Firefox Security Newsletter/FSN-2021-Q4

Hello fellow Mozillians,

Security and Privacy build cornerstones of Mozilla’s manifesto, and they influence how we operate and build our products. Here are the highlights representing our work from October, November, December 2021, grouped into the following categories:

• Firefox Security & Privacy, showcasing new Security & Privacy Features and Integrations in Firefox.
• Core Security, outlining Security and Hardening efforts within the Firefox Platform.
• Cryptography, showcasing improvements to connection security.
• Web Security, allowing websites to better protect themselves against online threats.
• Fuzzing, providing updates for automated security testing and analysis.

Firefox Product Security & Privacy

Introducing a New Site Isolation Security Architecture: You are probably aware that Project ‘Fission’ shipped in Firefox 94 - when visiting sites using this new security architecture Firefox ensures separated memory for different sites and as a result provides advanced security guarantees.

Protecting against insecure downloads: To better protect you from the dangers of insecure HTTP downloads, Firefox will now block insecure HTTP downloads from HTTPS pages.

Improving SmartBlock and new Referrer Tracking Protections: Firefox 93 ships with a more comprehensive version of SmartBlock. Additionally, our new and enhanced referrer tracking protection prevents sites from sharing sensitive user data via HTTP referrers. To further protect against navigational tracking, we have also enabled URL Query Stripping, which removes known tracking parameters from the URL.

Adding EDNS Padding Support: DNS over HTTPS in Firefox provides greater confidentiality for queries made by the end-user; so traffic analysis mitigations like padding become more relevant. EDNS Padding support landed in Firefox 95.

Core Security

RLBox: In Firefox 95 we shipped a lightweight intra-process sandboxing technology to isolate sub-components by compiling them to WebAssembly. While RLBox had been shipping in some capacity before, this release marks a milestone where it ships on all platforms (Desktop and Mobile) isolating five different modules in Firefox 95 and subsequently 96: Graphite,[1]Hunspell,[2]Ogg,[3]Expat and[4]Woff2. You can read more about this on the Mozilla Hacks blog.

API Hardening: After discovering some integer truncation issues in nsCString APIs, some benign and others not-so-benign, we hardened the apis exposed so that these types of issues cannot recur.

Enabling FORTIFY_SOURCE on Android: FORTIFY_SOURCE is a lightweight macro that allows detecting buffer overflows. We have now enabled FORTIFY_SOURCE on Android, bringing it to parity with our Desktop.

Cryptography

Securing Connections by disabling 3DES: Our continuous work to ensure that Firefox provides secure and private network connections causes us to disable configurations or even entire protocols when they’re old and infrequently used. 3DES (“triple DES”) was a popular encryption algorithm for many years but has fallen out of use and we disabled it by default in Firefox 93.

Advancing our implementation of Encrypted Client Hello: In early 2021 we announced that we are working on Encrypted Client Hello, which allows us to provide better privacy for TLS1.3 connections. In Q4 of 2021 we updated our implementation to the latest IETF draft specification (Draft 14) and tested interoperability with other major implementations.

Improving the Quality of Publicly Trusted Intermediate CA Certificates: Keeping our commitment to the security and privacy of individuals on the internet, we continued to increase our oversight and add automation to our compliance-checking of publicly trusted intermediate CA certificates. These include improvements that allow us to automatically process CA audit reports using Audit Letter Validation (ALV), advise CAs on the status of their intermediate certificates, and provide CAs and root store operators with lists of tasks relevant to intermediate certificates listed in the CCADB.

Web Security

SHA-256 support for HTTP Auth: The SHA-256 algorithm is now supported for digest-based[5]HTTP Authentication in Firefox 93. This allows much more secure authentication than previously available using the MD5 algorithm.

crypto.randomUUID() support: The[6]crypto.randomUUID() function is now supported. This returns a cryptographically strong 36 character fixed-length UUID.

Support onsecuritypolicyviolation on global: In Firefox 93, the[7]onsecuritypolicyviolation event handler property is now supported: This can be used to assign a global handler for processing[8]securitypolicyviolation events fired when there is a[9]Content Security Policy violation.

Fuzzing

Adding additional UBSan Checks: Our Fuzzing Team has been reducing our undefined behavior by testing additional UBSan checks like function and float-cast-overflow and filing and correcting issues. Nightly can already launch without triggering any issues, though a few fixes remain for tests failing in CI.

Fuzzing WebGPU’s Javascript API in Domino: The Fuzzing Team expanded our fuzzing coverage to WebGPU by implementing a fuzzing target for its Javascript API in Domino. Domino is our primary fuzzer for Web APIs in full-browser testing. In addition, we are also investigating further testing methods for the WebGPU feature before release.

Going Forward

Thanks to everyone involved in making Firefox and the Open Web more secure and privacy-respecting. Since we are already in the first quarter of the year 2022, please do not forget to add your items to the 2022 Q1 Security & Privacy Newsletter (Collection Document) so that they will show up in the next iteration of the Firefox Security & Privacy newsletter.

In the name of everyone improving Security and Privacy within Firefox, Mozilla and the Open Web,

Christoph, Freddy, Tom