Malware in the browser: how you might get hacked by a Chrome extension
1–10 of 64 posts
Re: Malware in the browser: how you might get hacked by a Chrome extension
#2The issue with Chrome extensions, just like with android apps, is that people never check the permissions and just click OK.
Extensions make it even easier to install them, though, just need to redirect a user.
I've also come upon some spam sites that try to get you to install extensions with annoying alerts that prevent you from closing the page, playing a recorded message "To close the page, just install the XX extension".
The only remedy is good screening in the app stores. Actually, for apps/extensions installed from the official repository, I would be OK with remote removal. This would probably spark an outcry from certain parties, but as long as it does not extend to manually installed extensions it's acceptable to me.
Re: Malware in the browser: how you might get hacked by a Chrome extension
#34ish years ago I had an old, unupdated netbook get infected with conduit extension, which spread through the sync mechanism to my newer laptops.
Re: Malware in the browser: how you might get hacked by a Chrome extension
#4If you like to tweak your Chrome install, check out:
chrome://flags/#extension-active-script-permission
It adds an extra level of permission where each extension that doesn't ask for a specific website is, by default, locked out of every website, and you have to enable it manually by either clicking on it, whitelisting the websites where it can run or globally (example pic, sorry for not being in english: http://puu.sh/q5QFR/d6004da3bb.png)
Re: Malware in the browser: how you might get hacked by a Chrome extension
#5The issue with Chrome extensions, just like with android apps, is that people never check the permissions and just click OK. Extensions make it even easier to install them, though, just need to redirect a user. I've also come upon some spam sites that try to get you to install extensions with annoying alerts that prevent you from closing the page, playing a recorded message "To close the page, just install the XX ext…
Doesn't the keyboard command to close the tab/window work in these cases? Thankfully, I've never encountered such BS.
Re: Malware in the browser: how you might get hacked by a Chrome extension
#6A big problem is also with unmaintained extensions that are being bought my malicious players (or developers' accounts hijacked), which then slap on an adware script and push a new version. That way, a previously good extension with a legitimate reason for "accessing your data on all websites" can silently become malicious.
Re: Malware in the browser: how you might get hacked by a Chrome extension
#7Extensions like this are just the same as .exe adware downloaded and installed by user (not automatically).
More serious problem is legitimate extensions that are trusted by lots of users then being sold to some rogue company, then lots of users receive malware with update.
Re: Malware in the browser: how you might get hacked by a Chrome extension
#8The issue with Chrome extensions, just like with android apps, is that people never check the permissions and just click OK. Extensions make it even easier to install them, though, just need to redirect a user. I've also come upon some spam sites that try to get you to install extensions with annoying alerts that prevent you from closing the page, playing a recorded message "To close the page, just install the XX ext…
Most useful extensions require access to all sites so permissions system isn't very helpful at all.
Re: Malware in the browser: how you might get hacked by a Chrome extension
#9The issue with Chrome extensions, just like with android apps, is that people never check the permissions and just click OK. Extensions make it even easier to install them, though, just need to redirect a user. I've also come upon some spam sites that try to get you to install extensions with annoying alerts that prevent you from closing the page, playing a recorded message "To close the page, just install the XX ext…
Most useful extensions require access to all sites so permissions system isn't very helpful at all.
I agree. I think that there could be more finely grained permissions. I basically have so sigh and resign myself anytime I want an extension badly enough.
Re: Malware in the browser: how you might get hacked by a Chrome extension
#10This article actually indicates a (probably bug-bounty'able) flaw in the Chrome webstore security checks:
> The script that it fetches from the above server is a malware payload. The extension needs to download it after having been installed because it cannot ship with the payload if it wants to pass through the Chrome Webstore’s security checks.
There probably are legitimate reasons to pull in remote content, but I can't think of any that can't be worked around. You'd think that Google's own malware tracking would pick up http://104.131.35.136:9999/ as a bad site, but the malware author takes care to hide that delivery mechanism behind a header check.
So, to me, ANY request or evals by extensions should (at the very least) be detected and constitute a separate permissions category, or, better yet, BLOCKED as a violation of same origin policy.