ELECTRON-BASED APPLICATIONS
Doyensec has been involved with Electron security since the beginning of 2017. We were the first company to publish a comprehensive and detailed analysis of the Electron framework from a security point of view.
Since then, we have continued to focus on Electron and remain very familiar with the codebase and the continually evolving set of weaknesses and pitfalls faced by developers.
ElectronJS on Windows, Linux, and macOS
Doyensec is uniquely situated to perform detailed security audits of Electron-based applications. The results of our work was presented at many top-tier security conferences, including BlackHat USA 2017, OWASP AppSec 2018, BlackHat ASIA 2019 and many private events.
We have discovered and reported vulnerabilities in core Electron and in many applications built using this framework. During our testing, we will find design weaknesses and implementation bugs that can be leveraged to compromise Desktop applications built using web technologies.
We're the author of Electronegativity, a popular OSS solution for automated Electron security. Given the difficulty of keeping up with the constantly changing security posture of the framework that powers Desktop applications, we also created ElectroNG (discontinued). ElectroNG's dynamic contextual scanning technology allows it to automatically adapt to the target application's configuration, resulting in rapid vulnerability detection with amazing accuracy.
Information Gathering and Reconnaissance
- Enumeration of BrowserWindow, BrowserView and Webview Tags
- WebPreferences
- Analysis of Native Code in Use
- Review of All Dependencies and Add-ons in Use
Content Security and Process Isolation
- NodeIntegration and Sandbox bypasses
- Flaws in Preload Scripts Insecure Affinity Property Usage
- Pop-ups in WebViews
- Loading Untrusted Origins
- Context Isolation for Preload Scripts
- Content Security Policy
- Use of Dangerous Functions and APIs
- Usage of openExternal and Similar Weaknesses in Custom Protocol Handlers
Framework Security
- Application of Security Patches
- Experimental Features
- Command Line Arguments
- Outdated Components and Dependencies with Known Vulnerabilities
- Privacy and Secure UX Flaws (e.g., Information Disclosure via Notifications)
- Deviations from Browser Security Standards (e.g., SOP)
- Insecure Data Storage
Cryptography
x.509 Certification Validation
TLS Vulnerabilities Introduced in Chromium/Node.js
Insecure HTTP Connections
Certificate Pinning
Advisory 04/27/2021\ Multiple Privilege Escalation Vulnerabilities in Pritunl VPN client
Publication 12/06/2022\ Brave Wallet Security Audit Report (Q4 2022)
Blog 04/03/2019\ Subverting Electron Apps via Insecure Preload
our research articles
Research is one of our founding principles and we invest in it heavily. All of our researchers have the privilege to use 25% of their time exclusively for self-directed research.