Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malware in the browser: how you might get hacked by a Chrome extension

kjaer.io

Post reply on HN
Print view View original

31–40 of 64 posts

Re: Malware in the browser: how you might get hacked by a Chrome extension

#31

Post by firewalkwithme »

the_duke wrote: post #2

The issue with Chrome extensions, just like with android apps, is that people never check the permissions and just click OK. Extensions make it even easier to install them, though, just need to redirect a user. I've also come upon some spam sites that try to get you to install extensions with annoying alerts that prevent you from closing the page, playing a recorded message "To close the page, just install the XX ext…

I do read the permissions for Android apps - they all want permissions to everything. For no good reason. Enter apathy

Re: Malware in the browser: how you might get hacked by a Chrome extension

#32

Post by heinrich5991 »

zeta0134 wrote: post #29
the_duke wrote: post #2

The issue with Chrome extensions, just like with android apps, is that people never check the permissions and just click OK. Extensions make it even easier to install them, though, just need to redirect a user. I've also come upon some spam sites that try to get you to install extensions with annoying alerts that prevent you from closing the page, playing a recorded message "To close the page, just install the XX ext…

I remain baffled that alerts in modern browsers are still handled with an OS-level modal dialog that prevents interaction with the browser's interface elements. Couldn't the alert instead be rendered as an overlay to the page itself, be modal to just that tab, and not disable the browser Chrome? This would make it much harder for pages to "trap" users with alert spam. The existing policies (don't allow this page to c…

That's at least what Firefox does.

Re: Malware in the browser: how you might get hacked by a Chrome extension

#33

Post by atomwaffel »

zeta0134 wrote: post #29
the_duke wrote: post #2

The issue with Chrome extensions, just like with android apps, is that people never check the permissions and just click OK. Extensions make it even easier to install them, though, just need to redirect a user. I've also come upon some spam sites that try to get you to install extensions with annoying alerts that prevent you from closing the page, playing a recorded message "To close the page, just install the XX ext…

I remain baffled that alerts in modern browsers are still handled with an OS-level modal dialog that prevents interaction with the browser's interface elements. Couldn't the alert instead be rendered as an overlay to the page itself, be modal to just that tab, and not disable the browser Chrome? This would make it much harder for pages to "trap" users with alert spam. The existing policies (don't allow this page to c…

> Couldn't the alert instead be rendered as an overlay to the page itself, be modal to just that tab, and not disable the browser Chrome?

Firefox and Safari do exactly that.

> The existing policies (don't allow this page to create more dialogs -> page instantly redirects to itself to reset the flag) aren't doing a good enough job.

Does that work? I've never seen any pages that circumvent alert blocking like that, and I'd have imagined that any sensible implementation would disable alerts for the entire session (or at least a few minutes).

Re: Malware in the browser: how you might get hacked by a Chrome extension

#34

Post by Noseshine »

I'm not sure, so this is not really an accusation, but I think I had such problems with BetterTTV (https://chrome.google.com/webstore/detail/betterttv/ajopnjid...), a Chrome extension for Twitch chat.

I had trouble with Google suddenly asking me to prove I'm not a bot - for months. I ended up buying a new router because my old one hadn't seen any updates in ages, just in case that got hacked.

Long story short, after some experimenting the only thing that seemed to shut Google up was to disable this extension.

This extension does load code from a remote site, they write it is because having new releases approved takes too long so this is how they work around it. I had BTTV report a newer version number than there was in the Chrome Web Store for that reason.

I don't understand they are allowed to do that, quite openly even? It defeats the purpose of the Chrome Web Store and any guarantees by Google are worthless if extensions can just load some of their code from somewhere else.

Now, this extension actually is open source (https://github.com/night/BetterTTV) and I have not read about any suspicions like mine from anyone else. Still, as I said above, Google only stopped asking me to verify I'm no robot after disabling this extension, and I tried several times (on/off).

And the code loading happens quite officially, I first read it on the extensions developer website itself. From their github README:

    > Files not included in the repo are pulled from the actual server,
    > so everything works.

Re: Malware in the browser: how you might get hacked by a Chrome extension

#35

Post by Animats »

lorenzhs wrote: post #6

A big problem is also with unmaintained extensions that are being bought my malicious players (or developers' accounts hijacked), which then slap on an adware script and push a new version. That way, a previously good extension with a legitimate reason for "accessing your data on all websites" can silently become malicious.

Yes. Mozilla also allows that, which is really sleazy for Mozilla.

Re: Malware in the browser: how you might get hacked by a Chrome extension

#36

Post by Sylos »

Animats wrote: post #35
lorenzhs wrote: post #6

A big problem is also with unmaintained extensions that are being bought my malicious players (or developers' accounts hijacked), which then slap on an adware script and push a new version. That way, a previously good extension with a legitimate reason for "accessing your data on all websites" can silently become malicious.

Yes. Mozilla also allows that, which is really sleazy for Mozilla.

Uhm, Mozilla does a code review of every extension or update to an extension before it gets published on AMO, so it should hardly be possible for a malicious third party to do malicious things...

Re: Malware in the browser: how you might get hacked by a Chrome extension

#37

Post by noinsight »

nkozyra wrote: post #20
billmalarky wrote: post #19

Earlier quoted context omitted.

I was under the impression all chrome extensions had to go through the chrome web store now. I don't think you can manually install them anymore (outside of installing in developer mode). I could be wrong though.

This is true. They've actually made it difficult to do even with Developer Mode active, which is probably a net win.

It's so annoying - on Windows, you can't even prevent Chrome from complaining every time you start it up when you have Developer Mode (and unpacked extensions) active. On Linux it doesn't, fortunately. I just want to use my own extension and it's not something that others would benefit from.

I even tried to put my extension up on the Web Store just because of this but I gave up once my (obviously valid) credit card got rejected. Now I just live with it.

Re: Malware in the browser: how you might get hacked by a Chrome extension

#38

Post by Animats »

Sylos wrote: post #36
Animats wrote: post #35

Earlier quoted context omitted.

Yes. Mozilla also allows that, which is really sleazy for Mozilla.

Uhm, Mozilla does a code review of every extension or update to an extension before it gets published on AMO, so it should hardly be possible for a malicious third party to do malicious things...

There's an outfit called WIPS which buys up abandoned Firefox add-ons and puts adware and spyware in them.[1] BlockSite [2] is an example. This was approved by Mozilla AMO.[3]

[1] http://www.ghacks.net/2013/03/12/mozilla-needs-a-new-audit-p... [2] https://addons.mozilla.org/en-US/firefox/addon/blocksite/rev... [3] https://bugzilla.mozilla.org/show_bug.cgi?id=903799

Re: Malware in the browser: how you might get hacked by a Chrome extension

#39

Post by netsharc »

firewalkwithme wrote: post #31
the_duke wrote: post #2

The issue with Chrome extensions, just like with android apps, is that people never check the permissions and just click OK. Extensions make it even easier to install them, though, just need to redirect a user. I've also come upon some spam sites that try to get you to install extensions with annoying alerts that prevent you from closing the page, playing a recorded message "To close the page, just install the XX ext…

I do read the permissions for Android apps - they all want permissions to everything. For no good reason. Enter apathy

BlackBerry allowed fine-grained permissions, and this was 7-8 years ago. But rooted phone, Xposed and Xprivacy brings this feature to Android.

Re: Malware in the browser: how you might get hacked by a Chrome extension

#40

Post by teraflop »

justinlardinois wrote: post #25
wnevets wrote: post #21

Earlier quoted context omitted.

I wish this was the default.

If it was, it would make Chrome all but unusable to a very large portion of its users. Once they realized Flash didn't work on any websites, they'd switch back to Internet Explorer or Firefox or Safari, rather than trying to figure out why it does that.

Technically, Flash is a plugin, not an extension.
Post reply on HN