Test+Recommend Tor Browser with MS EMET (Enhanced Mitigation Experience Toolkit)

The Enhanced Mitigation Experience Tookit is a Microsoft tool for further hardening selected applications against exploitation. We should test it with Tor Browser to see if it impacts functionality in any way, and if not, we should consider recommending it somewhere prominently for our Windows users.

https://support.microsoft.com/kb/2458544

added GeorgKoppen201610 TorBrowserTeam201610 component::applications/tor browser ff52-esr owner::tbb-team priority::medium severity::major status::assigned tbb-isec-report tbb-security type::project labels

Trac:
Cc: N/A to gk

Trac:
Status: new to accepted

Trac:
Cc: gk to gk, mcs

Trac:
Keywords: isec-audit deleted, tbb-isec-report added

I have been using EMET with Tor Browser (Firefox) for about a year. I haven't experienced any problem.

My current firefox (tor browser) configuration includes latest EMET 5.0 with the new EAF+ feature. The following is from the Popular Software.xml that comes with EMET. This code is applied on top of the default protection rules which is already defined in the xml files. I think to enter specific EAF+ modules, it must be imported from an xml file, because there isn't a place to enter the eaf modules on the GUI, only checkboxes.

  <Vendor Name="Mozilla">
    <Suite Name="FireFox" Arch="x86">
      <App Name="Browser" Path="*\Mozilla Firefox\firefox.exe">
        <Mitigation Name="EAF+" Enabled="true">
          <eaf_modules>mozjs.dll;xul.dll</eaf_modules>
        </Mitigation>
      </App>
      <App Name="Plugin container" Path="*\Mozilla Firefox\plugin-container.exe"/>
    </Suite>
  </Vendor>

Since I'm ok with using wildcards on EMET for most exes, this is the code from my edited xml which supports all firefox instances including (multiple and/or simultaneous) Tor Browsers.

  <Vendor Name="Mozilla">
    <Suite Name="FireFox" Arch="x86">
      <App Name="Browser" Path="*\firefox.exe">
        <Mitigation Name="EAF+" Enabled="true">
          <eaf_modules>mozjs.dll;xul.dll</eaf_modules>
        </Mitigation>
      </App>
      <App Name="Plugin container" Path="*\plugin-container.exe"/>
    </Suite>
  </Vendor>

You could recommend Path="\Browser\firefox.exe" if your goal is to specify only Tor Browser. Path="\Tor Browser\Browser\firefox.exe" wouldn't be useful because user could have changed the folder name.

I also have been using and never encountered a problem with *\tor.exe and *\Start Tor Browser.exe and *\obfsproxy.exe. I also added other pl. transports' exes but didn't try them, I guess it would work fine.

Is there anything else (eaf+ and asr modules) that could be added to above rules to further harden System Tor or Bundled Tor or Tor Browser?

Currently, ROP Simulate Execution Flow (SimExecFlow) does not work with Tor Browser 4.5.1, 4.5, and the last 4.0 release (4.0.8?). The last time it worked was in the 3.5 series if I remember correctly (and possibly one of the first 4.0 releases). Please note I am talking about releases, I have never tested any betas.

Turning SimExecFlow off for *\Tor Browser\Browser\firefox.exe fixes the problem. *\tor.exe and *\Tor Browser\Browser\plugin-container.exe work fine with it enabled. I have not tested *\Start Tor Browser.exe or *\obfsproxy.exe.

I run other versions of Firefox (64-bit nightly, 64-bit beta, 32-bit release, 32-bit release with DRM removed, portable firefox) and these work fine with SimExecFlow on. I have not tested any ESR, however.

I have also not tested running Tor Browser in safe mode.

All other mitigations work fine (be sure to add "mozjs.dll;xul.dll" without quotes to the EAF+ mitigation).

Replying to cypherpunks:

Currently, ROP Simulate Execution Flow (SimExecFlow) does not work with Tor Browser 4.5.1, 4.5, and the last 4.0 release (4.0.8?). The last time it worked was in the 3.5 series if I remember correctly (and possibly one of the first 4.0 releases). Please note I am talking about releases, I have never tested any betas.

Yes, this is #13893 (moved). Would you be willing to help us tracking down this problem? That would be really great. If so, the first question would be what is the first version that breaks? Older versions are at https://archive.torproject.org/tor-package-archive/torbrowser/. It seems we know that 4.0.1 and later are affected.

Trac:
Summary: Test+Recommend Tor Browser with Enhanced Mitigation Experience Toolkit to Test+Recommend Tor Browser with MS EMET (Enhanced Mitigation Experience Toolkit)
Severity: N/A to Major
Component: Tor bundles/installation to Tor Browser
Sponsor: N/A to N/A

I use

<EMET Version="5.5.5871.31890">
  <EMET_Apps>
    <AppConfig Path="*\Browser" Executable="firefox.exe">
      <Mitigation Name="DEP" Enabled="true" />
      <Mitigation Name="SEHOP" Enabled="true" />
      <Mitigation Name="NullPage" Enabled="true" />
      <Mitigation Name="HeapSpray" Enabled="true" />
      <Mitigation Name="EAF" Enabled="true" />
      <Mitigation Name="EAF+" Enabled="true">
        <eaf_modules>mozjs.dll;xul.dll</eaf_modules>
      </Mitigation>
      <Mitigation Name="MandatoryASLR" Enabled="true" />
      <Mitigation Name="BottomUpASLR" Enabled="true" />
      <Mitigation Name="LoadLib" Enabled="true" />
      <Mitigation Name="MemProt" Enabled="true" />
      <Mitigation Name="Caller" Enabled="true" />
      <Mitigation Name="SimExecFlow" Enabled="true" />
      <Mitigation Name="StackPivot" Enabled="true" />
      <Mitigation Name="ASR" Enabled="true">
        <asr_modules>flash*.ocx;njpi*.dll;jp2iexp.dll;vgx.dll;msxml4*.dll;wshom.ocx;scrrun.dll;vbscript.dll</asr_modules>
      </Mitigation>
    </AppConfig>
    <AppConfig Path="*\Browser" Executable="plugin-container.exe">
      <Mitigation Name="DEP" Enabled="true" />
      <Mitigation Name="SEHOP" Enabled="true" />
      <Mitigation Name="NullPage" Enabled="true" />
      <Mitigation Name="HeapSpray" Enabled="true" />
      <Mitigation Name="EAF" Enabled="true" />
      <Mitigation Name="EAF+" Enabled="true" />
      <Mitigation Name="MandatoryASLR" Enabled="true" />
      <Mitigation Name="BottomUpASLR" Enabled="true" />
      <Mitigation Name="LoadLib" Enabled="true" />
      <Mitigation Name="MemProt" Enabled="true" />
      <Mitigation Name="Caller" Enabled="true" />
      <Mitigation Name="SimExecFlow" Enabled="true" />
      <Mitigation Name="StackPivot" Enabled="true" />
      <Mitigation Name="ASR" Enabled="true">
        <asr_modules>flash*.ocx;njpi*.dll;jp2iexp.dll;vgx.dll;msxml4*.dll;wshom.ocx;scrrun.dll;vbscript.dll</asr_modules>
      </Mitigation>
    </AppConfig>
    <AppConfig Path="*\Tor" Executable="tor.exe">
      <Mitigation Name="DEP" Enabled="true" />
      <Mitigation Name="SEHOP" Enabled="true" />
      <Mitigation Name="NullPage" Enabled="true" />
      <Mitigation Name="HeapSpray" Enabled="true" />
      <Mitigation Name="EAF" Enabled="true" />
      <Mitigation Name="EAF+" Enabled="true" />
      <Mitigation Name="MandatoryASLR" Enabled="true" />
      <Mitigation Name="BottomUpASLR" Enabled="true" />
      <Mitigation Name="LoadLib" Enabled="true" />
      <Mitigation Name="MemProt" Enabled="true" />
      <Mitigation Name="Caller" Enabled="true" />
      <Mitigation Name="SimExecFlow" Enabled="true" />
      <Mitigation Name="StackPivot" Enabled="true" />
      <Mitigation Name="ASR" Enabled="false" />
    </AppConfig>
  </EMET_Apps>
</EMET>

and this doesn't work for firefox :(, but works for Tor.

I lso worrying about the fact that MS EMET is a proprietary software (though its .Net part is quite analyzable)

Trac:
Reviewer: N/A to N/A
Keywords: N/A deleted, GeorgKoppen201606, TorBrowserTeam201606 added

Trac:
Sponsor: N/A to SponsorU

Trac:
Owner: erinn to gk
Status: accepted to assigned

Moving my tickets

Trac:
Keywords: GeorgKoppen201606 deleted, GeorgKoppen201607 added

Trac:
Keywords: TorBrowserTeam201606 deleted, TorBrowserTeam201607 added

Moving items to August 2016.

Trac:
Keywords: TorBrowserTeam201607 deleted, TorBrowserTeam201608 added

Moving my tickets as well.

Trac:
Keywords: GeorgKoppen201607 deleted, GeorgKoppen201608 added

Moving my tickets

Trac:
Keywords: GeorgKoppen201608 deleted, GeorgKoppen201609 added

Tickets for September.

Trac:
Keywords: TorBrowserTeam201608 deleted, TorBrowserTeam201609 added

Trac:
Cc: gk, mcs to gk, mcs, arthuredelstein

Moving my tickets

Trac:
Keywords: GeorgKoppen201609 deleted, GeorgKoppen201610 added

Moving SponsorU items to October.

Trac:
Keywords: TorBrowserTeam201609 deleted, TorBrowserTeam201610 added

Trac:
Keywords: N/A deleted, ff52-esr added
Sponsor: SponsorU to N/A

As you see, configurations of EMET in

All other mitigations work fine (be sure to add "mozjs.dll;xul.dll" without quotes to the EAF+ mitigation). and comment:9 are different. So you need a proper one to Test+Recommend But it's not ready until ticket:18935#comment:24 gets fixed.

But it's not ready until ticket:18935#comment:24 gets fixed. M$ fixed its bug in EMET 5.52.

I have been using EMET with Tor Browser for years and my main problem is that sometimes it crashes with the "Caller" mitigation, the moment the window opens where you choose the location for saving files. It usually happens when there are many tabs open, but I'm not sure if that's related to the crash. I also use MBAE

Replying to cypherpunks:

I have been using EMET with Tor Browser for years and my main problem is that sometimes it crashes with the "Caller" mitigation, the moment the window opens where you choose the location for saving files. It usually happens when there are many tabs open, but I'm not sure if that's related to the crash. I also use MBAE What OS version? What Tor Browser version (actually, 7.0a3 is relevant now, and EMET 5.52, of course)? No other security software when testing, please (because of interference).

Windows 7 SP1 x64 and many Tor Browser versions over the years, it has been happening for a long time, I don't even know if Firefox would be different as I don't use it. I can try disabling MBAE protections for a while but I doubt it would make a difference

https://threatpost.com/us-cert-warns-of-aslr-implementation-flaw-in-windows

re-assigning

Trac:
Owner: gk to tbb-team

mentioned in issue #13893 (moved)

mentioned in issue #19274 (moved)

moved to tpo/applications/tor-browser#12820 (closed)