Playing in the Sandbox

Improve Security and Privacy with Userspace Compartmentation

Toby Betts

SeaGL, 2019-11-16

Disclaimer

Difficulty Level

Technical:

2/5 multitools: you should be comfortable administering your own box, chmod should not scare you

Difficulty Level

Paranoia:

3/5 tin foil cats: some Big Brother conspiracy paranoia, negligible Illuminati mentions

https://twitter.com/OphirHarpaz/status/1083701070126301184
https://twitter.com/jeanqasaur/status/1082367319957880832
https://twitter.com/k8em0/status/1083242702865498112
https://twitter.com/briankrebs/status/1094081981103583234

Problem Statement

We need a way to:

We need a way to:

We need a way to:

Goals

In other words we want this:

Not this:

Outside of Scope:

Incognito Mode

It's the last word in online safety! ...Right?

Incognito Mode

https://www.fastcompany.com/90311396/incognito-mode-wont-keep-you-private-try-browser-compartmentalization

Incognito Mode

https://www.fastcompany.com/90311396/incognito-mode-wont-keep-you-private-try-browser-compartmentalization
https://medium.com/@thegrugq/operational-security-and-the-real-world-3c07e7eeb2e8

@thegrugq says:

This means:

Compartmentation is Key

Use a Password Manager

https://www.forbes.com/sites/kateoflahertyuk/2019/02/20/password-managers-have-a-security-flaw-heres-how-to-avoid-it/

Use a Password Manager

Lots of good choices, some support 2FA / extensibility plugins

Gmail Address Extensions

Allows one Gmail account to accept messages for multiple unique addresses

name@gmail.com can expand to:

Feature added to Postfix v2.11 in 2014

https://gizmodo.com/how-to-use-the-infinite-number-of-email-addresses-gmail-1609458192

Securing the Browser

Q: How do you secure software you didn't write?

Securing the Browser

Q: How do you secure software you didn't write?
A: The same way you secure everything else.

Securing the Browser Container

Containers:

Securing the Container, TL;DR Version

Linux containers make extensive use of two related technologies:

TL;DR: Namespaces give a process a private view of the environment and dictate what the process sees on its host machine, cgroups restrict what that process can do within that environment

Securing the Container, TL;DR Version

Namespace: "Our hotel only has a lobby, an elevator, and the 6th floor."

cgroups: "You can only use the elevator between 8 AM and 11 PM and you can't order room service."

Losing Privileges

seccomp(2) and pledge(2) are two methods developers can use to restrict what a process can do by explicitly defining what resources they expect to use and requesting that the kernel deny it access to everything else.

If a process requests something it has already pledged to not want/need/already have, it is killed.

Securing the Browser System Calls

A developer has a number of process-restricting tools available:

All of these help isolate program resources in some way... but I'm not a developer!

Virtual Machines

VMs define clear security boundaries, but with high overhead. What if I just want to read Slashdot and HN at the same time?

firejail

User-configurable Linux utility - https://firejail.wordpress.com

https://firejail.wordpress.com/

firejail (Example 1)

Create a new namespace for a program and disable network access for it:

firejail --net=none /path/to/program

The only network program will see is its own dedicated lo0

firejail (Incognito Mode *= 10)

Run Firefox in a completely new temporary directory:

firejail --private /usr/bin/firefox

This is incognito/private browsing mode on steroids.

firejail (Source Code)

Repository is on Github: https://github.com/netblue30/firejail

Securing the Browser, DragonFly BSD-style

Matthew Dillon, DragonFly BSD founder, had had enough.

No, not this Matt Dillon.
https://marc.info/?l=dragonfly-users&m=143931438715045&w=2

Securing the Browser, DragonFly BSD-style

Matthew Dillon, DragonFly BSD founder, had had enough.

https://marc.info/?l=dragonfly-users&m=143931438715045&w=2

Matthew Dillon says:

"What I have done is segregate my browser use into user accounts separate from my main account. I created three accounts (one for my 'secure' firefox use, such as accessing bank account, one for general 'unsecure' browsing, including most of my social media browsing, and one for my chrome instance which I use for other things."
—Matthew Dillon

Matthew Dillon says:

"What I have done is segregate my browser use into user accounts separate from my main account. I created three accounts (one for my 'secure' firefox use, such as accessing bank account, one for general 'unsecure' browsing, including most of my social media browsing, and one for my chrome instance which I use for other things."
—Matthew Dillon

First make sure your main account(s) are fully protected. For example:

chmod 700 /home/yourmainaccount

Matthew Dillon says:

Create three new accounts (I used UIDs 30000, 30001, and 30002 and called them dfw1, dfw2, and dfw3). For each one of dfw1, dfw2, and dfw3 (using dfw1 as an example), set it up so you can ssh into it from your main account.

mkdir /home/dfw1
mkdir /home/dfw1/.ssh
cp ~/.ssh/id_rsa.pub \
  /home/dfw1/.ssh/authorized_keys
chown -R dfw1 /home/dfw1

Matthew Dillon says:

Then from your main account, do a
ssh dfw1@localhost -n ls -la
to test that you've set it up and it works. I'm assuming you are also:

Now you can create scripts that run firefox and/or chrome in these accounts, separate from your main account.

Matthew Dillon says:



#!/bin/csh
# script for ~/bin/firefox (assumes ~/bin is in your path)
scp ~/.Xauthority dfw1@localhost:
ssh dfw1@localhost -n "setenv DISPLAY :0.0; firefox"

You can then tie these scripts into your GUI as buttons or whatever. You can have a script for each compartment. I have a script for 'Sfirefox' (my 'secure' firefox), 'Ufirefox', and 'chrome'.

Thanks Matt!

Securing the Browser, DragonFly BSD-style



ssh-keygen -t ed25519 -N '' -q -f ~/.ssh/firefox
sudo groupadd firefox
sudo useradd --system --gid firefox --create-home \
  --shell /bin/false --home-dir /home/firefox firefox
sudo mkdir ~firefox/.ssh
sudo mv ~/.ssh/firefox.pub \
  ~firefox/.ssh/authorized_keys
sudo chmod 0700 ~firefox/.ssh
sudo chmod 0600 ~firefox/.ssh/authorized_keys

Run ~/bin/firefox.sh



#!/bin/sh
USER=firefox
KEY=~/.ssh/${USER}
IP=127.0.0.1

scp -i ${KEY} -q ~/.Xauthority ${USER}@${IP}:
ssh -i ${KEY} -l ${USER} ${IP} -X -n "DISPLAY=:0.0 \
  dbus-launch --exit-with-session
  /usr/bin/firejail \
    --private-home=.mozilla \
    --profile=/etc/firejail/firefox.profile \
    /usr/bin/firefox"

But What About Windows?
  • Windows Sandbox
  • Found in Windows 10 Pro/Enterprise build 18305 and up (1903 & newer)
  • Creates lightweight OS instance using Hyper-V "hybrid" virtualization
  • Not a full VM: reuses hardware, core system files
https://techcommunity.microsoft.com/t5/Windows-Kernel-Internals/Windows-Sandbox/ba-p/301849

But What About Windows?

But What About Windows?

Sandboxie - https://www.sandboxie.com

https://community.sophos.com/products/sandboxie/f/forum/115109/major-sandboxie-news-sandboxie-is-now-a-free-tool-with-plans-to-transition-it-to-an-open-source-tool

App Sandboxing...to the EXTREME!!eleven!

Qubes OS - https://www.qubes-os.org

https://www.qubes-os.org

Qubes OS

Compartmentation Beyond Software

Buying things online is risky. Anonymizing money and financial transactions is hard.

https://creditliftoff.com/experian-data-breach-settlement-com/
https://www.consumer.ftc.gov/blog/2017/09/equifax-data-breach-what-do

Don't Use Bitcoin?

Don't Use Bitcoin!

Use Gift Cards, Not Debit Cards

In Conclusion

Slides available online

https://su.bze.ro/talks.html