=======================================================================Vulnerability Affecting FireGPG Passphrase and Cleartext Recovery
10/20/2008

Abstract

FireGPG is a Firefox extension that provides a front-end to GPG,
allowing webmail users to conveniently exchange GPG messages from
Firefox.

Unfortunately, the way that FireGPG handles the user's passphrase and
decrypted cleartext is not secure and may result in the compromise of
secure communication or a users's private key.

=======================================================================Description

FireGPG does its encrypt/decrypt/sign/verify operations by shelling out
to a locally installed GPG executable.  The problem is that instead of
using stdin/stdout to pass information, it writes everything to disk
and passes the files as arguments.

When a user receives an encrypted email and asks FireGPG to decrypt it,
FireGPG prompts the user for her passphrase and then creates three
temporary files.  One for the ciphertext, one for the resulting
cleartext (!), and one for the user's passphrase (!).  The user's
passphrase is then written to disk, and the temporary file in which it
resides is passed to the gpg executable as a command-line argument. The
cleartext from the decrypt operation is then written to disk as well,
from where it is subsequently read and displayed to the user.  The same
process occurs for emails that are being encrypted and signed.  Notably,
in the latter cases the pre-encrypted cleartext is written to disk, as
is the passphrase for the signing key.

Obviously, there are a number of attack vectors here.  If an adversary
were to seize the user's disk, they would easily be able to recover the
passphrase used in previous FireGPG operations. In that case, all past
correspondence secured by that key would be compromised.  Even if the
user had just changed their passphrase and hadn't used FireGPG since
then, the adversary would be still be able to recover copies of
decrypted and pre-encrypted cleartext emails that touched the disk.

Additionally, as another vector of attack, the temporary files that
FireGPG creates for storing this information are constructed with
predictable filenames.  It is possible for someone with an account on
the same machine to exploit the race condition that results at the time
these files are created, such that the output from a decrypt operation
is written to a symlink which points to a file that they own -- thus
eliminating the need for data recovery.  There is a working exploit for
this.

=======================================================================Severity

Users who are serious about securing their data and communication
against a threat model that includes others gaining access to their
machines (either through hardware seizure or multiple user accounts)
should change their passphrases and scrub their disks.

========================================================================Affected Versions

All versions of FireGPG previous to 0.6 are vulnerable.  Version 0.6 was
released on 10/17/2008 in response to this issue.

- moxie

-- 
Thoughtcrime: http://www.thoughtcrime.org 
Audio Anarchy: http://www.audioanarchy.org 
Anarchist Yacht Clubb: http://www.blueanarchy.org