with Firefox Addons
Abusing Exploiting and Pwning with Firefox AddonsAjin Abraham
 
Shellcoding in linux
Shellcoding in linuxShellcoding in linux
Shellcoding in linuxAjin Abraham
 
Hacking Tizen : The OS of Everything - Nullcon Goa 2015
Hacking Tizen : The OS of Everything - Nullcon Goa 2015Hacking Tizen : The OS of Everything - Nullcon Goa 2015
Hacking Tizen : The OS of Everything - Nullcon Goa 2015Ajin Abraham
 
Injecting Security into vulnerable web apps at Runtime
Injecting Security into vulnerable web apps at RuntimeInjecting Security into vulnerable web apps at Runtime
Injecting Security into vulnerable web apps at RuntimeAjin Abraham
 
Injecting Security into Web apps at Runtime Whitepaper
Injecting Security into Web apps at Runtime WhitepaperInjecting Security into Web apps at Runtime Whitepaper
Injecting Security into Web apps at Runtime WhitepaperAjin Abraham
 
Automated Security Analysis of Android & iOS Applications with Mobile Securit...
Automated Security Analysis of Android & iOS Applications with Mobile Securit...Automated Security Analysis of Android & iOS Applications with Mobile Securit...
Automated Security Analysis of Android & iOS Applications with Mobile Securit...Ajin Abraham
 

More Related Content

What's hot

Android pen test basics
Android pen test basicsAndroid pen test basics
Android pen test basicsOWASPKerala
 
G4H Webcast: Automated Security Analysis of Mobile Applications with Mobile S...
G4H Webcast: Automated Security Analysis of Mobile Applications with Mobile S...G4H Webcast: Automated Security Analysis of Mobile Applications with Mobile S...
G4H Webcast: Automated Security Analysis of Mobile Applications with Mobile S...Ajin Abraham
 
Pentesting web applications
Pentesting web applicationsPentesting web applications
Pentesting web applicationsSatish b
 
Mobile Application Pentest [Fast-Track]
Mobile Application Pentest [Fast-Track]Mobile Application Pentest [Fast-Track]
Mobile Application Pentest [Fast-Track]Prathan Phongthiproek
 
2015.04.24 Updated > Android Security Development - Part 1: App Development
2015.04.24 Updated > Android Security Development - Part 1: App Development 2015.04.24 Updated > Android Security Development - Part 1: App Development
2015.04.24 Updated > Android Security Development - Part 1: App Development Cheng-Yi Yu
 
CNIT 128 8. Identifying and Exploiting Android Implementation Issues (Part 2)
CNIT 128 8. Identifying and Exploiting Android Implementation Issues (Part 2)CNIT 128 8. Identifying and Exploiting Android Implementation Issues (Part 2)
CNIT 128 8. Identifying and Exploiting Android Implementation Issues (Part 2)Sam Bowne
 
Pentesting Mobile Applications (Prashant Verma)
Pentesting Mobile Applications (Prashant Verma)Pentesting Mobile Applications (Prashant Verma)
Pentesting Mobile Applications (Prashant Verma)ClubHack
 
AppSec EU 2016: Automated Mobile Application Security Assessment with MobSF
AppSec EU 2016: Automated Mobile Application Security Assessment with MobSFAppSec EU 2016: Automated Mobile Application Security Assessment with MobSF
AppSec EU 2016: Automated Mobile Application Security Assessment with MobSFAjin Abraham
 
Pentesting With Web Services in 2012
Pentesting With Web Services in 2012Pentesting With Web Services in 2012
Pentesting With Web Services in 2012Ishan Girdhar
 
Abusing Google Apps and Data API: Google is My Command and Control Center
Abusing Google Apps and Data API: Google is My Command and Control CenterAbusing Google Apps and Data API: Google is My Command and Control Center
Abusing Google Apps and Data API: Google is My Command and Control CenterAjin Abraham
 
CNIT 128 7. Attacking Android Applications (Part 1)
CNIT 128 7. Attacking Android Applications (Part 1)CNIT 128 7. Attacking Android Applications (Part 1)
CNIT 128 7. Attacking Android Applications (Part 1)Sam Bowne
 
CNIT 128 7. Attacking Android Applications (Part 2)
CNIT 128 7. Attacking Android Applications (Part 2)CNIT 128 7. Attacking Android Applications (Part 2)
CNIT 128 7. Attacking Android Applications (Part 2)Sam Bowne
 
CNIT 128: 7. Attacking Android Applications (Part 1 of 3)
CNIT 128: 7. Attacking Android Applications (Part 1 of 3)CNIT 128: 7. Attacking Android Applications (Part 1 of 3)
CNIT 128: 7. Attacking Android Applications (Part 1 of 3)Sam Bowne
 
I Want More Ninja – iOS Security Testing
I Want More Ninja – iOS Security TestingI Want More Ninja – iOS Security Testing
I Want More Ninja – iOS Security TestingJason Haddix
 
CNIT 128 8. Identifying and Exploiting Android Implementation Issues (Part 3)
CNIT 128 8. Identifying and Exploiting Android Implementation Issues (Part 3)CNIT 128 8. Identifying and Exploiting Android Implementation Issues (Part 3)
CNIT 128 8. Identifying and Exploiting Android Implementation Issues (Part 3)Sam Bowne
 
CNIT 128 8. Android Implementation Issues (Part 3)
CNIT 128 8. Android Implementation Issues (Part 3)CNIT 128 8. Android Implementation Issues (Part 3)
CNIT 128 8. Android Implementation Issues (Part 3)Sam Bowne
 
Owasp Mobile Risk Series : M3 : Insufficient Transport Layer Protection
Owasp Mobile Risk Series : M3 : Insufficient Transport Layer ProtectionOwasp Mobile Risk Series : M3 : Insufficient Transport Layer Protection
Owasp Mobile Risk Series : M3 : Insufficient Transport Layer ProtectionAnant Shrivastava
 
CNIT 128 8. Identifying and Exploiting Android Implementation Issues (Part 1)
CNIT 128 8. Identifying and Exploiting Android Implementation Issues (Part 1)CNIT 128 8. Identifying and Exploiting Android Implementation Issues (Part 1)
CNIT 128 8. Identifying and Exploiting Android Implementation Issues (Part 1)Sam Bowne
 
Implementing application security using the .net framework
Implementing application security using the .net frameworkImplementing application security using the .net framework
Implementing application security using the .net frameworkLalit Kale
 
Android Application Penetration Testing - Mohammed Adam
Android Application Penetration Testing - Mohammed AdamAndroid Application Penetration Testing - Mohammed Adam
Android Application Penetration Testing - Mohammed AdamMohammed Adam
 

What's hot (20)

Android pen test basics
Android pen test basicsAndroid pen test basics
Android pen test basics
 
G4H Webcast: Automated Security Analysis of Mobile Applications with Mobile S...
G4H Webcast: Automated Security Analysis of Mobile Applications with Mobile S...G4H Webcast: Automated Security Analysis of Mobile Applications with Mobile S...
G4H Webcast: Automated Security Analysis of Mobile Applications with Mobile S...
 
Pentesting web applications
Pentesting web applicationsPentesting web applications
Pentesting web applications
 
Mobile Application Pentest [Fast-Track]
Mobile Application Pentest [Fast-Track]Mobile Application Pentest [Fast-Track]
Mobile Application Pentest [Fast-Track]
 
2015.04.24 Updated > Android Security Development - Part 1: App Development
2015.04.24 Updated > Android Security Development - Part 1: App Development 2015.04.24 Updated > Android Security Development - Part 1: App Development
2015.04.24 Updated > Android Security Development - Part 1: App Development
 
CNIT 128 8. Identifying and Exploiting Android Implementation Issues (Part 2)
CNIT 128 8. Identifying and Exploiting Android Implementation Issues (Part 2)CNIT 128 8. Identifying and Exploiting Android Implementation Issues (Part 2)
CNIT 128 8. Identifying and Exploiting Android Implementation Issues (Part 2)
 
Pentesting Mobile Applications (Prashant Verma)
Pentesting Mobile Applications (Prashant Verma)Pentesting Mobile Applications (Prashant Verma)
Pentesting Mobile Applications (Prashant Verma)
 
AppSec EU 2016: Automated Mobile Application Security Assessment with MobSF
AppSec EU 2016: Automated Mobile Application Security Assessment with MobSFAppSec EU 2016: Automated Mobile Application Security Assessment with MobSF
AppSec EU 2016: Automated Mobile Application Security Assessment with MobSF
 
Pentesting With Web Services in 2012
Pentesting With Web Services in 2012Pentesting With Web Services in 2012
Pentesting With Web Services in 2012
 
Abusing Google Apps and Data API: Google is My Command and Control Center
Abusing Google Apps and Data API: Google is My Command and Control CenterAbusing Google Apps and Data API: Google is My Command and Control Center
Abusing Google Apps and Data API: Google is My Command and Control Center
 
CNIT 128 7. Attacking Android Applications (Part 1)
CNIT 128 7. Attacking Android Applications (Part 1)CNIT 128 7. Attacking Android Applications (Part 1)
CNIT 128 7. Attacking Android Applications (Part 1)
 
CNIT 128 7. Attacking Android Applications (Part 2)
CNIT 128 7. Attacking Android Applications (Part 2)CNIT 128 7. Attacking Android Applications (Part 2)
CNIT 128 7. Attacking Android Applications (Part 2)
 
CNIT 128: 7. Attacking Android Applications (Part 1 of 3)
CNIT 128: 7. Attacking Android Applications (Part 1 of 3)CNIT 128: 7. Attacking Android Applications (Part 1 of 3)
CNIT 128: 7. Attacking Android Applications (Part 1 of 3)
 
I Want More Ninja – iOS Security Testing
I Want More Ninja – iOS Security TestingI Want More Ninja – iOS Security Testing
I Want More Ninja – iOS Security Testing
 
CNIT 128 8. Identifying and Exploiting Android Implementation Issues (Part 3)
CNIT 128 8. Identifying and Exploiting Android Implementation Issues (Part 3)CNIT 128 8. Identifying and Exploiting Android Implementation Issues (Part 3)
CNIT 128 8. Identifying and Exploiting Android Implementation Issues (Part 3)
 
CNIT 128 8. Android Implementation Issues (Part 3)
CNIT 128 8. Android Implementation Issues (Part 3)CNIT 128 8. Android Implementation Issues (Part 3)
CNIT 128 8. Android Implementation Issues (Part 3)
 
Owasp Mobile Risk Series : M3 : Insufficient Transport Layer Protection
Owasp Mobile Risk Series : M3 : Insufficient Transport Layer ProtectionOwasp Mobile Risk Series : M3 : Insufficient Transport Layer Protection
Owasp Mobile Risk Series : M3 : Insufficient Transport Layer Protection
 
CNIT 128 8. Identifying and Exploiting Android Implementation Issues (Part 1)
CNIT 128 8. Identifying and Exploiting Android Implementation Issues (Part 1)CNIT 128 8. Identifying and Exploiting Android Implementation Issues (Part 1)
CNIT 128 8. Identifying and Exploiting Android Implementation Issues (Part 1)
 
Implementing application security using the .net framework
Implementing application security using the .net frameworkImplementing application security using the .net framework
Implementing application security using the .net framework
 
Android Application Penetration Testing - Mohammed Adam
Android Application Penetration Testing - Mohammed AdamAndroid Application Penetration Testing - Mohammed Adam
Android Application Penetration Testing - Mohammed Adam
 

Similar to Abusing, Exploiting and Pwning with Firefox Add-ons

AbusingExploitingAndPWN-ingWithFirefoxAdd-Ons
AbusingExploitingAndPWN-ingWithFirefoxAdd-OnsAbusingExploitingAndPWN-ingWithFirefoxAdd-Ons
AbusingExploitingAndPWN-ingWithFirefoxAdd-Onsachettih
 
Firefox security (prasanna)
Firefox security (prasanna) Firefox security (prasanna)
Firefox security (prasanna) ClubHack
 
Browser Malware Taxonomy
Browser Malware TaxonomyBrowser Malware Taxonomy
Browser Malware TaxonomyAditya K Sood
 
Internet browsers by Andres Haydar
Internet browsers by Andres HaydarInternet browsers by Andres Haydar
Internet browsers by Andres HaydarAndresHaydar
 
Trabajo de jose
Trabajo de jose Trabajo de jose
Trabajo de jose josemgg
 
Elsevier NESE - Spying on the Browser
Elsevier NESE - Spying on the BrowserElsevier NESE - Spying on the Browser
Elsevier NESE - Spying on the BrowserAditya K Sood
 
Mozilla Jetpack SDK - LinuxTag 2010
Mozilla Jetpack SDK - LinuxTag 2010Mozilla Jetpack SDK - LinuxTag 2010
Mozilla Jetpack SDK - LinuxTag 2010Brian King
 
Browsers .
Browsers .Browsers .
Browsers .seripa3
 
Compvantages And Descriptions Of A Robot Operating System
Compvantages And Descriptions Of A Robot Operating SystemCompvantages And Descriptions Of A Robot Operating System
Compvantages And Descriptions Of A Robot Operating SystemErin Torres
 
Operations security (OPSEC) in IT
Operations security (OPSEC) in ITOperations security (OPSEC) in IT
Operations security (OPSEC) in ITMichal Špaček
 
Browsers in the actuality.
Browsers in the actuality.Browsers in the actuality.
Browsers in the actuality.carlosmau-95
 

Similar to Abusing, Exploiting and Pwning with Firefox Add-ons (20)

AbusingExploitingAndPWN-ingWithFirefoxAdd-Ons
AbusingExploitingAndPWN-ingWithFirefoxAdd-OnsAbusingExploitingAndPWN-ingWithFirefoxAdd-Ons
AbusingExploitingAndPWN-ingWithFirefoxAdd-Ons
 
Firefox security (prasanna)
Firefox security (prasanna) Firefox security (prasanna)
Firefox security (prasanna)
 
Firefox (in)Security
Firefox (in)SecurityFirefox (in)Security
Firefox (in)Security
 
Browser Malware Taxonomy
Browser Malware TaxonomyBrowser Malware Taxonomy
Browser Malware Taxonomy
 
Internet browsers by Andres Haydar
Internet browsers by Andres HaydarInternet browsers by Andres Haydar
Internet browsers by Andres Haydar
 
Trabajo de jose
Trabajo de jose Trabajo de jose
Trabajo de jose
 
Elsevier NESE - Spying on the Browser
Elsevier NESE - Spying on the BrowserElsevier NESE - Spying on the Browser
Elsevier NESE - Spying on the Browser
 
Mozilla Jetpack SDK - LinuxTag 2010
Mozilla Jetpack SDK - LinuxTag 2010Mozilla Jetpack SDK - LinuxTag 2010
Mozilla Jetpack SDK - LinuxTag 2010
 
Browsers .
Browsers .Browsers .
Browsers .
 
Browsers
BrowsersBrowsers
Browsers
 
Browsers
BrowsersBrowsers
Browsers
 
Compvantages And Descriptions Of A Robot Operating System
Compvantages And Descriptions Of A Robot Operating SystemCompvantages And Descriptions Of A Robot Operating System
Compvantages And Descriptions Of A Robot Operating System
 
Browsers
BrowsersBrowsers
Browsers
 
Browsers
BrowsersBrowsers
Browsers
 
Browsers
BrowsersBrowsers
Browsers
 
Firefox OS
Firefox OSFirefox OS
Firefox OS
 
Operations security (OPSEC) in IT
Operations security (OPSEC) in ITOperations security (OPSEC) in IT
Operations security (OPSEC) in IT
 
Browser (1)
Browser (1)Browser (1)
Browser (1)
 
Browsers in the actuality.
Browsers in the actuality.Browsers in the actuality.
Browsers in the actuality.
 
Browser (1)
Browser (1)Browser (1)
Browser (1)
 

More from Ajin Abraham

Nullcon Goa 2016 - Automated Mobile Application Security Testing with Mobile ...
Nullcon Goa 2016 - Automated Mobile Application Security Testing with Mobile ...Nullcon Goa 2016 - Automated Mobile Application Security Testing with Mobile ...
Nullcon Goa 2016 - Automated Mobile Application Security Testing with Mobile ...Ajin Abraham
 
Exploit Research and Development Megaprimer: DEP Bypassing with ROP Chains
Exploit Research and Development Megaprimer: DEP Bypassing with ROP ChainsExploit Research and Development Megaprimer: DEP Bypassing with ROP Chains
Exploit Research and Development Megaprimer: DEP Bypassing with ROP ChainsAjin Abraham
 
Exploit Research and Development Megaprimer: Win32 Egghunter
Exploit Research and Development Megaprimer: Win32 EgghunterExploit Research and Development Megaprimer: Win32 Egghunter
Exploit Research and Development Megaprimer: Win32 EgghunterAjin Abraham
 
Exploit Research and Development Megaprimer: mona.py, Exploit Writer's Swiss ...
Exploit Research and Development Megaprimer: mona.py, Exploit Writer's Swiss ...Exploit Research and Development Megaprimer: mona.py, Exploit Writer's Swiss ...
Exploit Research and Development Megaprimer: mona.py, Exploit Writer's Swiss ...Ajin Abraham
 
Exploit Research and Development Megaprimer: Unicode Based Exploit Development
Exploit Research and Development Megaprimer: Unicode Based Exploit DevelopmentExploit Research and Development Megaprimer: Unicode Based Exploit Development
Exploit Research and Development Megaprimer: Unicode Based Exploit DevelopmentAjin Abraham
 
Exploit Research and Development Megaprimer: Buffer overflow for beginners
Exploit Research and Development Megaprimer: Buffer overflow for beginnersExploit Research and Development Megaprimer: Buffer overflow for beginners
Exploit Research and Development Megaprimer: Buffer overflow for beginnersAjin Abraham
 
OWASP Xenotix XSS Exploit Framework v3 : Nullcon Goa 2013
OWASP Xenotix XSS Exploit Framework v3 : Nullcon Goa 2013OWASP Xenotix XSS Exploit Framework v3 : Nullcon Goa 2013
OWASP Xenotix XSS Exploit Framework v3 : Nullcon Goa 2013Ajin Abraham
 
Pwning with XSS: from alert() to reverse shell: Defcon Banglore 2013
Pwning with XSS: from alert() to reverse shell: Defcon Banglore 2013Pwning with XSS: from alert() to reverse shell: Defcon Banglore 2013
Pwning with XSS: from alert() to reverse shell: Defcon Banglore 2013Ajin Abraham
 
Abusing, Exploiting and Pwning with Firefox Add-ons: OWASP Appsec 2013 Presen...
Abusing, Exploiting and Pwning with Firefox Add-ons: OWASP Appsec 2013 Presen...Abusing, Exploiting and Pwning with Firefox Add-ons: OWASP Appsec 2013 Presen...
Abusing, Exploiting and Pwning with Firefox Add-ons: OWASP Appsec 2013 Presen...Ajin Abraham
 
Xenotix XSS Exploit Framework: Clubhack 2012
Xenotix XSS Exploit Framework: Clubhack 2012 Xenotix XSS Exploit Framework: Clubhack 2012
Xenotix XSS Exploit Framework: Clubhack 2012 Ajin Abraham
 
Wi-Fi Security with Wi-Fi P+
Wi-Fi Security with Wi-Fi P+Wi-Fi Security with Wi-Fi P+
Wi-Fi Security with Wi-Fi P+Ajin Abraham
 
Phishing With Data URI
Phishing With Data URIPhishing With Data URI
Phishing With Data URIAjin Abraham
 
Buffer overflow for Beginners
Buffer overflow for BeginnersBuffer overflow for Beginners
Buffer overflow for BeginnersAjin Abraham
 

More from Ajin Abraham (13)

Nullcon Goa 2016 - Automated Mobile Application Security Testing with Mobile ...
Nullcon Goa 2016 - Automated Mobile Application Security Testing with Mobile ...Nullcon Goa 2016 - Automated Mobile Application Security Testing with Mobile ...
Nullcon Goa 2016 - Automated Mobile Application Security Testing with Mobile ...
 
Exploit Research and Development Megaprimer: DEP Bypassing with ROP Chains
Exploit Research and Development Megaprimer: DEP Bypassing with ROP ChainsExploit Research and Development Megaprimer: DEP Bypassing with ROP Chains
Exploit Research and Development Megaprimer: DEP Bypassing with ROP Chains
 
Exploit Research and Development Megaprimer: Win32 Egghunter
Exploit Research and Development Megaprimer: Win32 EgghunterExploit Research and Development Megaprimer: Win32 Egghunter
Exploit Research and Development Megaprimer: Win32 Egghunter
 
Exploit Research and Development Megaprimer: mona.py, Exploit Writer's Swiss ...
Exploit Research and Development Megaprimer: mona.py, Exploit Writer's Swiss ...Exploit Research and Development Megaprimer: mona.py, Exploit Writer's Swiss ...
Exploit Research and Development Megaprimer: mona.py, Exploit Writer's Swiss ...
 
Exploit Research and Development Megaprimer: Unicode Based Exploit Development
Exploit Research and Development Megaprimer: Unicode Based Exploit DevelopmentExploit Research and Development Megaprimer: Unicode Based Exploit Development
Exploit Research and Development Megaprimer: Unicode Based Exploit Development
 
Exploit Research and Development Megaprimer: Buffer overflow for beginners
Exploit Research and Development Megaprimer: Buffer overflow for beginnersExploit Research and Development Megaprimer: Buffer overflow for beginners
Exploit Research and Development Megaprimer: Buffer overflow for beginners
 
OWASP Xenotix XSS Exploit Framework v3 : Nullcon Goa 2013
OWASP Xenotix XSS Exploit Framework v3 : Nullcon Goa 2013OWASP Xenotix XSS Exploit Framework v3 : Nullcon Goa 2013
OWASP Xenotix XSS Exploit Framework v3 : Nullcon Goa 2013
 
Pwning with XSS: from alert() to reverse shell: Defcon Banglore 2013
Pwning with XSS: from alert() to reverse shell: Defcon Banglore 2013Pwning with XSS: from alert() to reverse shell: Defcon Banglore 2013
Pwning with XSS: from alert() to reverse shell: Defcon Banglore 2013
 
Abusing, Exploiting and Pwning with Firefox Add-ons: OWASP Appsec 2013 Presen...
Abusing, Exploiting and Pwning with Firefox Add-ons: OWASP Appsec 2013 Presen...Abusing, Exploiting and Pwning with Firefox Add-ons: OWASP Appsec 2013 Presen...
Abusing, Exploiting and Pwning with Firefox Add-ons: OWASP Appsec 2013 Presen...
 
Xenotix XSS Exploit Framework: Clubhack 2012
Xenotix XSS Exploit Framework: Clubhack 2012 Xenotix XSS Exploit Framework: Clubhack 2012
Xenotix XSS Exploit Framework: Clubhack 2012
 
Wi-Fi Security with Wi-Fi P+
Wi-Fi Security with Wi-Fi P+Wi-Fi Security with Wi-Fi P+
Wi-Fi Security with Wi-Fi P+
 
Phishing With Data URI
Phishing With Data URIPhishing With Data URI
Phishing With Data URI
 
Buffer overflow for Beginners
Buffer overflow for BeginnersBuffer overflow for Beginners
Buffer overflow for Beginners
 

Recently uploaded

Boosting Developer Effectiveness with a Java platform team 1.4 - ArnhemJUG
Boosting Developer Effectiveness with a Java platform team 1.4 - ArnhemJUGBoosting Developer Effectiveness with a Java platform team 1.4 - ArnhemJUG
Boosting Developer Effectiveness with a Java platform team 1.4 - ArnhemJUGRick Ossendrijver
 
PrismCRM-RealEstate-SalesCRM_byCode5Company
PrismCRM-RealEstate-SalesCRM_byCode5CompanyPrismCRM-RealEstate-SalesCRM_byCode5Company
PrismCRM-RealEstate-SalesCRM_byCode5CompanyMustafa Kuğu
 
TrustArc Webinar - TrustArc's Latest AI Innovations
TrustArc Webinar - TrustArc's Latest AI InnovationsTrustArc Webinar - TrustArc's Latest AI Innovations
TrustArc Webinar - TrustArc's Latest AI InnovationsTrustArc
 
Mastering Play Store App Listing and Optimization
Mastering Play Store App Listing and OptimizationMastering Play Store App Listing and Optimization
Mastering Play Store App Listing and OptimizationAppsthentic Technology
 
Trending now: Book subjects on the move in the Canadian market - Tech Forum 2024
Trending now: Book subjects on the move in the Canadian market - Tech Forum 2024Trending now: Book subjects on the move in the Canadian market - Tech Forum 2024
Trending now: Book subjects on the move in the Canadian market - Tech Forum 2024BookNet Canada
 
Elevating Cloud Infrastructure with Object Storage, DRS, VM Scheduling, and D...
Elevating Cloud Infrastructure with Object Storage, DRS, VM Scheduling, and D...Elevating Cloud Infrastructure with Object Storage, DRS, VM Scheduling, and D...
Elevating Cloud Infrastructure with Object Storage, DRS, VM Scheduling, and D...ShapeBlue
 
AI improves software testing to be more fault tolerant, focused and efficient
AI improves software testing to be more fault tolerant, focused and efficientAI improves software testing to be more fault tolerant, focused and efficient
AI improves software testing to be more fault tolerant, focused and efficientKari Kakkonen
 
Geospatial Synergy: Amplifying Efficiency with FME & Esri
Geospatial Synergy: Amplifying Efficiency with FME & EsriGeospatial Synergy: Amplifying Efficiency with FME & Esri
Geospatial Synergy: Amplifying Efficiency with FME & EsriSafe Software
 
Centralized TLS Certificates Management Using Vault PKI + Cert-Manager
Centralized TLS Certificates Management Using Vault PKI + Cert-ManagerCentralized TLS Certificates Management Using Vault PKI + Cert-Manager
Centralized TLS Certificates Management Using Vault PKI + Cert-ManagerSaiLinnThu2
 
My Journey towards Artificial Intelligence
My Journey towards Artificial IntelligenceMy Journey towards Artificial Intelligence
My Journey towards Artificial IntelligenceVijayananda Mohire
 
VM Migration from VMware to CloudStack and KVM – Suresh Anaparti, ShapeBlue
VM Migration from VMware to CloudStack and KVM – Suresh Anaparti, ShapeBlueVM Migration from VMware to CloudStack and KVM – Suresh Anaparti, ShapeBlue
VM Migration from VMware to CloudStack and KVM – Suresh Anaparti, ShapeBlueShapeBlue
 
CloudStack Authentication Methods – Harikrishna Patnala, ShapeBlue
CloudStack Authentication Methods – Harikrishna Patnala, ShapeBlueCloudStack Authentication Methods – Harikrishna Patnala, ShapeBlue
CloudStack Authentication Methods – Harikrishna Patnala, ShapeBlueShapeBlue
 
Large Language Models and Applications in Healthcare
Large Language Models and Applications in HealthcareLarge Language Models and Applications in Healthcare
Large Language Models and Applications in HealthcareAsma Ben Abacha
 
Artificial Intelligence - AI For Everyone
Artificial Intelligence - AI For EveryoneArtificial Intelligence - AI For Everyone
Artificial Intelligence - AI For EveryoneSridhar Seshadri
 
Establishing data sharing standards to promote global industry development
Establishing data sharing standards to promote global industry developmentEstablishing data sharing standards to promote global industry development
Establishing data sharing standards to promote global industry developmentThorsten Huelsmann
 
AMER Introduction to ThousandEyes Webinar
AMER Introduction to ThousandEyes WebinarAMER Introduction to ThousandEyes Webinar
AMER Introduction to ThousandEyes WebinarThousandEyes
 
Mind your App Footprint 🐾⚡️🌱 (@FlutterHeroes 2024)
Mind your App Footprint 🐾⚡️🌱 (@FlutterHeroes 2024)Mind your App Footprint 🐾⚡️🌱 (@FlutterHeroes 2024)
Mind your App Footprint 🐾⚡️🌱 (@FlutterHeroes 2024)François
 
What’s New in CloudStack 4.19, Abhishek Kumar, Release Manager Apache CloudSt...
What’s New in CloudStack 4.19, Abhishek Kumar, Release Manager Apache CloudSt...What’s New in CloudStack 4.19, Abhishek Kumar, Release Manager Apache CloudSt...
What’s New in CloudStack 4.19, Abhishek Kumar, Release Manager Apache CloudSt...ShapeBlue
 
MuleSoft Online Meetup Group - B2B Crash Course: PM Insider Lecture
MuleSoft Online Meetup Group - B2B Crash Course: PM Insider LectureMuleSoft Online Meetup Group - B2B Crash Course: PM Insider Lecture
MuleSoft Online Meetup Group - B2B Crash Course: PM Insider LectureManik S Magar
 
GDG Cloud Southlake 30 Brian Demers Breeding 10x Developers with Developer Pr...
GDG Cloud Southlake 30 Brian Demers Breeding 10x Developers with Developer Pr...GDG Cloud Southlake 30 Brian Demers Breeding 10x Developers with Developer Pr...
GDG Cloud Southlake 30 Brian Demers Breeding 10x Developers with Developer Pr...James Anderson
 

Recently uploaded (20)

Boosting Developer Effectiveness with a Java platform team 1.4 - ArnhemJUG
Boosting Developer Effectiveness with a Java platform team 1.4 - ArnhemJUGBoosting Developer Effectiveness with a Java platform team 1.4 - ArnhemJUG
Boosting Developer Effectiveness with a Java platform team 1.4 - ArnhemJUG
 
PrismCRM-RealEstate-SalesCRM_byCode5Company
PrismCRM-RealEstate-SalesCRM_byCode5CompanyPrismCRM-RealEstate-SalesCRM_byCode5Company
PrismCRM-RealEstate-SalesCRM_byCode5Company
 
TrustArc Webinar - TrustArc's Latest AI Innovations
TrustArc Webinar - TrustArc's Latest AI InnovationsTrustArc Webinar - TrustArc's Latest AI Innovations
TrustArc Webinar - TrustArc's Latest AI Innovations
 
Mastering Play Store App Listing and Optimization
Mastering Play Store App Listing and OptimizationMastering Play Store App Listing and Optimization
Mastering Play Store App Listing and Optimization
 
Trending now: Book subjects on the move in the Canadian market - Tech Forum 2024
Trending now: Book subjects on the move in the Canadian market - Tech Forum 2024Trending now: Book subjects on the move in the Canadian market - Tech Forum 2024
Trending now: Book subjects on the move in the Canadian market - Tech Forum 2024
 
Elevating Cloud Infrastructure with Object Storage, DRS, VM Scheduling, and D...
Elevating Cloud Infrastructure with Object Storage, DRS, VM Scheduling, and D...Elevating Cloud Infrastructure with Object Storage, DRS, VM Scheduling, and D...
Elevating Cloud Infrastructure with Object Storage, DRS, VM Scheduling, and D...
 
AI improves software testing to be more fault tolerant, focused and efficient
AI improves software testing to be more fault tolerant, focused and efficientAI improves software testing to be more fault tolerant, focused and efficient
AI improves software testing to be more fault tolerant, focused and efficient
 
Geospatial Synergy: Amplifying Efficiency with FME & Esri
Geospatial Synergy: Amplifying Efficiency with FME & EsriGeospatial Synergy: Amplifying Efficiency with FME & Esri
Geospatial Synergy: Amplifying Efficiency with FME & Esri
 
Centralized TLS Certificates Management Using Vault PKI + Cert-Manager
Centralized TLS Certificates Management Using Vault PKI + Cert-ManagerCentralized TLS Certificates Management Using Vault PKI + Cert-Manager
Centralized TLS Certificates Management Using Vault PKI + Cert-Manager
 
My Journey towards Artificial Intelligence
My Journey towards Artificial IntelligenceMy Journey towards Artificial Intelligence
My Journey towards Artificial Intelligence
 
VM Migration from VMware to CloudStack and KVM – Suresh Anaparti, ShapeBlue
VM Migration from VMware to CloudStack and KVM – Suresh Anaparti, ShapeBlueVM Migration from VMware to CloudStack and KVM – Suresh Anaparti, ShapeBlue
VM Migration from VMware to CloudStack and KVM – Suresh Anaparti, ShapeBlue
 
CloudStack Authentication Methods – Harikrishna Patnala, ShapeBlue
CloudStack Authentication Methods – Harikrishna Patnala, ShapeBlueCloudStack Authentication Methods – Harikrishna Patnala, ShapeBlue
CloudStack Authentication Methods – Harikrishna Patnala, ShapeBlue
 
Large Language Models and Applications in Healthcare
Large Language Models and Applications in HealthcareLarge Language Models and Applications in Healthcare
Large Language Models and Applications in Healthcare
 
Artificial Intelligence - AI For Everyone
Artificial Intelligence - AI For EveryoneArtificial Intelligence - AI For Everyone
Artificial Intelligence - AI For Everyone
 
Establishing data sharing standards to promote global industry development
Establishing data sharing standards to promote global industry developmentEstablishing data sharing standards to promote global industry development
Establishing data sharing standards to promote global industry development
 
AMER Introduction to ThousandEyes Webinar
AMER Introduction to ThousandEyes WebinarAMER Introduction to ThousandEyes Webinar
AMER Introduction to ThousandEyes Webinar
 
Mind your App Footprint 🐾⚡️🌱 (@FlutterHeroes 2024)
Mind your App Footprint 🐾⚡️🌱 (@FlutterHeroes 2024)Mind your App Footprint 🐾⚡️🌱 (@FlutterHeroes 2024)
Mind your App Footprint 🐾⚡️🌱 (@FlutterHeroes 2024)
 
What’s New in CloudStack 4.19, Abhishek Kumar, Release Manager Apache CloudSt...
What’s New in CloudStack 4.19, Abhishek Kumar, Release Manager Apache CloudSt...What’s New in CloudStack 4.19, Abhishek Kumar, Release Manager Apache CloudSt...
What’s New in CloudStack 4.19, Abhishek Kumar, Release Manager Apache CloudSt...
 
MuleSoft Online Meetup Group - B2B Crash Course: PM Insider Lecture
MuleSoft Online Meetup Group - B2B Crash Course: PM Insider LectureMuleSoft Online Meetup Group - B2B Crash Course: PM Insider Lecture
MuleSoft Online Meetup Group - B2B Crash Course: PM Insider Lecture
 
GDG Cloud Southlake 30 Brian Demers Breeding 10x Developers with Developer Pr...
GDG Cloud Southlake 30 Brian Demers Breeding 10x Developers with Developer Pr...GDG Cloud Southlake 30 Brian Demers Breeding 10x Developers with Developer Pr...
GDG Cloud Southlake 30 Brian Demers Breeding 10x Developers with Developer Pr...
 

Abusing, Exploiting and Pwning with Firefox Add-ons

  • 1. Abusing, Exploiting and Pwning with Firefox Add-ons Ajin Abraham www.ajinabraham.com www.keralacyberforce.in ajin25@gmail.com Abstract This paper discuss about a number of ways through which hackers can use Mozilla Firefox as a platform to run there malicious piece of code with all the privileges and features as that supported by any native programming languages. Also there is an advantage that these malicious codes remain stealthy and undetected against anti-virus solutions. Malicious Firefox add-ons can be coded to serve this purpose. Mozilla Firefox Browser Engine acts just like a compiler or interpreter to execute your codes without much security concerns. The coding technologies for add-on development can be abused and exploited to create malicious add-ons. This paper explains how Firefox’s insecure policies and add-on development technologies like JavaScript, CORS, Web Socket, XPCOM and XPConnect can be abused by a hacker for malicious purposes. The widely popular browser add-ons can be utilized by hackers to implement new malware attack vectors. This paper is supported by proof of concept add-ons which are developed by exploiting the weakness in Firefox add-on coding. The proof of concept includes the implementation of a local keylogger, a remote keylogger, spawning a reverse shell, stealing the Firefox user session data, stealing Linux password files and Distributed Denial of Service (DDoS) Attack. All of these attack vectors are fully undetectable against anti-virus solutions and can bypass filters or protection mechanisms. Introduction Firefox is an awesome web browser by Mozilla foundation. It is used by millions of people all around the world. According to w3shools.com Firefox stands second in world in terms of usage. AJIN ABRAHAM 1 Kerala Cyber Force Learn | Contribute | Share
  • 2. It got millions of feature rich add-ons to meet ones needs and taste. Add-ons are small pieces of software that adds new features or functionality to the Firefox browser. It extends, modify and control browser behavior. Firefox got a lot of developers devoted in add-on development around the world. To help the developers to carry out add-on development in an easier way, Firefox supports variety of powerful languages for add-on development. Fig 1: Browser Usage Statistics The add-ons are developed with the help of HTML, CSS, XHTML, XML, js-ctypes, Web Workers, XBL, XUL, XPCOM, and JavaScript with XPConnect. The paper will discuss about the exploitable coding features in XPCOM interface, WebSocket, CORS, JavaScript and XPConnect offered by Firefox along with successful abusing and exploitation of these with the proof of concept add- ons. Firefox add-on Structure An add-on is just a zipped file with its extension (.zip) changed to (.xpi). The Fig 2 shows the structure of a Firefox add-on. This structuring of the components of the add-on is conventional. It’s not mandatory that one should follow this structuring. But the essential and bare minimal files for developing an add-on are “chrome.manifest”, “install.rdf”, “overlay.xul”, and “overlay.js”. Fig 2: Add-on directory structure AJIN ABRAHAM 2 Kerala Cyber Force Learn | Contribute | Share
  • 3. Purpose of these files is as follows: chrome.manifest : Registers the location of the contents with the Chrome engine. overlay.xul : This files defines the GUI elements to be added to the browser window. install.rdf : Gives general information about the extension like name, description version etc. overlay.js : This file consist of the scripts/codes that runs in the browser engine. Firefox Add-on Security Model The Firefox platform has no mechanisms to restrict the privileges of add-ons. The add-on code is fully trusted by Firefox. The installation of malicious add-ons can result in full system compromise. There is no security measure to restrict the intercommunication between add- ons. As a result an add-on can alter or modify another add-on in the background. There is no security policy or sandboxing ability of XPConnect and XPCOM components which is a serious flaw in the security model. Firefox does not have any type of restrictions on malformed Cross Origin Resource Sharing and socket creation. Some exploitable vulnerabilities are platform independent. However addons.mozilla.org where add-ons are officially hosted, perform reviews of all add- ons submitted. Add-ons with malicious functionality will be rejected in the review, same goes for add-ons executing remote code. An extension on addons.mozilla.org can have three states:  Fully reviewed: the add-on passed the review without any serious issues.  Preliminarily reviewed: the add-on was found to be safe to use but has serious issues or simply isn't mature enough yet.  Not reviewed: the add-on has only been submitted recently and not reviewed yet, use at your own risk. Even though it’s possible to host a malicious add-on in Firefox add-ons website, but it is not under the scope of this paper. We will only discuss about some methods through which we can abuse add-on coding technologies to build malicious add-ons and methods used by hackers to spread them. AJIN ABRAHAM 3 Kerala Cyber Force Learn | Contribute | Share
  • 4. Exploitable Features of Firefox add-on Coding Fig 3: The Mozilla Platform Add-ons are the best part of Firefox. Firefox got feature rich and extensible add-on support. Firefox supports variety of powerful languages for add-on development including HTML, CSS, XHTML, XML, js-ctypes, Web Workers, WebSocket, CORS, XBL, XUL, XPCOM and JavaScript with XPConnect. In this paper we are concentrating on XUL, XPCOM, XPConnect and JavaScript. XUL (XML User Interface) is used to provide user interface to the add-ons. XPCOM (Cross platform Component Object Model) much alike ActiveX is a cross-platform component model which features multiple language bindings and IDL (Interface Description Language) descriptions enabling developers to incorporate their custom functionality into the framework and connect it with other components. It can be used to interact with low layer libraries like network, I/O, file system, etc. XPCOM components support multiple programming languages such as C++, Java, Python and JavaScript. XPConnect (Cross Platform Connect) is a technology which enables simple interoperation between XPCOM and JavaScript. There are not mechanism to restrict the privileges and execution scope of add-ons. JavaScript functions can hook into the browser interface every time Firefox loads. They can collect keystrokes from Firefox browser interface. The JavaScript XMLHttpRequest object can be used to exchange data with a server in background. The JavaScript with XPConnect used for file management, process & thread management which can be used to execute windows AJIN ABRAHAM 4 Kerala Cyber Force Learn | Contribute | Share
  • 5. executable (.exe) and for performing file operations without any restrictions. CORS and WebSocket can be used to create numerous bogus requests to a server. Exploiting the Weakness So now consider some of the exploiting scenario. • By abusing the JavaScript function “document.addEventListener();”, we can implement a Keylogger. • We can pack and execute malicious Windows executable (.exe) files by abusing the File I/O operations supported by XPConnect. • We can hook malicious codes into the Firefox browser interface and execute them every time the browser loads. • We can steal Firefox session data with malicious add-on. • Add-ons can access the contents of confidential files in the system without any restrictions. • With XHR object we can exchange data between the victim and the server. • By abusing CORS and WebSocket we can shot numerous bogus request to DDoS a Web Site. Proof of Concept (PoC) To demonstrate the potential security risk caused by malicious Firefox add-ons, I had implemented some proof of concept add-ons.  Xenotix KeylogX  Xenotix Remote Keylogger  Xenotix Session Stealer  Xenotix Linux Password Stealer  Xenotix Reverse Connect  Xenotix DDoSer All of these add-ons are fresh and fully undetectable against Anti-virus solutions. AJIN ABRAHAM 5 Kerala Cyber Force Learn | Contribute | Share
  • 6. Xenotix KeylogX It is a Keylogger add-on for Mozilla Firefox which can capture keystrokes and log it into a file. It can hook into the browser interface and capture keystrokes from all the opened tabs in Firefox. Fig 4: Abusing JavaScript Functions The Keylogger add-on is implemented by abusing JavaScript functions like “document.addEventListener();” for hooking into the browser interface to capture the keystrokes and file management features of XPConnect for creating a log file. The weakness of Firefox is that it does not implement any security privilege policy or restrictions on content extraction from webpages and file creation by add-ons. The add-on is platform independent and is tested under Windows and Linux. Fully Undetectable Fig 5: Virus Total Scan results of Xenotix KeylogX AJIN ABRAHAM 6 Kerala Cyber Force Learn | Contribute | Share
  • 7. Most antivirus solutions won’t scan the inside of a packed add-on with .xpi extension. Also the add-on use common JavaScript functions and the anti-virus heuristic scans are not applicable since no executable files are present here. Bypass Anti-Keylogger and On-Screen Keyboard The keylogger add-on can bypass Windows On-Screen Keyboard and KeyScrambler. KeyScrambler is an Anti-Keylogging mechanism which simultaneously encrypts the keystrokes at the keyboard driver level and decrypts them at the destination application for which the keystrokes are made. The Keylogger add-on described here can by bypass KeyScrambler protection mechanism. Fig 6: How Xenotix KeylogX bypass KeyScrambler, the ant-keylogger mechanism. The Fig 6 depicts the working of a normal keylogger, protection mechanism of KeyScrambler against Keyloggers and bypassing KeyScrambler protection mechanism with Xenotix KeylogX add-on. AJIN ABRAHAM 7 Kerala Cyber Force Learn | Contribute | Share
  • 8. A normal software based keylogger will hook into the environment between keyboard inputs and the applications running on the system. So they can collect the keystrokes passing through the environment. KeyScrambler is an anti-keylogger which encrypts all the keystrokes at keyboard driver level, deep inside the kernel. So when the encrypted data passes through the environment which is hooked by the Keylogger, they render useless since the captured data is completely encrypted. Finally KeyScrambler will decrypt the keystrokes at the destination application for which the keystrokes are produced. Now consider the scenario where Xenotix KeylogX add-on is installed in Firefox. As usual KeyScrambler will encrypt the keystrokes and decrypts them before providing to Firefox executable. But since the keylogger add-on is executing inside Firefox, it will obtain all the keystrokes in plain text. So the protection mechanism is bypassed and render useless against this malicious add-on. Xenotix Remote Keylogger This is the remote implementation of the previous keylogger add-on. This add-on is implemented to demonstrate the weakness of Firefox that it does not implement any security privilege policy, restrictions or sandboxing on file execution by add-ons. This malicious add-on collects keystrokes from the opened tabs in Firefox and logs it into a file and uploads the log file to a FTP account. The add-on is implemented by abusing JavaScript functions like “document.addEventListener();” for capturing keystrokes and the process and thread management features of XPConnect for executing any windows executable file. The add-on is packed with an executable “Firefox.exe” that gets executed every time the victim loads Firefox browser and it will upload the log file to any FTP account specified by the attacker every 60 seconds. Fig 7: The add-on will invoke an executable which uploads the log file to a FTP account every 60 sec. Here also we exploit the weakness of Firefox that it does not implement any security privilege policy or restrictions on content extraction from webpages and file execution by add-ons. This add-on works only in Windows environment as windows executable is not supported in Linux. Also the method of invoking a Linux executable file is not supported by XPConnect. AJIN ABRAHAM 8 Kerala Cyber Force Learn | Contribute | Share
  • 9. Fully Undetectable Fig 8: Virus Total Scan Results of Xenotix Remote Keylogger. Most antivirus solutions won’t scan the inside of a packed add-on with .xpi extension. The add- on use common JavaScript functions and even if they check inside the add-on, the heuristic scans of anti-virus solutions are not detecting the executable as a threat since it is just an executable with the basic function of uploading file to a FTP account. Bypass Anti-Keylogger and On-Screen Keyboard Xenotix Remote Keylogger can bypass Windows On-Screen Keyboard and KeyScrambler protection in the way mentioned before. Xenotix Session Stealer Fig 9: The add-on will send the contents of sessionstore.js to the remote attacker. Firefox is having a built-in Session Store feature that saves your session data, including open window and tabs, window size and position, text typed in forms and the session cookies which AJIN ABRAHAM 9 Kerala Cyber Force Learn | Contribute | Share
  • 10. can maintain your login state in different websites. All these session data information are stored in a file named “sessionstore.js” in the profile folder of Firefox. This file is intended for recovery of tabs after a Firefox crash. The “sessionstore.js” file is maintained in such way that Firefox will preserve the session data upon abnormal exit or crash and deletes the session data on a normal exit. A malicious add-on can be implemented by abusing the file management feature of XPConnect and data exchange feature of XmlHttpRequest (XHR) object to read the contents of “sessionstore.js” and send it to the attacker via GET request at specified time intervals. And later the attacker can use the stolen session data file to reproduce the victim’s authenticated session. Fig 10: The add-on will send the contents of session data file to the remote attacker. This add-on exploits the weakness of Firefox that it does not impart any access restriction on its session data file and the file is compactable with any system and any version of Firefox which provides the attacker the ability to reproduce the session on a remote computer. Also Firefox doesn’t impart any security measure to isolate and lock out the session file for a unique Firefox installation. Fully Undetectable Fig 11: Virus Total Scan Results of Xenotix Session Stealer. AJIN ABRAHAM 10 Kerala Cyber Force Learn | Contribute | Share
  • 11. Here also most antivirus solutions won’t scan the inside of a packed add-on with .xpi extension). Also the add-on use common JavaScript functions and the anti-virus heuristic scans are not applicable here as an executable file is not present. Xenotix Linux Password Stealer This add-on can steal Linux password (passwd and shadow) files by exploiting the File I/O operations supported by JavaScript XPCOM interface. It reads the password files from a root user with the help of nSIFile XPCOM Interface and sends the contents to a remote attacker with XMLHttpRequest. Fig 12: Xenotix Linux Password Stealer add-on is implemented by abusing nSIFile Object and XMLHttpRequest. The XMLHttpRequest is a JavaScript object which provides us an easy way to retrieve data at a URL (POST/GET) within JavaScript. Here we craft an add-on that can read the contents of Linux password files provided Firefox is running in a root account and send it to a remote attacker via GET request. Fully Undetectable Fig 13: Virus Total Scan Results of Xenotix Linux Password Stealer. AJIN ABRAHAM 11 Kerala Cyber Force Learn | Contribute | Share
  • 12. Linux Anti-virus solutions are not that efficient to detect this malicious add-on as it’s in packed form (.xpi). Also the add-on use common JavaScript functions and the anti-virus heuristic scans are not applicable here as an executable file is not present. Xenotix Reverse Connect Fig 14: Reverse Connection form Windows 8 PC. This malicious add-on is packed with a reverse shell that will connect back to the attacker. This add-on abuses the file execution feature of XPConnect to start a reverse shell to an IP and port specified by the attacker. This malicious add-on targets the weakness of Firefox that it lacks privilege restriction and control policy to create and execute processes. Fully Undetectable Fig 15: Virus Total Scan Results of Xenotix Reverse Connect. Most Anti-virus solutions won’t scan the packed form (.xpi) of the add-on. Currently the heuristic scans of anti-viruses are not detecting it as a threat. But some anti-virus solutions just warn the user whether to allow the execution or not since it communicate through a reverse TCP communication channel. AJIN ABRAHAM 12 Kerala Cyber Force Learn | Contribute | Share
  • 13. Xenotix DDoSer With HTML 5 comes great power. We harvest the power of HTML 5 to abuse the Cross Origin Resource Sharing (CORS) and WebSocket supported by Firefox to implement a DDoS attack. WebSocket is a technology that allow web applications to have a bidirectional channel to a URI endpoint. Sockets can send and receive data to and from a web server and respond to opening or closing a WebSocket. The XMLHttpRequest is a JavaScript object which is used to exchange data between a server and a bowser behind the scene. This can be used for Cross Origin Resource Sharing (CORS). Firefox does not impart any restrictions on CORS on Cross Domain requests. The restriction is only on reading the response. So we can perform a combined and powerful DDoS attack by abusing these two technologies. Xenotix DDoSer is a malicious POC add-on that abuses WebSocket and creates numerous socket connections with a target server to slow it down. Along with it by abusing CORS, the add-on create numerous fake GET requests to slow down the target server. When we send the first request to the target server and the response does not contain the 'Access-Control-Allow-Origin' header with a suitable value then at times the browser refuses to send more requests to the same URL. However this can be easily bypassed by making every request unique by adding a non-existing query-string parameter with changing values. Fig 16: DDoS with CORS and WebSocket. This add-on can be used to perform Distributed DoS attack or even just a single instance of the add-on running is enough to take down a low profile web site. The interesting part is that the victim who is running the add-on won’t be able to know that he is part of zombie network hosting a DDoS Attack. AJIN ABRAHAM 13 Kerala Cyber Force Learn | Contribute | Share
  • 14. Fully Undetectable Fig 13: Virus Total Scan Results of Xenotix DDoSer. Again here too, most of the antivirus solutions won’t scan the inside of a packed add-on with .xpi extension. Also the add-on use common JavaScript functions and the anti-virus heuristic scans are not applicable since no executable files are present here. Spreading the Add-ons Lot of methodologies can be used to spread these malicious add-ons. A webpage that request the user to install an add-on as a basic requirement for accessibility, viewing a video or accessing some contents etc. Social Engineering tricks can be effectively used to spread the malicious add-ons as human stupidity is the greatest vulnerability. By exploiting the Cross Site Scripting vulnerabilities in web applications, malicious add-on can be spread (refer Fig 17). Fig 17: Spreading malicious add-on by exploiting Cross Site Scripting vulnerabilities. Tabnabbing can be used for spreading the add-on by employing JavaScript to replace a webpage with an add-on download popup at a timed interval. The given below code can be used by an attacker to spread malicious add-ons via Tabnabbing. AJIN ABRAHAM 14 Kerala Cyber Force Learn | Contribute | Share
  • 15. <h1>After opening this page in the browser, open a new tab and wait for 5 sec and come back to this tab again. An add-on pop up will come up.</h1> <script type="text/javascript"> var xScroll, yScroll, timerPoll, timerRedirect, timerClock; function initRedirect(){ if (typeof document.body.scrollTop != "undefined"){ xScroll = document.body.scrollLeft; yScroll = document.body.scrollTop; clearInterval(timerPoll); clearInterval(timerRedirect); timerPoll = setInterval("pollActivity()",1); //poll scrolling timerRedirect = setInterval("location.href='http://192.168.183.1/addon.xpi'",5000 ); redirect } } document.onmousemove=initRedirect; document.onclick=initRedirect; document.onkeydown=initRedirect; window.onload=initRedirect; window.onresize=initRedirect; </script> Mitigation Strategies So far I had discussed about the depth and scope of the threats arised by abusing and exploiting Firefox add-ons. Now we will see about some defense strategies. The first and foremost thing is never trust 3rd party add-ons. Be cautious before installing an add-on. Always use a good and updated Anti-Virus and Firewall solutions. Keylogger Beater is a nice add-on for Firefox to beat Keylogger. Reverse and analyze the source code if you can. Disable session data storing in Firefox to prevent session stealing from Firefox. For configuring it, visit about:config in the URL field of Firefox and set “browser.sessionstore.resume_from_crash” to false. Do not run Firefox from a root privileged account while running on Linux environment. If the user account is a less privileged one then the password files can’t be accessed without privilege and permission. Use a safe and configured proxy server so that it can filter out and block unauthorized reverse TCP and FTP connections. The DDoS attempts can be effectively blocked by a WAF since all Cross Origin AJIN ABRAHAM 15 Kerala Cyber Force Learn | Contribute | Share
  • 16. Requests contain the 'Origin' header. Analyzing that, a WAF can process a legitimate request and reject the bogus request. Conclusion I had explained the Mozilla Firefox add-on security model and the weakness in the current architecture which a hacker can abuse. I had implemented and demonstrated the proof of the concept add-ons which successfully exploits security weakness in the Firefox platform. The Anti- virus detection rates of all these malicious add-ons are almost zero and protection mechanisms and filters are bypassed. It’s a real threat to the normal people out there. So Anti-virus vendors should identify and eliminate these threats efficiently. And I hope that Mozilla Firefox team will work on these issues to fix them and provides there users a secure browsing environment. Till then from next time onwards, keep an eye on the add-ons before installing them. References Papers • Abusing Firefox Extensions –By Roberto Suggi Liverani & Nick Freeman • Firefox Security – By Prasanna Kanagasabai Websites  Mozilla Firefox Internals and Attack Strategies http://www.chmag.in/article/apr2011/mozilla-firefox-internals-attack-strategies  Building an Extension https://developer.mozilla.org/en-US/docs/Building_an_Extension  Getting Started with Extension Development http://kb.mozillazine.org/Getting_started_with_extension_development AJIN ABRAHAM 16 Kerala Cyber Force Learn | Contribute | Share
  • 17. Firefox Extension Template http://davidwalsh.name/firefox-extension-template  Add-on Developer FAQ https://addons.mozilla.org/en-US/developer_faq  Running Applications https://developer.mozilla.org/en-US/docs/Code_snippets/Running_applications  XPCOM Interface - nsILocalFile https://developer.mozilla.org/en- US/docs/XPCOM_Interface_Reference/nsILocalFile#launch()  File Input/output operation with add-on https://developer.mozilla.org/en- US/docs/Code_snippets/File_I_O#Getting_your_extension.27s_folder  Add-on Development https://blog.mozilla.org/addons/2009/01/28/how-to-develop-a-firefox-extension/  XPConnect Interface https://developer.mozilla.org/en-US/docs/XPConnect  XPCOM Interface – nsIProcess https://developer.mozilla.org/en-US/docs/XPCOM_Interface_Reference/nsIProcess AJIN ABRAHAM 17 Kerala Cyber Force Learn | Contribute | Share
  • 18. Event Listener https://developer.mozilla.org/en-US/docs/DOM/element.addEventListener  Firefox Session Restore http://kb.mozillazine.org/Session_Restore  XMLHTTP Request https://developer.mozilla.org/en-US/docs/DOM/XMLHttpRequest  XMLHTTP Request http://www.w3schools.com/xml/xml_http.asp  INTRODUCING WEBSOCKETS: BRINGING SOCKETS TO THE WEB http://www.html5rocks.com/en/tutorials/websockets/basics/  WebSockets https://developer.mozilla.org/en-US/docs/WebSockets  Using CORS http://www.html5rocks.com/en/tutorials/cors/  CORS + WebSocket DDoS Implementation https://github.com/chickenwin/DDoS-chickenwin/blob/master/test.html  Performing DDoS Attacks with HTML5 http://blog.andlabs.org/2010/12/performing-ddos-attacks-with-html5.html  HTTP access control (CORS) https://developer.mozilla.org/en/docs/HTTP_access_control AJIN ABRAHAM 18 Kerala Cyber Force Learn | Contribute | Share