Security/Reviews/APK Factory

From MozillaWiki
< Security‎ | Reviews
Revision as of 14:40, 20 November 2013 by Curtisk (talk | contribs)
Jump to navigation Jump to search
Please use "Edit with form" above to edit this page.

Item Reviewed

APK Factory
Target 
   
     Full Query
ID Summary Priority Status
896003 [theme] Support for Synthetic APKs (Fennec / Android) -- RESOLVED
936725 [SecReview]: APK Factory -- RESOLVED

2 Total; 0 Open (0%); 2 Resolved (100%); 0 Verified (0%);

{{#set:SecReview name=APK Factory

|SecReview target=

Full Query
ID Summary Priority Status
896003 [theme] Support for Synthetic APKs (Fennec / Android) -- RESOLVED
936725 [SecReview]: APK Factory -- RESOLVED

2 Total; 0 Open (0%); 2 Resolved (100%); 0 Verified (0%);

}}

Introduce the Feature

Goal of Feature, what is trying to be achieved (problem solved, use cases, etc)

APK Builder web service

  • Two key services:
    • Given an Open Web App manifest (or packaged app), produce an Android .apk install file
    • Given a list of web app manifests and version numbers, determine which apps are out of date

Status

  • Working prototype - https://github.com/jhugman/synth-apks
  • Proposed Architecture - https://www.lucidchart.com/documents/view/4262-9680-5285454a-bd0a-4a150a00de40
  • rforbes diagram: CZ67.png
  • Prereq: user has to allow install from other stores
    • ( corner case - .apks uploaded into Google Play store)
  • the apps are still web apps with a browser wrapper, this just allows them to be controled as individual processes and have the app name show up appropriatly
  • Main concern is Android keys,keys are per-app. You can't update an app if you lose the key.
  • Create Android apps for developers, so we need to create these keys and manage them.
  • Dolphin does something similar, they still use their browser to run them.
  • You must have Fennec installed, Android Intents are used to launch them
  • We're creating private keys and storing them.
  • We will tell developers that they can give us their private keys.

storage, management.

  • Marketplace will have a UI for developers to update their keys.
    • High risk, obvious benefits?
  • Keys are per app, not per developer key across all your apps.
  • APK Signer - Use solitude again.
    • HSM can take many months...
    • It's possble to sign multiple apps with the same key, to enable priviledged communication (SSO)
  • Upload dev key -> V2
  • Access will be locked down via the marketplace.

(IP Addresss OAuth...)

  • Fennec implements mozApps.install -> talks to APK Factory in the demo
  • Bundling on the fly can be a scaling detail...

??? confusion around the production plan for the service

What solutions/approaches were considered other than the proposed solution?

`

Why was this solution chosen?

  • Allows apps to show up in process manager as themselves
  • Allows for an install experience that users are familiar with

Any security threats already considered in the design and why?

`

Threat Brainstorming

  • Are the developers uploading their private key for signing?
    • Yes, moved to v2
  • Is the Android and Fx app signature checked on install / launch?
    • Yes both are checked
  • HSMs to store the keys (like FxOS) - mainly if storing dev's own keys
  • otherwise apps are also verified through a separate firefox os app signature (checked by code from firefox.apk/not the application's apk)
  • Is it possible to physically separate the two use-cases? Keep the production infrastructure that does the (offline non-realtime) apk building for Marketplace separate from the public web service that developers really only use for testing? Limits attack surface of production infrastructure. Allows for much stricter separation of deployments.
  • An exploit in the downloading, processing of a packaged app? Malformed zip file being extracted over a signed file?
  • (AMO may have code or procedures to help here)
  • Multiple filenames in the zip file.

{{#set: SecReview feature goal=* https://wiki.mozilla.org/User:Clouserw/APKFactorynutshell: run apps on android natively

APK Builder web service

  • Two key services:
    • Given an Open Web App manifest (or packaged app), produce an Android .apk install file
    • Given a list of web app manifests and version numbers, determine which apps are out of date

Status

  • Working prototype - https://github.com/jhugman/synth-apks
  • Proposed Architecture - https://www.lucidchart.com/documents/view/4262-9680-5285454a-bd0a-4a150a00de40
  • rforbes diagram: CZ67.png
  • Prereq: user has to allow install from other stores
    • ( corner case - .apks uploaded into Google Play store)
  • the apps are still web apps with a browser wrapper, this just allows them to be controled as individual processes and have the app name show up appropriatly
  • Main concern is Android keys,keys are per-app. You can't update an app if you lose the key.
  • Create Android apps for developers, so we need to create these keys and manage them.
  • Dolphin does something similar, they still use their browser to run them.
  • You must have Fennec installed, Android Intents are used to launch them
  • We're creating private keys and storing them.
  • We will tell developers that they can give us their private keys.

storage, management.

  • Marketplace will have a UI for developers to update their keys.
    • High risk, obvious benefits?
  • Keys are per app, not per developer key across all your apps.
  • APK Signer - Use solitude again.
    • HSM can take many months...
    • It's possble to sign multiple apps with the same key, to enable priviledged communication (SSO)
  • Upload dev key -> V2
  • Access will be locked down via the marketplace.

(IP Addresss OAuth...)

  • Fennec implements mozApps.install -> talks to APK Factory in the demo
  • Bundling on the fly can be a scaling detail...

??? confusion around the production plan for the service |SecReview alt solutions=' |SecReview solution chosen=* Allows apps to show up in process manager as themselves

  • Allows for an install experience that users are familiar with

|SecReview threats considered=' |SecReview threat brainstorming=* Are the developers uploading their private key for signing?

    • Yes, moved to v2
  • Is the Android and Fx app signature checked on install / launch?
    • Yes both are checked
  • HSMs to store the keys (like FxOS) - mainly if storing dev's own keys
  • otherwise apps are also verified through a separate firefox os app signature (checked by code from firefox.apk/not the application's apk)
  • Is it possible to physically separate the two use-cases? Keep the production infrastructure that does the (offline non-realtime) apk building for Marketplace separate from the public web service that developers really only use for testing? Limits attack surface of production infrastructure. Allows for much stricter separation of deployments.
  • An exploit in the downloading, processing of a packaged app? Malformed zip file being extracted over a signed file?
  • (AMO may have code or procedures to help here)
  • Multiple filenames in the zip file.

}}

Action Items

Action Item Status None
Release Target `
Action Items
'

{{#set:|SecReview action item status=None

|Feature version=` |SecReview action items=` }}

Retrieved from "https://wiki.allizom.org/index.php?title=Security/Reviews/APK_Factory&oldid=766835"