Is SConnect safe?

Question

Is SConnect safe?

Accepted Answer

SConnect is high risk. Dynamic analysis confirmed that the SConnect extension forwards browser messages to the SafeNet SConnect application on the local device without checking which website sent the message. The extension's content script runs on every HTTP and HTTPS page and listens for window.postMessage events bearing type 'SConnect'. It accepts such messages from any script on the page—not just from pages that are part of the SafeNet ecosystem—because it checks only that the message came from the same browser window, never which website that window belongs to. Any page-level script that crafts a matching message has it relayed, unchanged, to the native smart-card host, which handles operations such as certificate listing and digital signing. We confirmed this by injecting a test message on a neutral page and observing the extension open a native messaging port to com.gemalto.sconnect.

Is SConnect safe?

Findings