Project “Foxhound” – Hunting Cross-Site Scripting on the Web

"The Open Source Way". This is our podcast series, SAP's podcast series, about the difference that open source can be. And in each episode, we'll talk with experts about open source and why they do it the open-source way. I'm your host, Karsten Hohage, and in this episode, I'm going to talk to Thomas Barber about "Foxhound". Hi Thomas, nice to have you here.

Karsten. Yeah, it's great to be here. Thanks for having me.

let's see who we have here. Thomas Barber is a security research expert since 2019 who specializes in web security. His background is pretty impressive. He's got a PhD in Particle Physics, and among other places that involved a time at the CERN, the C, E, R, N. So, for us computer people, where one could say, the web was born in 1992, where they discovered, or still trying to discover the Higgs Boson.

yeah.

That's it. Okay, probably looking for some other interesting god particles, there still, right? And his professional interest is in software and automotive and in security. And his first programming experiences, Thomas says, was with computer games in BASIC. Thomas, how does one get from computer games in BASIC to particle physics?

actually, there's quite a lot of computing involved at CERN, and in particle physics. So, a lot of my research in my PhD wasn't just sitting down and thinking about new particles. It was a lot of coding and programming . Either to write code to drive the detector, and to read out all of this data from the detector . Or to analyze the data that we got trying to put it together and trying to understand it. So, there is a lot of coding involved there.

is there any similarity in, I don't know, trying to catch the particle while it's trying to escape reality again within a fraction of a second, that I can't express a number of zeros probably, and trying to catch the intruder or something in the security space?

the worlds are kind of a bit far apart but the methodology, like the scientific techniques that you use, are in principle the same, right. So, setting up an experiment you have a hypothesis, you create your experiment to test that hypothesis, go and do your experiments, and analyze the data, and present the data in a way that other people can understand

great. Before you ask me how I came from geology to working for SAP, let's maybe get to the specific subject of the day better.

what is "Foxhound"? Maybe the function or, I don't know, purpose or what is it?

so, project "Foxhound" is, it's a fork of the Firefox browser. So, Firefox I think everyone knows. And what we've done with it is we've instrumented it, so we've modified it in certain ways to enable you to use it to detect security vulnerabilities in websites. And the vulnerability in particular that we're looking at is called cross-site scripting

just learned is, that in the phishing email, I shouldn't only check if the main domain the link goes to is legitimate but also what comes after, right?

exactly. So, that would be the piece where you can put this.

"Foxhound" is a branch of Firefox that is specialized to seek out such vulnerabilities. How is it distributed? Is that source or is it binaries?

at the moment we are just distributing the source code. So, one of the challenges we had, even at the source code stage, was because Firefox is a web browser it contains actually implementations of cryptographic functionality. So, like its own implementations to do encryption and decryption which your browser uses, for example, with https to make a secure connection to a server .

you probably then couldn't do that open source anymore. When you're distributing the source code, it's probably easier to exclude the cryptographic part, right?

cryptographic part is still in there, but I think there's some additional restrictions. It would be something nice to do, maybe something for the future to look at.

maybe not dwell on that for too long, because we don't have export control mechanisms in the open-source world as our main topic here, although that is interesting, of course. How did "Foxhound" come to life as an open-source project anyway?

the line of research that we've been doing to detect the dangerous data flows, which can lead to cross-site scripting, for example . That line of research actually has a long history in the research group, SAP Security Research group. And it was sort of pioneered as a technique by, actually by my predecessor, by Martin Johns. And his study did use this technology.

actually not all too surprised by the 10%. After somebody told me how some password mechanisms, even for websites that supposedly have a login, how easily some of these are tricked by some simple sending them an equals true statement, kind of thing, with a too easy password programming there. Anyway, how about "Foxhound"? Was that open source from the start, or did it start as some closed project?

said it was starting off as an internal research tool, if you like.

kind of, when I started in the role, I kind of saw we'd been developing this code, and we wanted to collaborate together with the university to carry on the research, and decided then there's a lot of, kind of, overhead in order to set up this research collaboration. We went through all of the process to do that, but in the end decided it would be a lot easier if we could just point them to the code and say: 'Look, here's the code that we've been working on.

you just said it's a cooperation with universities, I would have had to ask you, how does that collaboration work? Now, I don't have to ask you because it's simply an open-source project and you just simply need to point them to it, and then they can work with it, right?

exactly. Yeah so, we've got like a number of different ways where we can collaborate with universities in a sort of a more formal framework . But we notice it makes it a lot easier to just point them towards the repository, and to try it out.

guess the age that you encounter at universities, at least when we talk about students, is probably more fascinated by open-source projects than by setting up a 25 page collaboration contract with someone like SAP, or Microsoft, or whoever, right?

Yeah, definitely.

see.

just for the students.

the older people as well.

in the end, it was that ease of collaboration that made the open-source decision, or anything else?

that was the main driver, definitely . Because it's a bit to do with the unique position of the SAP Security Research Group that we're doing this industrial research, we want to collaborate with academia, so we're sort of bridging this gap between industrial, like academic research and SAP products, if you like. So, we're kind of a foot in both worlds and kind of, yeah I guess, bridging that gap, and with this open-source project was one of the main motivators.

one can relate to that, particularly when one comes from particle physics, because any results that are being published from that world are, of course, in need of heavy confirmation by others, who will look at all the numbers and all the number crunching that has been done to derive at the results, right? Anyway, that is your perspective now on the collaboration. Unfortunately, for time reasons, we couldn't have anyone from the university with us today.

I actually talked to one of the PhD students at the University of Braunschweig. So, this is one of the universities we do a lot of collaboration with, and he gave a couple of pointers. And like I touched on this whole making a project open source, it kind of gives more weight to the project. If you kind of make it open source it means: Okay, you're kind of showing everyone, showing the world, this is what we used, go ahead and try it out yourself. It sort of gives more weight to the results.

the non-disclosure agreement.

Exactly, yeah.

you don't follow through on the non-disclosure, we're going to sue you for everything you have.

that might put you off as a master's student, right?

so, is that the only issue, basically? Did that solve it all? Or were there any other challenges to make the project fly?

there were a lot of challenges. So, like the biggest one was the fact that Firefox, which we're based on, is such a huge project. I mean, it's a massive code base. I think it's probably like rivals, I don't know, the Linux kernel is one of the biggest like open-source projects. And I kind of checked just before the recording and there's something like 10 million lines of code in the Firefox codebase . And the release branch, you can go and look at it on GitHub, has over 900,000 commits.

we could even point back to a couple of other episodes in this podcast series where we talked about different licenses, and even for license type scanners and so on. I didn't prepare well enough, otherwise I could tell you when these were broadcast. I don't know offhand, but I know we talked about this subject. Let's get back to "Foxhound", though. The community, is that pretty lively? Or is that a niche project? How much traffic do you see?

we're slowly trying to build a community. I mean the tool, like I mentioned, it's not the easiest one maybe to get started with. So, we've got something like 50 stars on GitHub and over ten forks. It's mostly research collaborations, like I said . But it has allowed us to start off those collaborations. So, apart from the original project with University of Braunschweig, we've also had contact with other universities and student projects with, for example, Karlsruher Institute of Technology.

as?

there's other things like, it's called cross-site request forgery. So, it's similar but you don't execute code in the user's browser but you kind of you trick their browser into performing actions for you. So, you can for example, I don't know, you can force the user's browser to delete records in a database or perform actions on behalf of an attacker.

And as the question actually was, the community how lively it is and so on. Do you have any big players active in it? Or is it a couple of people, well SAP of course is a big player, sorry. Any other big players, but SAP, active in the community?

did have, actually, a pull request a few weeks ago from an email address, at least, from someone from Google. It was quite a small change, like correcting some typos somewhere, but at least it shows that there's people aware of the project and looking into it. So, maybe it's kind of stoking interest in other places.

the competition ? Because it's a Firefox branch and they're protecting their Chrome, of course.

Possibly.

. Anyway, how about uses ? In like, beyond the research collaboration of developing it.

there's a couple of places like within SAP where we're looking at trying to deploy it and turn it a bit more from a simple research tool into more of a security testing, not product, but kind of an open-source tool for security testing. And we actually had the security validation team at SAP who do penetration testing, security testing, on products before they're shipped. They actually found an example of this cross-site scripting bug, which commercial tools were not able to

actually one of the benchmarks, right? I mean, there's tons of tools around that will find, I don't know, 80%, 90%, 95. And your tool is good as soon as it finds something the others don't, right?

yeah. Yeah so, this would be really nice.

necessarily find everything that the others find, but your tool is worth its while as soon as it finds something that nobody else has found, I guess.

yeah.

beyond within SAP, that you were just talking about, are there any outside SAP integrations, use cases or collaborations, beyond the universities, whatever?

one of the things we're trying to do is integrate what we've been doing in project "Foxhound" with another tool called "Playwright". It's an open-source tool from Microsoft, and it enables you to automate browser actions. So, instead of opening a browser by hand and putting in a URL and clicking around, you can actually like script this, with a piece of JavaScript, to perform those actions for you.

here's a Microsoft project that is interested. And actually, follow up to that of course always is: Would that be specifically needing "Foxhound" ? Or could they also do this with Firefox as it is in the main branch?

we actually do is, the patches that are provided are already for Firefox. So, Microsoft they'll make some small changes to the browser to enable their automation framework to run. And we take those patches and then apply them to " Foxhound". So, that's how we're doing that integration.

apart from the "Playwright" thing, are there more projects like it on the horizon?

so, one of the things we're looking at is expanding beyond just using "Foxhound" for security, but also use it to detect like privacy issues with websites. So, there are some websites, if you visit them, they collect different attributes about, like from your browser. So, this could be things just like the screen height, the screen width, information about which browser version you're using.

that sounds like one of the things that could even, sometimes be of even more interest . At least from this particular German perspective, where we are very worried about our data privacy and data protection, sometimes seems more than the rest of the world.

yeah. It's definitely, with GDPR that's very relevant to that.

this being a project that lives off contributions, of course. Are there any wishes, who should still join? Or contributions you're like waiting for.

there's always a big to-do list with all of these projects. One thing that I've wanted to do for a long time is, to actually get support for more operating systems. So, we've got builds for Linux, I think the Windows build should still be working. It would be really nice to have someone to do the build for a Mac as well . So, to run on as many platforms as possible. And there's also some technical things, like we're trying to push for more stability, to integrate with some other testing tools

That's the main thing? Or anything else?

there's a few other things. So, we'd also like to expand like the, a bit the accuracy. So, we're currently just instrumenting these string data types in the browser. So, they're the ones which are most relevant for security. And it would be interesting to expand it to other data types, so like JavaScript objects or to numbers. This would be something which would be useful to do.

let me do the commercial break part. You've heard Thomas Barber what is needed in the "Foxhound" project. So, if you have good C++ code experience, and if you are willing to work in a complex and sometimes frustrating, yet very rewarding project, and if you think the web is part of our everyday life, and you want to understand better how browsers work; join "Foxhound". Was that about the way I should have said it?

couldn't have put it better myself.

didn't plan this. I just figured that we do this as a commercial break before we come to the famous before last question . If someone has felt addressed by what you and I just said right before, where should they go to find information? Of course, you always have the GitHub repo. Is there anything beyond that?

the GitHub repository is the main place to contribute. So, it's under the SAP organization and then it's project minus "Foxhound". So yeah, to kind of raise awareness, if you want to, have a, try it out; you can leave a star with us on GitHub. Try checking out the code, building it and running it. I'd say if you get that far then you're kind of already enthusiastic enough to contribute. Have a look at the to-do's, the open issues, there's a list there of things

it's mainly on GitHub. There is no accompanying YouTube channel yet or anything like that, right?

not yet. Maybe as a follow-up to this, I'll start doing some YouTube.

last question: What are the, some people call it, key takeaways. What are the three to four main things, in very short, that you want everyone to remember from this episode?

the biggest thing is, I think for me, to, that may maybe a bit cheesy, but to thank the open-source team at SAP. So, this was a big project . You could see like whenever I had calls with them that you'd open the video and then they'd kind of realize what we were talking about and that it was such a big project, and their faces would all kind of drop. So a big, big thank you for them. In the end, this open-source process really worked, even with such a complex product.

Thank you very much, Thomas. Thanks for being our guest today. It was nice to have you here.

thank you very much for having me, Karsten.

thanks everyone out there who listened to "The Open Source Way". If you enjoyed this episode, please share it and don't miss the next one. We usually publish every last Wednesday of the month, and you'll find us on openSAP and in all those places where you find your other podcasts . Either the mainstream apps that you know, or some of the, themselves, open-source podcast apps. Thanks again and bye bye.