Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Our Copyfish extension was stolen and adware-infested

a9t9.com

Post reply on HN
Print view View original

161–170 of 217 posts

Re: Our Copyfish extension was stolen and adware-infested

#161

Post by gorhill »

krackers wrote: post #103

I guess this is as good a place as any to post that I noticed something similar had happened to [User-Agent Switcher for Google Chrome]( https://chrome.google.com/webstore/detail/user-agent-switche... ) and [Block Site]( https://chrome.google.com/webstore/detail/block-site/eiimnmi... ). The "report abuse" link on the page is useless. The former is very insidious in that it actually hides the malware in a .jpg file th…

> it actually hides the malware in a .jpg file that appears benign at first (promo.jpg for anyone who wants to analyze) but when loaded in a canvas element and decoded in some manner

I am guessing the extensions had a "content_security_policy" key in its manifest[1], with a 'unsafe-eval' CSP directive in its value?

Any extension which declare such CSP directive in its manifest should be presumed malicious until further thorough investigation proves otherwise.

The 'unsafe-eval' in a manifest is essentially the ability for an extension to execute arbitrary code in the extension context which can't be code-reviewed by reading the source files.

EDIT:

"User-Agent Switcher for Google Chrome" confirmed to have a 'unsafe-eval' in its manifest.

"Block site" does not declare 'unsafe-eval' in its manifest. It does however add many "script-src" directives in its manifest, including one for ".wips.com", which means the extension can pull javascript resources not bundled with the extension from its own web site (hence outside of the Chrome store review process if any), and thus the behavior of the extension is subject to change at any time as far as its permissions allow.

So I guess the suspicion should be extended to any extension declaring a "content_security_policy" key in its manifest.

===

[1] https://developer.mozilla.org/en-US/Add-ons/WebExtensions/ma...

Re: Our Copyfish extension was stolen and adware-infested

#162

Post by posterboy »

codedokode wrote: post #138
krackers wrote: post #108

Earlier quoted context omitted.

The odd post requests I noticed to uaswitcher.org in wireshark while I was trying to create a packet capture. I saw that it contained my browsing history urls in double encoded base64 format. Interestingly it appears the extension was infected ~4 years back, taken down, and somehow later re-added, only to be reinfested with malware within the last few months. Suffice to say, I am now paranoid and have audited all my…

I don't use browser extensions at all because they are often made by unknown developers and I cannot trust them.

and if an extension is not downright malignand, they are often slow.

Re: Our Copyfish extension was stolen and adware-infested

#163

Post by numerum-bestiae »

nl wrote: post #87
sillysaurus3 wrote: post #36

Earlier quoted context omitted.

This actually isn't true. A website like https://www.xn--80ak6aa92e.com/ won't show up as apple.com. Browsers don't allow Unicode rendering in the URL bar. Maybe IE is affected though. I haven't tested every browser. But it's a known security concern.

It shows up as www.apple.com on Firefox 54.0.1 (latest, up-to-date) on OSX.

Just tried - same (54.0.1) FF version on Android DOES show apple.com (Chrome and Yandex do not).

Re: Our Copyfish extension was stolen and adware-infested

#164

Post by milankragujevic »

krackers wrote: post #103

I guess this is as good a place as any to post that I noticed something similar had happened to [User-Agent Switcher for Google Chrome]( https://chrome.google.com/webstore/detail/user-agent-switche... ) and [Block Site]( https://chrome.google.com/webstore/detail/block-site/eiimnmi... ). The "report abuse" link on the page is useless. The former is very insidious in that it actually hides the malware in a .jpg file th…

I am mortified. I had this extension installed for 2 years... What info did they get and what can they do to me? Please help... (I uninstalled it, talking about User-Agent Switcher)

Re: Our Copyfish extension was stolen and adware-infested

#165

Post by thadk »

FYI, This "Better History" extension in Chrome has a history of selling browser history since it was sold by its developer: https://chrome.google.com/webstore/detail/better-history/obc...

They frequently remove it from the store when people notice and restore it a or so month later.

The comments over the past year or so detail the symptoms of spyware. The "Report Abuse" button in Chrome Store feels useless.

Re: Our Copyfish extension was stolen and adware-infested

#166

Post by logicallee »

stordoff wrote: post #149
logicallee wrote: post #95

We should never have to read a title "disable immediately" by a developer. In a news article. That is not how this should be distributed, in case the original developer is the one distributing the news. Instead, Google should generate an emergency disable code that a developer can put into a simple web form from anywhere in the world, even if the developer has been locked out of every one of their accounts, which imm…

How would you handle exposed disable codes (say if a person who had access to it leaves the company)? There are presumably situations where revocation of the code would be needed, but that seems difficult to implement without also opening a window for the attacker to use: * instant revocation -> attacker will just revoke the code * delayed revocation where the code remains usable for some period -> accidental exposur…

We are competing with publishing "if you're my user, disable my extension."

Revocation codes should revoke. A malicious employee or compromised gmail account should be able to disable an extension, yes. The developer should then have to work to reinstate it.

Extensions are not part of the core Chrome experience.

You are asking: "As a user, are you okay with Chrome extensions being disabled by Google if its developer had their revoke key compromised?"

Nobody would say "no".

Compare: "as a user, are you okay with Microsoft Windows locking and not booting, in case Microsoft's internal revoke key experienced a security issue?" (until Microsoft issues an update which unlocks it again.)

Most people would not want that, because people need to finish working on their things in this scenario. (Of course some ultra secure installations might want that, but most wouldn't.)

The difference is that these are small, third-party developers, working on extensions, not the core functionality.

I hope this answers your question regarding how I personally would handle exposed codes.

However, I am not an extension developer or heavy extension user! I am not saying this is the only solution.

Re: Our Copyfish extension was stolen and adware-infested

#167

Post by FussyZeus »

stevenh wrote: post #140
codedokode wrote: post #138

Earlier quoted context omitted.

I don't use browser extensions at all because they are often made by unknown developers and I cannot trust them.

I always thought it was strange that Google bothered adding so many XSS prevention measures to Chrome when they also happily give UXSS abilities to extension developers, complete with the veneer of trust provided by the Chrome web store.

> veneer of trust provided by the Chrome web store

Seriously? Who trusts the Chrome store or the Android store for that matter? If you've ever once submitted an app and seen how loose the security is, I can't see how you'd have any faith in their system.

Re: Our Copyfish extension was stolen and adware-infested

#168

Post by Rjevski »

4ad wrote: post #156
BenjiWiebe wrote: post #72

Earlier quoted context omitted.

I always look at the mouse over url. And check the URL in the address bar. And rely on the password manager in the browser. And sometimes login in a new tab, then go back and reload the link.

A pity some browsers now hide the mouse over URL. I use this in safari to bring it back: https://visnup.github.io/Minimal-Status-Bar/

In Safari you can go to "View -> Show status bar" to bring it back natively without a third-party extension.

Re: Our Copyfish extension was stolen and adware-infested

#169

Post by 4ad »

Rjevski wrote: post #168
4ad wrote: post #156

Earlier quoted context omitted.

A pity some browsers now hide the mouse over URL. I use this in safari to bring it back: https://visnup.github.io/Minimal-Status-Bar/

In Safari you can go to "View -> Show status bar" to bring it back natively without a third-party extension.

Amazing, thanks!

Re: Our Copyfish extension was stolen and adware-infested

#170

Post by cyphar »

FussyZeus wrote: post #167
stevenh wrote: post #140

Earlier quoted context omitted.

I always thought it was strange that Google bothered adding so many XSS prevention measures to Chrome when they also happily give UXSS abilities to extension developers, complete with the veneer of trust provided by the Chrome web store.

> veneer of trust provided by the Chrome web store Seriously? Who trusts the Chrome store or the Android store for that matter? If you've ever once submitted an app and seen how loose the security is, I can't see how you'd have any faith in their system.

You're viscously agreeing here. "Veneer" means a very thin layer of pretty material on top of cheaper material -- in this context the comment was saying that the trust afforded to Google is skin-deep and is probably unjustified.
Post reply on HN