51–60 of 64 posts
Basically, at their scale it's a hard problem, especially if you need to redo your analysis after every update to an extension and you can't afford a high false positive rate.
A big problem is also with unmaintained extensions that are being bought my malicious players (or developers' accounts hijacked), which then slap on an adware script and push a new version. That way, a previously good extension with a legitimate reason for "accessing your data on all websites" can silently become malicious.
Yes. Mozilla also allows that, which is really sleazy for Mozilla.
Additionally, JS is a dynamic language so it's difficult to provide adequate automated scanning for malicious intent. Even so, extension authors can be quite clever in how they hide malicious behavior, especially if there's financial reward involved.
WebExtensions (https://wiki.mozilla.org/WebExtensions) add a permission system, have a much smaller attack surface, and should help to alleviate this problem. This combined with automated scanning + human review and
For Chrome, I think Google prefers a combination of automated scanning and quick response, without upfront human review (based on https://static.googleusercontent.com/media/research.google.c...)
The issue with Chrome extensions, just like with android apps, is that people never check the permissions and just click OK. Extensions make it even easier to install them, though, just need to redirect a user. I've also come upon some spam sites that try to get you to install extensions with annoying alerts that prevent you from closing the page, playing a recorded message "To close the page, just install the XX ext…
I remain baffled that alerts in modern browsers are still handled with an OS-level modal dialog that prevents interaction with the browser's interface elements. Couldn't the alert instead be rendered as an overlay to the page itself, be modal to just that tab, and not disable the browser Chrome? This would make it much harder for pages to "trap" users with alert spam. The existing policies (don't allow this page to c…
They were opaque with us about what the code did (they didn't share the actual code without NDA, and we never got that far). But I did get to see the snippet they wanted us to add to our privacy policy, which was devilishly opaque. It arguably disclosed everything that would be done, but it did so in a way that sounded very benign.
I googled some phrases from the privacy policy insert and found that they had in fact gotten several extensions to include the code. Scary.
Google gave a good overview of the screening they perform for extensions in a paper at usenix security last year: https://www.usenix.org/conference/usenixsecurity15/technical... Basically, at their scale it's a hard problem, especially if you need to redo your analysis after every update to an extension and you can't afford a high false positive rate.
I'm guessing Google would have more extensions to review than Mozilla and could not rely as much on volunteers as Mozilla can, but Google also has something like an order of magnitude more money, so I'm sure they could work something out, if they really wanted to.
A big problem is also with unmaintained extensions that are being bought my malicious players (or developers' accounts hijacked), which then slap on an adware script and push a new version. That way, a previously good extension with a legitimate reason for "accessing your data on all websites" can silently become malicious.
Yes. Mozilla also allows that, which is really sleazy for Mozilla.
One of these extensions I came across automatically closed about:extensions every time I opened it to prevent uninstallation. Eventually went through the chrome task manager, killing extensions one by one until I found the right one by trial and error. Very frustrating to debug.
Doesn't anyone else see that as incredibly overreaching?
My company has a Chrome/Firefox extension with ~60k users. We have been approached repeatedly by companies that want us to add in their tracking snippet to our extension. What they offered—tens of thousands of dollars every year—was tempting, but we didn't take the bait. They were opaque with us about what the code did (they didn't share the actual code without NDA, and we never got that far). But I did get to see th…
Could you share those phrases, so that we can do the same Googling?