Addressing Security Loopholes of Third-Party Browser Plug-ins - UPDATED FEBRUARY 2017

February 2017 Update

Endpoint inspection and network access support with Chrome browser,  Firefox, and Edge Browser is now available for BIG-IP v13 .  Release notes with details are available here: https://support.f5.com/kb/en-us/products/big-ip_apm/releasenotes/related/relnote-helper-apps-13-0-0.html.

January 2017 Update

As the popularity of browser-based security attacks and vulnerabilities continue to increase, scrutiny is turning to third-party browser plugins as an attack vector. Java and Flash have both been successful targets, as have certain third-party malicious plugins. As a result, browser vendors are eager to close loopholes that allow control of page content and computer operation outside of the browser context. The longstanding F5 client technique of using browser plugins to allow VPN, application tunnel, and endpoint security checks utilize these functions. To mitigate these concerns, F5 will soon end the use of browser plug-ins. This will support the ability to run the endpoint security checks and connectivity operations such as SSL VPN and app tunnels with client PCs using new versions of popular web browsers - Google Chrome, Firefox, and Microsoft Edge Browser, in addition to Microsoft Internet Explorer and Apple Safari.

F5’s plan is to use components that will be installed by end users that run outside of the browser process, thereby eliminating the security concerns of using browser plug-ins. These client components will register a URI scheme and will be able to be called from the browser when users launch a VPN or app tunnel from BIG-IP APM web portals, endpoint security checks (firewall, antivirus, and OS patch and registry checks).  Additionally, a plug-in-less technique will be used to launch native Microsoft Remote Desktop apps or desktops on the user’s device without the traditional use of an ActiveX plugin.

This solution will not require the use of browsers’ NPAPI support. Although end users will be required to download and install components that run outside of the browser process, F5’s most important goal is to keep the user experience as close to the current browser-initiated experience on currently supported browsers as much as possible. Alternatively, the client components may be installed by Microsoft’s SCCM or other automatic software installation systems in end user populations with limited rights on PCs. With this plan, F5 will also be able to support 64-bit versions of browsers  specified above as well. 

In the meantime, you can use the below instructions to detect unsupported browsers and guide the user to a supported browser with a remediation message.

Handling new Firefox and Chrome browsers in BIG-IP APM.

Client browsers can be detected by their User-Agent header transmitted along with HTTP requests. APM automatically creates a session variable during Access Session creation that contains this value. It’s a simple matter to handle this in an appropriate way.

1. Launch the Visual Policy Editor. Access Policy => Access Profiles => (your access policy) => Edit.
   The VPE will launch in a new browser tab
2. Click the + icon to add a new Policy Item. Choose General Purpose => Empty and click Add Item.
   The new Policy Item will appear
3. Name the Policy Item appropriately. (In this example, “Browser Info” was chosen.).
4. Select the Branch Rules tab and click Add Branch Rule.
5. Name the branch rule “Firefox 43”
6. Click Advanced.
7. Insert the TCL code:
   expr { [mcget "session.user.agent"] contains "Firefox/43" }
8. Repeat the last 3 steps, this time for Firefox 44.
9. Your new Policy Item should look something like this:

10. Click Save to save the changes to the Policy Item.

      Now we need to add a user friendly error message.

11.  Near the top of the VPE screen, click Edit Endings.

12.  Click Add Ending.

13.  Name the ending “Unsupported Firefox”

14.  Click the + near Customization.

15.  Change the text to something appropriate for your users. This is a sample:

16.  Because the user should close the browser and use a different one, it doesn’t make sense to display a “Restart Session” link, so we simply hide it using the HTML <!-- and --> tags in the New session text and New session link areas.

17.  Click the Deny endings attached from Firefox 43 and 44, and change them to the new “Unsupported Firefox” endings.

18.  Review your Access Policy. The new section should appear similar to this (note that this policy is empty -- your normal policy should be attached to the “fallback” branch).

19.  Test this with Firefox 43 or 44. You should see an error page similar to this:

If you need to detect additional browsers and are not sure of the user agent, simply add a Message Box Policy Item to the beginning of the policy to log your browser’s User Agent string, like this:

When a browser activates this Policy Item, the User-Agent will be displayed.

We hope this is helpful. 

Update January 2017

Currently the latest Firefox version is release 50. Releases 50 and 51 include NPAPI plugin support that is required by F5 endpoint inspection and VPN access. Firefox release 52 will not allow the use of F5 plugin by default. This means that endpoint inspection and VPN will not function with Firefox browser for BIG-IP APM end users. F5 is planning to release BIG-IP version 13.0 that includes the new lite endpoint check and VPN clients that support a seamless end user experience with Firefox, Microsoft Edge Browser, and Chrome Browser. Based on current release schedules from F5 and Mozilla, the BIG-IP v13.0 release may not be available before Firefox 52 is released. If your end users require endpoint inspection or VPN launch capability with Firefox browser, we recommend installing Firefox ESR. This version will include plugin capability until early 2018.

*Firefox 52 Note: The configuration parameter is called plugin.load_flash_only, and it should be set to false. After this configuration parameter is created and set, the user needs to quit Firefox and delete pluginreg.dat file under profiles folder.  Please see https://bugzilla.mozilla.org/show_bug.cgi?id=1269807 for more details.

Note that this is preliminary information about a non-F5 product and is subject to change.

Refer to the information about Firefox ESR:
https://www.mozilla.org/en-US/firefox/organizations/

Information from Mozilla on future NPAPI support:
https://blog.mozilla.org/futurereleases/