Mozillas Sync Extension (WS10/11)
Total Page:16
File Type:pdf, Size:1020Kb
Weaving secure synchronization into Mozilla Firefox - Mozillas Sync Extension (WS10/11) Markus Rudel Seminar Work at Chair for Network and Data Security Prof. Dr. Jörg Schwenk advised through Dominik Birk 26.01.2011 Horst-Görtz Institute Ruhr-University of Bochum Contents 1 Introduction 1 1.1 Motivation . .1 1.2 Sync extension . .1 2 Implementation 3 2.1 Synchronized data . .3 2.2 Security measures . .3 2.2.1 Used encryption algorithms . .4 2.2.2 Username and password . .4 2.2.3 Key management and de/encryption . .4 2.3 Server component . .8 2.3.1 Server installation . .8 2.3.2 Server configuration . .9 2.3.3 Database structure . .9 2.3.4 Used URL scheme . 10 2.3.5 Mozillas implementation . 10 3 Security considerations 11 3.1 Man-in-the-middle related attacks . 11 3.1.1 Self-signed certificates . 11 3.1.2 Replaying already transferred data . 12 3.1.3 Validation on server side . 12 3.1.4 Manipulation of transferred data . 12 3.2 Extension manipulation on client side . 17 3.3 Security on server side . 18 4 Summary 19 i List of Figures 2.1 Allowed characters in usernames and passwords . .4 2.2 Necessary values for the first encryption . .5 2.3 Basic WBO encryption . .6 2.4 WBO decryption . .7 2.5 Basic database scheme . .9 3.1 Check for modifications 1 . 13 3.2 Check for modifications - continued, but no change detected . 14 3.3 Check for modifications - continued, but change detected . 15 3.4 Check for modifications 2 . 16 1 Introduction In this paper, we will present the new Mozilla Firefox extension called Firefox Sync [Moz10b]. It allows an easy and secure way of synchronizing browser settings, bookmarks and especially login data. As this data contains sensitive and personal information, it is necessary to get an insight in the functionality of the extension and to focus especially on how data is stored and transported. Most users will use the public servers of the Mozilla Foundation and it is therefore crucial to understand what happens to their synchronized data. Due to the increased availability of mobile devices and computers, we need a secure and easy way to share data between the devices. A user might want to switch from his netbook to his home computer because of the bigger screen. However, retyping the addresses of the opened browser tabs is exhausting. By using a synchronization extension for Firefox, you can easily continue your work on another computer. Another important reason for the Sync extension is the backup aspect. The browser profile is saved with each of its saved bookmarks and settings, so that in case your computer crashes, you can access your data from another authorized computer. Last but not least you can securely use more complex passwords for your logins without the need to memorize them, as they can also be synchronized to other computers. 1.1 Motivation Synchronization between different pools of data tends to be complicated and sometimes frustrat- ing. The possible loss of information during a synchronization is an important factor to distrust in such an infrastructure like Mozillas Sync service. Mozilla pledges an easy and especially secure way of realizing this claim. Today’s browsers contains confidential data like logins to online banking, e-commerce or social networks. By promising to exchange this kind of sen- sitive data between computers over potentially insecure networks, it is important to protect it from curious eyes. During my Bachelor thesis I already got experiences in analyzing secured data transfer with a focus on the Google Chrome web-browser. Now it is interesting to see how Mozilla solves this problem keeping in mind that Google announced a similar service for their browser. In respect of data security, it is also worthwhile to point out the possibility to install your own server in your trusted environment, which makes Sync interesting for commercial use. 1.2 Sync extension The development of the Sync extension started in 2009 [Moz10c] and it was first called Weave. It should weave different browser installations on different PCs and their individual settings together in one common profile. The idea of synchronizing browser profiles is not new, as 1 several other services appeared earlier on the internet. But they were often centered around synchronizing the bookmarks1 instead of whole user profiles. With more and more browsers supporting synchronizing profiles (i.e. Google Chrome [Goo10] or Opera [Ope10]), the Mozilla Foundation needed to add this feature to their browser to keep up in order to be able to compete. There are also non-browser specific programs for this function. One example is the Xmarks service, which should be discontinued in January 2011 due to a insufficient business plan [Tod10]. Another possible solution could be the use of a portable drive with modified browser versions, which saves all the users data and program content. The installation of the Sync extension is quite simple and needs no complicated installation routines. The user visits the Sync homepage in the Firefox Extension Repository [Moz10a] and clicks on "Add to Firefox". After a browser restart the extension is available and active. The user is asked to create a new account or to login with an existent account. For further instructions on this matter, please refer to the Mozilla knowledge base entry [Moz10m]. At this time of installation, the user is also asked to use the Mozilla Sync server or his own server. 1Depending on the used browser bookmarks are also called favorites. 2 2 Implementation This chapter gives a short insight into the different types of synchronized data, the used security measures like used encryption algorithms, the choice of username and password, the key man- agement and de/encryption as well as a closer look at the server component of the extension. 2.1 Synchronized data The extension synchronizes different types of data [Moz10l], notably bookmarks, history, pass- words, tabs, user preferences as well as an API1 for other developers [Moz10h], so that they can synchronize their data as well. All items are stored inside so called Weave Basic Objects (WBOs) and are organized in collections. While the WBO contains the actual synchronized item (e.g. bookmark, tab), the collection combines several WBOs of a session to one set of data for a browsing session. There are three different synchronization modes to choose from, when the Sync extension registers with the synchronization servers: "two-way synchronization between each Firefox", "other Firefox browsers overwrites this Firefox" and "this Firefox overwrites other Firefox browsers". It is the users choice to determine the behavior of his Sync clients to the server. 2.2 Security measures It is important to ensure privacy and confidentiality for the users profile data. The Sync exten- sion uses several security measures to achieve these aims, therefore we will present you in this chapter the used encryption algorithms, the choice of username and password as well as the used key management and de/encryption workflows. To analyze and understand the used encryption algorithms, an insight into the extensions source code is helpful. As Mozilla Sync is published open source2, we can easily examine the Mozilla Sync extension source code3 as well as the Mozilla Sync server source code consisting of a user registration server component4 and the actual Sync server component5. 1API stands for application programming interface. 2Open source means that the used source coded can be openly reviewed. 3This source code was accessed on 27th October 2010 (http://hg.mozilla.org/services/fx- sync/log?rev=c540c68ecda1). 4This source code was accessed on 14th November 2010 (http://hg.mozilla.org/services/reg-server/). 5This source code was accessed on 14th November 2010 (http://hg.mozilla.org/services/sync-server/). 3 2.2.1 Used encryption algorithms The Sync extension is written by the Mozilla foundation. The developers used for this extension already existing working and proven code from older projects. So they used Mozillas own crypto engine library called Network Security Services (NSS) [Moz09]. Another important reason for choosing this library lies in its platform independency. This allows the extension to work on almost all major operating systems, as the NSS is written in JavaScript. NSS supports SSL v2 and v3, TLS v1, PKCS 5, PKCS 7, PKCS 11, PKCS 12, SMIME, X.503 v3 certificates, and other security standards and algorithms [Moz10k]. But the Sync extension uses only a small set of this functionality: it only uses RSA with a 2048 bit private key, PBKDF2, AES 256-bit in CBC Mode for encryption and TLS v1 for secure data exchange with the Sync server. Mozilla states in their privacy policy [Moz10d] that their engine assures an SSL-secured con- nection to their servers and that there is no way that a server administrator is able to view unen- crypted data [Moz10g]. The following chapters will explain the necessary steps to achieve these aims. 2.2.2 Username and password When using the Sync service for the first time, the user has to create a new user account, con- sisting of e-mail address and password. The following characters are allowed to be used as a password: Figure 2.1: Allowed characters in usernames and passwords The username will be randomly generated and will be saved together with the e-mail address. They will be used together with the password to authenticate against the Sync server. The pass- word can be changed via the extension settings. Username and password can be seen in the Firefox password manager, if no master password is set. 2.2.3 Key management and de/encryption After having successfully created a new account, the extension generates a passphrase for the user6, consisting of twenty random characters between a and z.