SecurityEngineering/Newsletter: Difference between revisions

From MozillaWiki
Jump to navigation Jump to search
No edit summary
(Replaced content with "This newsletter is no longer maintained. ---- '''Previous Editions''' * 2016 4th Quarter * SecurityEngineering/Newsletter/20...")
 
Line 1: Line 1:
= Security Newsletter Q4 2017 =
This newsletter is no longer maintained.  
 
Last quarter marked the milestone release of Firefox Quantum, the new Firefox browser. While project Quantum was largely focused on performance, Firefox 57 included a number of key security improvements:
 
<ul>
<li><blockquote><p>As of 57, all supported operating systems (Windows, Mac OS X, and Linux) have file system access restricted by the sandbox which is a major milestone in bringing a sandbox implementation to Firefox.</p></blockquote></li>
<li><blockquote><p>[https://blog.mozilla.org/security/2017/10/04/treating-data-urls-unique-origins-firefox-57/ Data URIs are now treated as unique opaque origins], rather than inheriting the origin of the settings object responsible for the navigation - which acts as an XSS mitigation.</p></blockquote></li>
<li><blockquote><p>Experimental support for anti-phishing FIDO U2F “Security Key” USB devices [https://mobile.twitter.com/jamespugjones/status/912314952232267777 ''landed behind a preference''] in Firefox 57.</p></blockquote></li></ul>
 
And we haven’t stopped there! Since 57, we’ve been busy continuing to make Firefox more secure than ever, including:
 
<ul>
<li><blockquote><p>Added more formally verified crypto algorithms (ChaCha20, Poly1305) to Firefox 59</p></blockquote></li>
<li><blockquote><p>Firefox 59 has preloaded Strict Transport Security support for top-level domains now</p></blockquote></li>
<li><blockquote><p>Media team completed the audio remoting work, allowing for tighter lockdown of our sandbox</p></blockquote></li></ul>
 
= Team Highlights =
 
== Security Engineering ==
 
=== Crypto Engineering ===
 
<ul>
<li><blockquote><p>We’ve implemented a formally-verified ChaCha20 and a verified Poly1305 into Firefox 59, joining our formally-verified Curve25519 implementation from Firefox 57. [[https://www.youtube.com/watch?v=xrZTVRICpSs ''Real World Crypto talk'']] [[https://rwc.iacr.org/2018/Slides/Beurdouche.pdf ''Slides'']]</p></blockquote></li>
<li><blockquote><p>The certificate and key databases for NSS have moved to a modern SQLite format from the prior DBM format in Firefox 58.</p></blockquote></li>
<li><blockquote><p>Our implementation of TLS 1.3 is updated to draft -23, which is expected to have much improved behavior with legacy middlebox network equipment (it’s both in Firefox Nightly and at [https://tls13.crypto.mozilla.org ''https://tls13.crypto.mozilla.org'']/).</p></blockquote></li>
<li><blockquote><p>Firefox 58 prints a warning to the browser console when encountering a Symantec-issued website certificate which will be subject to our distrust plan in Firefox 60. See [https://wiki.mozilla.org/CA/Additional_Trust_Changes ''the CA program's Additional Trust Changes''] page for details.</p></blockquote></li>
<li><blockquote><p>Firefox 59 supports add-ons to be signed using PKCS7 SHA-256 signatures, as well as a new COSE-based format (RFC 8152) with algorithm agility. Add-ons will move to the new COSE signature format over time.</p></blockquote></li>
<li><blockquote><p>Firefox 59 has preloaded Strict Transport Security support for top-level domains now, via the hstspreload.org list.</p></blockquote></li></ul>
 
=== Privacy and Content Security ===
 
<ul>
<li><blockquote><p>[https://blog.mozilla.org/blog/2018/01/23/latest-firefox-quantum-release-now-available-with-new-features/ ''We enabled always-on Tracking Protection in Firefox Quantum''] (Firefox 57)</p></blockquote></li>
<li><blockquote><p>[https://blog.mozilla.org/security/2017/11/27/blocking-top-level-navigations-data-urls-firefox-58/ ''To mitigate phishing attempts we started to block top-level data URI navigations''] within Firefox 58.</p></blockquote></li>
<li><blockquote><p>To help prevent third party data leakage while browsing privately, [https://blog.mozilla.org/security/2018/01/31/preventing-data-leaks-by-stripping-path-information-in-http-referrers/ ''Firefox Private Browsing Mode will remove path information from referrers sent to third parties starting in Firefox 59''].</p></blockquote></li>
<li><blockquote><p>Added a preference to allow users disable FTP (network.ftp.enabled)</p></blockquote></li>
<li><blockquote><p>Added CSP improvements in Firefox 58</p></blockquote>
<ul>
<li><blockquote><p>Support for worker-src directive landed in 58</p></blockquote></li>
<li><blockquote><p>security policy violation events (previously behind a pref) were enabled in Nightly starting in 58</p></blockquote></li></ul>
</li>
<li><blockquote><p>Continued our efforts to harden the web against attacks:</p></blockquote>
<ul>
<li><blockquote><p>Moved to deprecate AppCache from insecure [https://blog.mozilla.org/security/2018/02/12/restricting-appcache-secure-contexts/ ''contexts'']</p></blockquote></li>
<li><blockquote><p>X-Frame-Options will now check all frame ancestors are the same origin</p></blockquote></li>
<li><blockquote><p>Treating insecure flash requests as mixed active instead of mixed passive (behind a preference for now, will ship in future version)</p></blockquote></li>
<li><blockquote><p>[https://bugzilla.mozilla.org/show_bug.cgi?id=1420622 ''Removal''] of legacy pcast: and feed: protocols (previously a source of security issues)</p></blockquote></li></ul>
</li>
<li><blockquote><p>Hardening improvements</p></blockquote>
<ul>
<li><blockquote><p>FORTIFY_SOURCE landed for Mac and Linux</p></blockquote></li>
<li><blockquote><p>Initial testing of Control Flow Guard deployment (bug [https://bugzilla.mozilla.org/show_bug.cgi?id=1235982 ''1235982''])</p></blockquote></li></ul>
</li></ul>
 
=== Content Isolation ===
 
<ul>
<li><blockquote><p>Audio library remoting work completed by the (media team) allowed the Content Isolation team to secure content process access to various audio services (OSX) and networking related application programming interfaces (Linux).</p></blockquote></li>
<li><blockquote><p>A newly developed application programming interface (API) hooking framework is currently being tested in the 64-bit Flash sandbox. For Flash, the framework will handle better securing of networking related API access and is planned to ship in 60.</p></blockquote></li>
<li><blockquote><p>The alternative-desktop feature on Windows has been held up from shipping due to various incompatibilities with 3rd party software running on the same device. A dependent project involving elimination of native windowing event dispatch in content processes is reaching completion. Completion should facilitate alternative desktop rolling out in Firefox 60.</p></blockquote></li></ul>
 
== Operations Security ==
 
<ul>
<li><blockquote><p>With more of the Firefox continuous integration moving to [https://github.com/taskcluster ''Taskcluster''], we looked into the security posture of the platform. A number of hardening projects were spun off that will continue throughout 2018.</p></blockquote></li>
<li><blockquote><p>Signature verification of release artifacts now covers all Windows builds. MacOS and MAR are next.</p></blockquote></li>
<li><blockquote><p>We reviewed the security of repositories hosted in GitHub. Next step is to finalize a security standard and write tools to check compliance.</p></blockquote></li>
<li><blockquote><p>In Austin, we ran a Capture The Flag challenge to teach web security to dozens of engineers. We used [http://www.zaproxy.org/ ''ZAP''], [https://github.com/bkimminich/juice-shop ''OWASP Juice Shop''] and [https://github.com/CTFd/CTFd ''CTFd''] to great success.</p></blockquote></li></ul>
 
== Cross-Team Initiatives ==
 
<ul>
<li><blockquote><p>Mozilla sent a [https://blog.mozilla.org/security/2018/01/29/january-2018-ca-communication/ ''CA Communication''] to inform [https://en.wikipedia.org/wiki/Certificate_authority ''Certificate Authorities (CAs)''] who have root certificates [https://wiki.mozilla.org/CA/Included_Certificates ''included in Mozilla’s program''] about current events related to domain validation for SSL certificates and to remind them of a number of upcoming deadlines.</p></blockquote></li></ul>
 
= Security Blog Posts &amp; Presentations =
 
<ul>
<li><blockquote><p>[https://blog.mozilla.org/security/2018/01/31/preventing-data-leaks-by-stripping-path-information-in-http-referrers/ Preventing data leaks by stripping path information in HTTP Referrers]</p></blockquote></li>
<li><blockquote><p>[https://blog.mozilla.org/blog/2018/01/23/latest-firefox-quantum-release-now-available-with-new-features/ ''https://blog.mozilla.org/blog/2018/01/23/latest-firefox-quantum-release-now-available-with-new-features/'']</p></blockquote></li></ul>


----
----
Line 85: Line 6:
* [[SecurityEngineering/Newsletter/2017Q1|2017 1st Quarter]]
* [[SecurityEngineering/Newsletter/2017Q1|2017 1st Quarter]]
* [[SecurityEngineering/Newsletter/2017Q2|2017 2nd Quarter]]
* [[SecurityEngineering/Newsletter/2017Q2|2017 2nd Quarter]]
* [[SecurityEngineering/Newsletter/2017Q4|2017 4th Quarter]]

Latest revision as of 03:28, 28 November 2018

This newsletter is no longer maintained.

Previous Editions

Retrieved from "https://wiki.allizom.org/index.php?title=SecurityEngineering/Newsletter&oldid=1204465"