751018 - [Security Review] Web Intents/Activities

Status: RESOLVED FIXED

(mozilla.org :: Security Assurance, task, P2)

Description

[Paul Theriault [:pauljt] (no longer reading bugmail)]

Security Review for Web Intents

Comment 1

[Paul Theriault [:pauljt] (no longer reading bugmail)]

Still chasing appropriate bug for this.

Comment 3

[Paul Theriault [:pauljt] (no longer reading bugmail)]

Possibly limited set of activities for milestone 3

Comment 4

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

SecReview Scheduled:
https://mail.mozilla.com/home/[e-mail]/Security%20Review.html?view=month&action=view&invId=110473-110472&pstat=AC&exInvId=110473-179818&useInstance=1&instStartTime=1338408000000&instDuration=3600000

Comment 5

[Paul Theriault [:pauljt] (no longer reading bugmail)]

Brain dump of a list of threats:

1. Handle an activity that provides access to sensitive information 
    - Mitigation: only certified (trusted and from carrier) apps can register for certain types TODO: what types? sms, dialing, 
2. Handle an activity, and deliberately return malicious/malformed/empty data (.e.g pretend to be the Contact app and PICK the wrong number for a contact)
    - Mitigation: Apps should treat all data as untrusted input
    - Mitigation: An app that returns broken or no data should be not chosen in the future by the user
3. Start an activity with a malicious payload (e.g. SMS to expensive number, SHARE exe instead of a photo
    - Mitigation: Apps fulfilling activities must validate the data provided
    - Mitigation: Handling of activity must allow for user review (e.g. for SMS, the user has a chance to clearly review where the SMS is going to be sent, and it's contents)
4. Start an activity that is sensitive: 
     - Mitigation: Ensure that ALL activities are safe to start (user should always have a chance to review the action before it is completed)
     (NB: in the gallery app case, should the LAUNCH camera be changed to PICK photo from camera since that is really what you are doing here?)
5. Too many apps are registered so the user can't see all the apps registered for an activity
    - Mitigation: provide a way to hide/remove an activity handler for a given app (or is the only option to remove the app entirely)

Comment 6

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

https://wiki.mozilla.org/Security/Reviews/B2GWebActivities

Comment 7

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

review is done, marking resolved fixed, we still have a blocking bug for this bug before we can go confirmed fixed