[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[tor-bugs] Re: [Tor Bug Tracker] #1115: jqnotify.exe starting with tbb-firefox.exe
#1115: jqnotify.exe starting with tbb-firefox.exe
-------------------------------------------+--------------------------------
Reporter: Sandy | Owner: phobos
Type: defect | Status: closed
Priority: minor | Milestone:
Component: Tor-Tor bundles/installation | Version: 0.2.1.19
Resolution: fixed | Keywords:
-------------------------------------------+--------------------------------
Changes (by phobos):
* status: assigned => closed
* resolution: None => fixed
Old description:
> Java Quick Starter...
>
> When Tor Browser Bundle starts and tbb-firefox.exe loads, tbb-firefox.exe
> scans the host registry for installed Add-Ons
> at the following locations[1]:
>
> HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions\
>
> HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions\
>
> If Java Plantform is installed on the host system it writes a registry
> value to one, or both, of those of those keys.
> The registry value is the plugin "Java Quick Starter", and the value is
> named "jq@xxxxxxx". The hard path to the file
> is "C:\Program Files\Java\jre6\lib\deploy\jqs\ff".
>
> Those two registry keys have been vectors for malware attacks to firefox
> via. add-ons in the past[1]...
>
> Using the Sysinternals application "Process Explorer" one can watch in
> real-time as the file "jqnotify.exe" is called by
> tbb-firefox.exe. One needs to pay attention, because it loads and then
> closes in a second or two. I apply this setting
> in Process Explorer "View > Show New Process" so each new process called
> gets a highlighted color, makes seeing the files
> sudden appearance easier. I am unsure how far back this has been a
> problem with Java Platform, version wise. But it's
> been a problem for while at least.
>
> When I start TBB in a sandbox I used to get errors about "jsnotify.exe"
> trying to access the "internet". Well, if I
> am correct, and I could be wrong, jsnotify.exe doesn't connect to the
> internet, but does try to access the pipe
> "\Device\Afd\Endpoint". That is when it hits the sandbox walls facing
> the internet.
>
> To fix this I just prevent any application within the sandbox from
> reading those two keys. Maybe someone can hack the
> firefoxportable which ships with TBB so it won't read those two keys?
> That seems like a good solution, though I have
> no idea if it's 'hard' to accomplish or not.
>
> From what Phobos said last night, TBB currently disables the "Java Quick
> Starter" Add-On in firefoxportable. But,
> uninstalling the Add-On is not possible, it's always grayed out. That is
> a trick by Java Platform to prevent the
> removal of their Add-On. If a user wants to remove the Add-On from their
> registry all they do is delete the value
> "js@xxxxxxx" and then configure the Java GUI to not load Java Quick
> Starter. OTOH, simply deleting the registry
> value "js@xxxxxxx" might be enough, I'll try to see if I can get Java to
> reinstall the Add-On into my registry and play
> with it a bit more.
>
> Here are some relevant threads from Mozilla and other pieces of
> background info, etc:
>
> http://support.mozilla.com/tiki-
> view_forum_thread.php?locale=lt&comments_parentId=362460&forumId=1
>
> http://forums.mozillazine.org/viewtopic.php?f=38&t=921325&sid=515e4e29b64ba8c12e52c5ce15504d40
>
> Good forum post with registry info on removing the Java Add-on:
> http://forums.mozillazine.org/viewtopic.php?p=4837715#p4837715
>
> [1] http://kb.mozillazine.org/Uninstalling_add-
> ons#Windows_Registry_extension
>
> Contact me at IRC if you need more info. I should be around the next few
> days at least.
>
> [Automatically added by flyspray2trac: Operating System: Windows 2k/XP]
New description:
Java Quick Starter...
When Tor Browser Bundle starts and tbb-firefox.exe loads, tbb-firefox.exe
scans the host registry for installed Add-Ons
at the following locations[1]:
HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions\
HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions\
If Java Plantform is installed on the host system it writes a registry
value to one, or both, of those of those keys.
The registry value is the plugin "Java Quick Starter", and the value is
named "jq@xxxxxxx". The hard path to the file
is "C:\Program Files\Java\jre6\lib\deploy\jqs\ff".
Those two registry keys have been vectors for malware attacks to firefox
via. add-ons in the past[1]...
Using the Sysinternals application "Process Explorer" one can watch in
real-time as the file "jqnotify.exe" is called by
tbb-firefox.exe. One needs to pay attention, because it loads and then
closes in a second or two. I apply this setting
in Process Explorer "View > Show New Process" so each new process called
gets a highlighted color, makes seeing the files
sudden appearance easier. I am unsure how far back this has been a
problem with Java Platform, version wise. But it's
been a problem for while at least.
When I start TBB in a sandbox I used to get errors about "jsnotify.exe"
trying to access the "internet". Well, if I
am correct, and I could be wrong, jsnotify.exe doesn't connect to the
internet, but does try to access the pipe
"\Device\Afd\Endpoint". That is when it hits the sandbox walls facing the
internet.
To fix this I just prevent any application within the sandbox from reading
those two keys. Maybe someone can hack the
firefoxportable which ships with TBB so it won't read those two keys?
That seems like a good solution, though I have
no idea if it's 'hard' to accomplish or not.
From what Phobos said last night, TBB currently disables the "Java Quick
Starter" Add-On in firefoxportable. But,
uninstalling the Add-On is not possible, it's always grayed out. That is
a trick by Java Platform to prevent the
removal of their Add-On. If a user wants to remove the Add-On from their
registry all they do is delete the value
"js@xxxxxxx" and then configure the Java GUI to not load Java Quick
Starter. OTOH, simply deleting the registry
value "js@xxxxxxx" might be enough, I'll try to see if I can get Java to
reinstall the Add-On into my registry and play
with it a bit more.
Here are some relevant threads from Mozilla and other pieces of background
info, etc:
http://support.mozilla.com/tiki-
view_forum_thread.php?locale=lt&comments_parentId=362460&forumId=1
http://forums.mozillazine.org/viewtopic.php?f=38&t=921325&sid=515e4e29b64ba8c12e52c5ce15504d40
Good forum post with registry info on removing the Java Add-on:
http://forums.mozillazine.org/viewtopic.php?p=4837715#p4837715
[1] http://kb.mozillazine.org/Uninstalling_add-
ons#Windows_Registry_extension
Contact me at IRC if you need more info. I should be around the next few
days at least.
[Automatically added by flyspray2trac: Operating System: Windows 2k/XP]
--
Comment:
this hasn't happen since 1.2.x. in fact i could never recreate the
problem. closing.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/1115#comment:3>
Tor Bug Tracker <https://trac.torproject.org/>
The Tor Project: anonymity online