Friday, August 25, 2006

I know what you've got (Firefox Extensions)

Update: I removed the JS PoC from the template. Was messing up IE.

Update
: Some generous person, who sadly didn't leave their name, supplied me with a bunch more Firefox Extension signatures. Way cool! I updated the PoC code on the blog. Enjoy!


RSnake discovered a great way to detect installed Firefox extensions using the chrome: protocol handler. I liked it so much and in keeping CSS/JS History Hack, I just had to have some proof-of-concept code for the blog. I improved upon his design a bit, making it more complete as far as popular extensions go and easier to add new signatures. On the right side column look for the "I know what you've got" heading. Below you should see a list of detected extensions, if any. Again, I'm not capturing this data, just redisplaying it.

The chrome protocol handler enables reaching into the FF browser extensions folder to access image resources. For instance the Google Toolbar has chrome://google-toolbar/skin/icon.png. For detection create an IMG DOM Object with an onload event handler. If the onload event handler fires, you know the extension is there because the URL is unique.

I put in signatures for Adblock Plus, Auto Copy, ColorZilla, Customize Google, DownThemAll, Faster Fox, Flash Block, FlashGot, Forecastfox, Google Toolbar, Greasemonkey, IE Tab, IE View, JS View, Live HTTP Headers, MeasureIt, SEO For Firefox, SEOpen, Search Status, Server Switcher, StumbleUpon, Tab Mix Plus, Torrent-Search Toolbar, User Agent Switcher, View Source With, Web Developer.

Source:
// popular extensions.
var e = {
"Adblock Plus" : "chrome://adblockplus/skin/adblockplus.png",
"Auto Copy" : "chrome://autocopy/skin/autocopy.png",
"ColorZilla" : "chrome://colorzilla/skin/logo.png",
"Customize Google" : "chrome://customizegoogle/skin/32x32.png",
"DownThemAll!" : "chrome://dta/content/immagini/icon.png",
"Faster Fox" : "chrome://fasterfox/skin/icon.png",
"Flash Block" : "chrome://flashblock/skin/flash-on-24.png",
"FlashGot" : "chrome://flashgot/skin/icon32.png",
"Forecastfox" : "chrome://forecastfox/skin/images/icon.png",
"Google Toolbar" : "chrome://google-toolbar/skin/icon.png",
"Greasemonkey" : "chrome://greasemonkey/content/status_on.gif",
"IE Tab" : "chrome://ietab/skin/ietab-button-ie16.png",
"IE View" : "chrome://ieview/skin/ieview-icon.png",
"JS View" : "chrome://jsview/skin/jsview.gif",
"Live HTTP Headers" : "chrome://livehttpheaders/skin/img/Logo.png",
"MeasureIt" : "chrome://measureit/skin/measureit.png",
"SEO For Firefox" : "chrome://seo4firefox/content/icon32.png",
"SEOpen" : "chrome://seopen/skin/seopen.png",
"Search Status" : "chrome://searchstatus/skin/cax10.png",
"Server Switcher" : "chrome://switcher/skin/icon.png",
"StumbleUpon" : "chrome://stumbleupon/content/skin/logo32.png",
"Tab Mix Plus" : "chrome://tabmixplus/skin/tmp.png",
"Torrent-Search Toolbar" : "chrome://torrent-search/skin/v.png",
"User Agent Switcher" : "chrome://useragentswitcher/content/logo.png",
"View Source With" : "chrome://viewsourcewith/skin/ff/tb16.png",
"Web Developer" : "chrome://webdeveloper/content/images/logo.png",
"Unhide Passwords" : "chrome://unhidepw/skin/unhidepw.png",
"UrlParams" : "chrome://urlparams/skin/urlparams32.png",
"NewsFox" : "chrome://newsfox/skin/images/home.png",
"Add N Edit Cookies" : "chrome://addneditcookies/skin/images/anec32.png",
"GTDGmail" : "chrome://gtdgmail/content/gtd_lineitem.png",
"QuickJava" : "chrome://quickjava/content/js.png",
"Adblock Filterset.G Updater" : "chrome://unplug/skin/unplug.png",
"BBCode" : "chrome://bbcode/skin/bbcode.png",
"BugMeNot" : "chrome://bugmenot/skin/bugmenot.png",
"ConQuery" : "chrome://conquery/skin/conquery.png",
"Download Manager Tweak" : "chrome://downloadmgr/skin/downloadIcon.png",
"Extended Cookie Manager" : "chrome://xcm/content/allowed.png",
"FireBug" : "chrome://firebug/content/firebug32.png",
"FoxyTunes" : "chrome://foxytunes/skin/logo.png",
"MR Tech Disable XPI Install Delay" : "chrome://disable_xpi_delay/content/icon.png",
"SessionSaver .2" : "chrome://sessionsaver/content/ss.png",
"spooFX" : "chrome://spoofx/skin/main/spoofx.png",
"Statusbar Clock" : "chrome://timestatus/skin/icon.png",
"Torbutton" : "chrome://torbutton/skin/bigbutton_gr.png",
"UnPlug" : "chrome://unplug/skin/unplug.png",
"View Source Chart" : "chrome://vrs/skin/vrssmall.png",
"XPather" : "chrome://xpather/content/iconka.png",

};

if (is_mozilla) {
showExtensions();
}

function showExtensions() {
for (var i in e) {
var img = document.createElement("img");
img.setAttribute("border", '0');
img.setAttribute("width", '0');
img.setAttribute("height", '0');
img.setAttribute("onload", "document.getElementById('ext').
appendChild(document.createElement('li')).innerHTML='" + i + "'");

img.setAttribute("src", e[i]);
}

}

If you have more signatures with extension names and unique-chrome-url, comment them in and I'll add them to the list. And I agree with RSnake that we'll have to dig deeper into the chrome handler to see if any issues exist with the extensions. So much research, so little time.

12 comments:

Anonymous said...

Have fun ;)
"Adblock Filterset.G Updater" : "chrome://unplug/skin/unplug.png",
"BBCode" : "chrome://bbcode/skin/bbcode.png",
"BugMeNot" : "chrome://bugmenot/skin/bugmenot.png",
"ConQuery" : "chrome://conquery/skin/conquery.png",
"Download Manager Tweak" : "chrome://downloadmgr/skin/downloadIcon.png",
"Extended Cookie Manager" : "chrome://xcm/content/allowed.png",
"FireBug" : "chrome://firebug/content/firebug32.png",
"FoxyTunes" : "chrome://foxytunes/skin/logo.png",
"MR Tech Disable XPI Install Delay" : "chrome://disable_xpi_delay/content/icon.png",
"SessionSaver .2" : "chrome://sessionsaver/content/ss.png",
"spooFX" : "chrome://spoofx/skin/main/spoofx.png",
"Statusbar Clock" : "chrome://timestatus/skin/icon.png",
"Torbutton" : "chrome://torbutton/skin/bigbutton_gr.png",
"UnPlug" : "chrome://unplug/skin/unplug.png",
"View Source Chart" : "chrome://vrs/skin/vrssmall.png",
"XPather" : "chrome://xpather/content/iconka.png",

Step said...

Alright, so you know what extensions we're running. Now what do we do about that? Disable extensions? Stop using Firefox? (I know, run for the hills. ;) )

Seriously, what is the next step for the user to stay safe and protect our privacy until mozilla somehow addresses this?

Jeremiah Grossman said...

Steph, that's a really good question. First I would say that if someone knows your extensions that its is a privacy issue, not necessarily a security one. And for the moment the violation is not THAT bad. The only way to prevent detection is to either disable JavaScript, yuck, or uninstall the extension, worse. Running for the hills is of course optional.

But when you posed the question what ran through my mind was the future research that has yet to be done that RSnake mentioned. Do FF extensions have security issues that we can take advantage of from JavaScript space? The answer is "I don't know", but again we haven't looked. So maybe this could eventually turn into a security issue in the near future. We'll have to wait and see.

Ronald van den heetkamp said...

@Jeremiah who said:

"or uninstall the extension"

This is no option, because any available extension can be traced, so one has to uninstall all of them.

I'm an extension developer myself, and i think a few measures can be made from our side: not implement the images in the extension, at least that would be a tradeoff, it is possible then to detect on other files in in the extension folder i know. The images are only visible in the extension manager mostly, and are not needed in anyway, one can do without them.

It is also possible to detect other files in the extension folder which incorporates other data.

The thing i am afraid of is that there could be code flaws in some extensions, and in combination with the detection and some good ajax programming could lead to exploits.

And really i have no suggestions how to fix and address this issue, i have questioned other Mozilla developers, and awaiting awnsers.

Anonymous said...

Seems it's been there for quite sometime and they know about it alright:

https://bugzilla.mozilla.org/show_bug.cgi?id=292789

Anonymous said...

what if i wish to block some of these extensions while the user visits my website? is there a way?

Jeremiah Grossman said...

No, just detect, not block

Anonymous said...

Adblock Plus can help stop scripts from trying to detect extensions. See here: http://adblockplus.org/en/faq_internal#protectchrome

Win said...

To take it even further ...
Is there anyway to detect what Greasemonkey User Scripts are running?

Win said...

I wonder why your code does not detect Greasemonkey although I can access chrome://greasemonkey/content/status_on.gif

Which chrome folders are all those images located on Mac OS X and Windows?

MTec89 said...

this doesn't work any more. JS Error Console marks all references to chrome:// as security risk and is disabled.

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.11) Gecko/2009060308 Ubuntu/9.04 (jaunty) Firefox/3.0.11

icon manager said...

its a very very nice blog.