985059 - Check for DLL injection with stub installer

Status: RESOLVED DUPLICATE of bug 1361326

(Firefox :: Installer, defect)

Description

[Kamil Jozwiak [:kjozwiak]]

This issue is the exact same as Bug #945192 but will concentrate on the unknown DLL's that are being loaded while installing Firefox via the regular installer. Current progress can be found here:

https://intranet.mozilla.org/User:[e-mail]/DLL_Hijacking_via_StubInstaller

Comment 1

[Kamil Jozwiak [:kjozwiak]]

Comment #0 meant to say "loaded while installing Firefox via the regular Stub Installer"

Comment 2

[Kamil Jozwiak [:kjozwiak]]

Quick Update:

- Installed all the needed Win OS's (both x64 and x86 versions)
- Went through each OS and listed all the unknown DLL's (went through this process twice to make sure nothing was missing)
- Once the entire unknown DLL list was created, went through each OS one more time to make sure nothing was missed
- Beginning to create the exploit DLL's using the utility/process mentioned in bug #945192 comment #10 (will be adding those steps in the wiki for future reference)

Comment 3

[Matt Wobensmith [:mwobensmith][:matt:]]

Kamil, has there been any progress here? Is there ongoing testing, or are you waiting for feedback from a developer? We'd like to know what's actionable here. Thanks.

Comment 4

[Kamil Jozwiak [:kjozwiak]]

Matt,

This is basically the same issue as bug #945192 but I split the work into three different tickets (Installer, Updater, Stub Installer) rather then adding it all into one giant ticket (there's a lot of information and DLL's). I as per Bug #945192 comment #17, I plan on finishing this up at the end of next week. I'm just finishing up some things with telemetry experiments.

I have the environment/tools installed and just need to start creating the proxy DLL's and seeing if I can reproduce the issue with those unknown DLL's. (I'll update the ticket/wiki's accordingly)

Comment 5

[Kamil Jozwiak [:kjozwiak]]

Attachment: Win XP Pro DLL's (x86 & x64)

Current Progress:

* Windows XP SP3 x86 [FOUND 0 DLL's]
* Windows XP SP2 x64 [Found 1 POSSIBLE DLL]
* Windows Vista x86 [FOUND 1 DLL & 1 CRASH]
* Windows Vista x64 [FOUND 1 DLL & 1 CRASH]
* Windows 7 x86 [FOUND 1 DLL]
* Windows 7 x64 [FOUND 1 DLL]

Comment 6

[Kamil Jozwiak [:kjozwiak]]

Attachment: Win Vista Ultimate DLL's (x86 & x64)

Comment 7

[Kamil Jozwiak [:kjozwiak]]

Attachment: Win 7 Pro DLL's (x86 & x64)

Comment 8

[Kamil Jozwiak [:kjozwiak]]

Attachment: Win 8 DLL's (x86 & x64)

Finished going through the entire list of unknown DLL's, affected DLL's are highlighted bold and listed in the intra wiki from comment #0.

Comment 9

[Kamil Jozwiak [:kjozwiak]]

Attachment: Win 8.1 DLL's (x86 & x64)

Comment 10

[Kamil Jozwiak [:kjozwiak]]

Attachment: Win 8.1 DLL's (x86 & x64)

Added an incorrect DLL into the 7zip file earlier, this one is the correct version

Comment 11

[Brian R. Bondy [:bbondy]]

we have a blanket fix for this type of issue in review on updater now. We'll likely use that in installer code after that is done. Still a ways off, but just giving an update.