Wojtek Zieliński

1. Introduction to desktop browser add-ons.
Explanation the process of moderation.
Most frequent attack vectors and good
practices for developers.
Wojtek Zieliński

2. Browser add-ons
Themes
Extensions

3. Browser themes
persona.ini

4. Browser themes

5. Browser extensions
Html
CSS
JavaScript

6. Browser extensions
Background script (UI, app state, sync)
Content script (context, DOM, r/w, limitations)
Popups
Options
Speed Dials
Sidebars
./manifest.json (metadata)

7. Moderation process
1. Check metadata: summary, description, category,
service, support, source code, icons, screenshots, etc.
2. Acceptance criteria:
– Must perform as described
– Screenshots, description, category
– Private information
– Remote code execution
– Obfuscation
3. Code review

8. Moderation process /
Static code review
New and upgrades
Redundant files, permission, comments
• Code performance
• Thieving data
• Proposing fix
• Bad programming techniques, attacks, malware code
• Cooperation
Additional testing
Automation

9. Vulnerability in extensions
– External scripts (http, m-i-m)
– Parsing JSON using eval()
– Passing strings to setTimeout() and setInterval()
– Inserting untrusted data into Event Handler
– Using InnerHTML
– Bugs in third party libraries jQuery
– A bunch of other XSS attacks

10. Vulnerability in extensions /
External script injection

11. Vulnerability in extensions /
Parse JSON using eval()
1. eval(json string) 2. JSON.parse(json string)
3. eval(JS string) 4. JSON.parse(JS string)

12. Vulnerability in extensions /
Event Handlers

13. Vulnerability in extensions /
innerHTML

14. Vulnerability in extensions /
data-target

15. Tahnk You!