Opened 15 months ago

Closed 14 months ago

Last modified 10 months ago

#27013 closed defect (fixed)

TBA: Audit thirdparty selfbraille

Reported by: sysrqb Owned by: tbb-team
Priority: Very High Milestone:
Component: Applications/Tor Browser Version:
Severity: Normal Keywords: tbb-mobile, tbb-proxy-bypass, TorBrowserTeam201808R
Cc: gk, igt0 Actual Points:
Parent ID: #25851 Points:
Reviewer: Sponsor: Sponsor8

Description

Proxy-safe?

$ ls mobile/android/thirdparty/com/googlecode/eyesfree/braille/selfbraille/
ISelfBrailleService.java  SelfBrailleClient.java  WriteData.java

Child Tickets

Change History (4)

comment:1 Changed 15 months ago by sysrqb

Status: newneeds_review

This library creates a Binder IPC with the BrailleBack app (com.googlecode.eyesfree.brailleback). It verifies the SHA-1 hash of the signing key of the app before creating a background service for communicating with it.

This library is probably proxy-safe, but the browser and Android OS (via AccessibilityManager [0]) could send arbitrary data over this IPC so BrailleBack could bypass the Tor Browser proxy. Currently, I don't see this happening. I believe Accessibility events are only sent when focus is changed in the app, so I don't see a proxy-bypass right now.

Any opinions here? Close?

[0] https://developer.android.com/reference/android/view/accessibility/AccessibilityManager

comment:2 Changed 14 months ago by gk

Keywords: TorBrowserTeam201808R added

comment:3 Changed 14 months ago by gk

Resolution: fixed
Status: needs_reviewclosed

I think that's okay for now.

comment:4 Changed 10 months ago by gk

Sponsor: Sponsor8

Sponsor8 in August 2018.

Note: See TracTickets for help on using tickets.