1489946 - Firefox for Android App allow attackers to modify apps without affecting their signature.

Status: RESOLVED FIXED

(Firefox Build System :: Android Studio and Gradle Integration, defect, P1)

Description

[Bean3ai]

Attachment: firefox62.jpg

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36

Steps to reproduce:

Checking the Firefox for Android App`s signature information, I notice that it is using signature scheme version 1.  App`s signature information screenshots attached.


Actual results:

It is a serious vulnerability that could allow attackers to modify installed apps without affecting their signature. This vulnerability (designated as CVE-2017-13156, and also called the Janus vulnerability) affects versions of Android from 5.1.1 to 8.0


Expected results:

For compatibility reasons, developer could use a mixed signature (version 1 and 2) scheme.

Comment 1

[Bean3ai]

Attachment: v1.jpg

Comment 2

[Bean3ai]

Attachment: v1.jpg

Comment 3

[Bean3ai]

Attachment: v1.jpg

Comment 4

[Kevin Brosnan [Ex-Mozilla]]

Good write up of the issue. The CVE database links don't do a good job of describing the vuln. https://blog.trendmicro.com/trendlabs-security-intelligence/janus-android-app-signature-bypass-allows-attackers-modify-legitimate-apps/

Comment 5

[:sdaswani]

Will wait for a sec-rating from the security team before prioritizing this work.

Comment 6

[Daniel Veditz [:dveditz]]

This and bug 1489950 are essentially dupes -- I'm fairly sure we use the same build/signing infrastructure. But we can create a build/tooling bug and make both depend on it.

Comment 8

[Liz Henry (:lizzard) (relman/hg->git project)]

:catlee, might this be for your team as well as the Focus issue?

Comment 9

[Chris AtLee [:catlee]]

I'm pretty sure that this is a dupe of bug 1489950

Comment 10

[Liz Henry (:lizzard) (relman/hg->git project)]

Nick, can you help find an owner for this issue for Firefox 70?

Comment 11

[Liz Henry (:lizzard) (relman/hg->git project)]

oops, just realized this is more likely for :ulfr.

Comment 12

[Julien Vehent]

APKv2 support in autograph is planned for q3 2019.
https://github.com/mozilla-services/autograph/issues/64

Comment 13

[Liz Henry (:lizzard) (relman/hg->git project)]

I'd still love to get this into 70 if you have time for it in the next couple of weeks. We're heading into beta 8 (of 14) now.

Comment 14

[Julien Vehent]

Unfortunately, apk2 support slipped train-4. We will try to ship it with train-5 in 3 weeks, and it will be another couple weeks before we're comfortable signing fennec/fenix with it.

Comment 15

[Liz Henry (:lizzard) (relman/hg->git project)]

Ok, I'll mark this wontfix for 70 then. Thanks!

Comment 16

[Pascal Chevrel:pascalc]

Julien, is that something we should still track for 71? Thanks

Comment 17

[Julien Vehent]

Yes. APK2 is available in Autograph, and we can start moving applications to it.
We can start using it on Fenix Nightly for a train cycle (3 weeks) and move the rest in the next train.

Comment 18

[Julien Vehent]

Attachment: Switch non-release Fenix to apk2 in autograph prod config

Comment 19

[Julien Vehent]

As of yesterday, Fenix Nightly has been switched to APK2. Please QA.

Comment 20

[BugBot [:suhaib / :marco/ :calixte]]

There's a r+ patch which didn't land and no activity in this bug for 2 weeks.
:jvehent, could you have a look please?
For more information, please visit auto_nag documentation.

Comment 21

[Greg G]

The patch landed in a private config repo that I don't think autonag has access to.

Comment 22

[Pascal Chevrel:pascalc]

The status of this bug is a bit unclear but https://github.com/mozilla-services/autograph/issues/64 is closed and 71 is now behind us, so I am marking it as wontfix for our past releases. Julien is there something needed in this bug for 72/73

Comment 23

[Julien Vehent]

We're holding off on moving other releases to APK2 until January (end of year freeze), but at this point it's just a config change in the signing server to move the remaining applications to APK2. Nothing else is needed.

Comment 24

[Sylvestre Ledru [:Sylvestre]]

Greg, Aki, is that still a thing?

Comment 25

[Greg G]

(In reply to Sylvestre Ledru [:Sylvestre] from comment #24)

Greg, Aki, is that still a thing?

Nope, we migrated all apk signers to issue v2 signatures in autograph a couple years ago.