A First Look at Firefox OS Security Daniel DeFreez∗, Bhargava Shastryy, Hao Chen∗, Jean-Pierre Seiferty ∗University of California, Davis fdcdefreez,
[email protected] ySecurity in Telecommunications, Technische Universitat¨ Berlin fbshastry,
[email protected] Abstract—With Firefox OS, Mozilla is making a serious push the abuse of vulnerable applications. All privileged appli- for an HTML5-based mobile platform. In order to assuage cations have a default Content Security Policy applied and security concerns over providing hardware access to web ap- are reviewed for conformance to security guidelines prior to plications, Mozilla has introduced a number of mechanisms that being distributed through the official Firefox Market. The make the security landscape of Firefox OS distinct from both Content Security Policy almost categorically prevents Cross- the desktop web and other mobile operating systems. From an Site Scripting (XSS) via JavaScript injection, and code re- application security perspective, the two most significant of these mechanisms are the the introduction of a default Content Security view should pick up any misuse of permissions or obvious Policy and code review in the market. This paper describes how security errors. This paper asks whether these mechanisms lightweight static analysis can augment these mechanisms to find are sufficient to prevent developers from making trivially vulnerabilities which have otherwise been missed. We provide preventable security blunders. We find that they are not. The examples of privileged applications in the market that contain most prevalent attack vector, without a doubt, is HTML in- vulnerabilities that can be automatically detected. jection, and .innerHTML1 is the culprit.