Comments on: Firefox Offline http://www.gnucitizen.org/blog/firefox-offline/ Information Security Think Tank Tue, 06 Jan 2009 07:22:48 +0000 http://wordpress.org/?v=2.7 hourly 1 By: pdp http://www.gnucitizen.org/blog/firefox-offline/comment-page-1/#comment-4977 pdp Wed, 21 Feb 2007 17:05:39 +0000 http://www.gnucitizen.org/blog/firefox-offline#comment-4977 Here is another interesting question: will FF3 allow caching of offline applications from https://. If that is the case, isn't that a security problem? if this offline http:// application contains sensitive information, attackers might be able to read it and use it. This is a huge problem if the user is checking their GMAIL from an Internet Cafe for example. Here is another interesting question: will FF3 allow caching of offline applications from https://. If that is the case, isn’t that a security problem? if this offline http:// application contains sensitive information, attackers might be able to read it and use it.

This is a huge problem if the user is checking their GMAIL from an Internet Cafe for example.

]]> By: pdp http://www.gnucitizen.org/blog/firefox-offline/comment-page-1/#comment-4939 pdp Wed, 21 Feb 2007 10:36:44 +0000 http://www.gnucitizen.org/blog/firefox-offline#comment-4939 Robert, Ben, Thanks for the comments. As I mentioned, it is very early to talk about possible problems in FF offline support, however, am I right by saying that if web applications can cache so do web malware? Also, I am interested to know how the offline state in web applications is defined. Is an application offline when there is no access to the remote server, or is it offline when the network cable is unplugged? It makes a big difference. In simple words, attackers might be able to cache malware code and call it when it is needed. This is a problem because it removes the need for external servers to host the malicious code. I can come up with dozens of other questions like this. We need to seriously think about the security implications involved in this feature. Robert, Ben,

Thanks for the comments. As I mentioned, it is very early to talk about possible problems in FF offline support, however, am I right by saying that if web applications can cache so do web malware? Also, I am interested to know how the offline state in web applications is defined. Is an application offline when there is no access to the remote server, or is it offline when the network cable is unplugged? It makes a big difference.

In simple words, attackers might be able to cache malware code and call it when it is needed. This is a problem because it removes the need for external servers to host the malicious code.

I can come up with dozens of other questions like this. We need to seriously think about the security implications involved in this feature.

]]> By: Ben Bucksch http://www.gnucitizen.org/blog/firefox-offline/comment-page-1/#comment-4913 Ben Bucksch Wed, 21 Feb 2007 00:49:58 +0000 http://www.gnucitizen.org/blog/firefox-offline#comment-4913 Not knowing all that more than you either, I think the technical base for this is simply a facility for web apps to store more complex data on disk than cookies. localstore.rdf, sqlite table, doesn't matter, it simply gets some space to write text and XML and whatnot in. Combine with smart cache and Boom you have your offline web apps. No increased privileges needed. This, the extend of a XSS would still be the same as today: The attacker can control gmail and the data in there, but nothing else. Not knowing all that more than you either, I think the technical base for this is simply a facility for web apps to store more complex data on disk than cookies. localstore.rdf, sqlite table, doesn’t matter, it simply gets some space to write text and XML and whatnot in. Combine with smart cache and Boom you have your offline web apps. No increased privileges needed.

This, the extend of a XSS would still be the same as today: The attacker can control gmail and the data in there, but nothing else.

]]> By: Robert O'Callahan http://www.gnucitizen.org/blog/firefox-offline/comment-page-1/#comment-4897 Robert O'Callahan Tue, 20 Feb 2007 21:25:24 +0000 http://www.gnucitizen.org/blog/firefox-offline#comment-4897 Good stuff to think about. However we're trying hard to keep the security model the same as the existing online model. For example, we won't allow offline apps to run "in the background" any more than we allow online apps to do so. On the downside this means you must explicitly visit the application page to resync when you get back online; on the upside, malware wouldn't be able to run invisibly. Furthermore, the offline cache that stores offline application resources is just a cache and it's only used when you're offline. When you're online the application will run using normal HTTP caching mechanisms and offline-cache resources will be revalidated against the online source. So I don't think this opens any new avenues of attack that don't exist with existing browser caching, unless we stuff up our implementation somehow. Good stuff to think about. However we’re trying hard to keep the security model the same as the existing online model.

For example, we won’t allow offline apps to run “in the background” any more than we allow online apps to do so. On the downside this means you must explicitly visit the application page to resync when you get back online; on the upside, malware wouldn’t be able to run invisibly.

Furthermore, the offline cache that stores offline application resources is just a cache and it’s only used when you’re offline. When you’re online the application will run using normal HTTP caching mechanisms and offline-cache resources will be revalidated against the online source. So I don’t think this opens any new avenues of attack that don’t exist with existing browser caching, unless we stuff up our implementation somehow.

]]>