Security/Reviews/B2GAppUpdates

   

     Full Query    

1 Total; 0 Open (0%); 1 Resolved (100%); 0 Verified (0%);

• Property "SecReview feature goal" (as page type) with input value "Process-
  • Content decides when to update
  • check is manifest has changed (hash check and manifest etag)
    • bug 829934
  • app updates checked during system update check / app can trigger update / marketplace app can trigger update
  • Notification is only shown for Hosted apps with appcache, or Packaged apps
  • Marketplace has funcitonality to serve update saying an app is blocklisted. User needs to accept update
  • app-validator for reviews
    • https://github.com/mattbasta/app-validator
  • marketplace app review process
    • https://developer.mozilla.org/en-US/docs/Apps/Marketplace_review_criteria

  Hosted App

  • (manifest hosted on the applications server)
  • manifest just gets downloaded and update gets applied (ie update the webapps registry)

  HostedApp with appcache

  • (manifest hosted on the applications server)

  Packaged App

  • (manifest hosted on the marketplace server)

  https://wiki.mozilla.org/Reviews/B2G/AppUpdates gaia.system.checkForUpdates Open Question: Is there no time-based check for app updates? If not why not?

  • Where are the manifest hosted - anywhere for hosted, packaged at marketplace
  • Can you apply signed app udpates to another app (or what stops this)
  1. . A file (sigFilename) containing the RSA certificate data
  2. . The signature digest (sfFileName), verified by #1
  3. . A manifest file containing all the files that must be "signed" and their digests (mfFilename)

  [1] - Loading the RSA certificate data http://mxr.mozilla.org/mozilla-cent ral/source/security/manager/ssl/src/JARSignatureVerification.cpp#558 [2] - Verify signature of SF file http://mxr.mozilla.org/mozilla-central/source/security/manager/ssl/src/JARSignatureVerification.cpp#588 [3] - Verify digest of manifest file http://mxr.mozilla.org/mozilla-central/source/security/manager/ssl/src/JARSignatureVerification.cpp#616 [4] - Verify that digest of each file specified by manifest file is correct http://mxr.mozilla.org/mozilla-central/source/security/manager/ssl/src/JARSignatureVerification.cpp#628

  http://mxr.mozilla.org/mozilla-central/source/security/manager/ssl/src/JARSignatureVerification.cpp#443" contains invalid characters or is incomplete and therefore can cause unexpected results during a query or annotation process.
• Property "SecReview threats considered" (as page type) with input value "*App isn't updated in a timely manner
  • • what could cause the initial update check to fail?
      • What about if the update manifest is accidentally included in an appcache?
        • imho it can't
      • Other possible DoS scenarios? Version number corruption?
        • we don't care about the actual version, this is only used to change the webapp manifest
  • • Check to make sure people dont appcache their update manifest (appstore-side)
    • Relying on the app to update itself, need to check update cadence in review process
  • Unsigned update gets applied?
    • app updates are signed for packaged apps. Hosted apps are not installed, and are at risk, but same model as the web. (i.e. use SSL to protect content integrity)
    • if I am not wrong, app updates are not necessarily signed, but they can be
  • Wrong app gets updated?
    • Currently a compromised process could spoof the input parameter to checkForUpdate, so an app could trigger an update for another app. But the update code retrieves the app to update based on the manifest, and so while a compromised process could trigger updates for other apps, it can't provide any malicious parameters to that update. See bug 820206 for more info on attacks related to spoofing webapps:* system messages. But I dont think there is an issue here.
  • Partial update makes app unusable
    • Can an app be half updated? (appcache yes? packaged no?)
    • Power loss while copying app files across ?
  • • Check when delete old app happens?
  • App update is incompatible with the underlying gecko version?
    • how do we address this? (not really a security issue though)
    • probably ignore this, it same problem as person no applying system updates
  • Signed update gets applied to the wrong app?
    • Can this happen? Are signatures per domain/manifest/what? IE could one signed appupdate be somehow applied over another app somehow?
  • An old update get applied (perhaps introducing a security vulnerability)
  • download the update, but dont apply it?" contains invalid characters or is incomplete and therefore can cause unexpected results during a query or annotation process.