Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Our Copyfish extension was stolen and adware-infested

a9t9.com

Post reply on HN
Print view View original

171–180 of 217 posts

Re: Our Copyfish extension was stolen and adware-infested

#171

Post by mschuster91 »

TeMPOraL wrote: post #99
devrandomguy wrote: post #46

Earlier quoted context omitted.

Yeah, we really need to distinguish between a 2FA app and a dedicated hardware key. My phone is probably the least secure thing I've ever owned, both in terms of technical security, and physical security. This whole 2FA thing has been really jarring for me, because I always treated my phone like a public space: no password, no private data (that I know of), ready for inspection by foreign authorities. Of all the thin…

> Of all the things the world could ask me to trust, why the phone? Because it's the only instance of a computer that you can expect majority of users to own and always have on them. 2FA as a thing would not get any reasonable adoption if you required people to buy hardware keys to use it. Not to mention, hardware keys do not work on every device one would like to log in from (AFAIK you can't plug in a Yubikey to an…

> AFAIK you can't plug in a Yubikey to an Android tablet, and it may not have NFC built in

Using an USB OTG adapter, it should be possible. However, even the flagship tablets of Samsung don't carry NFC, only the phones do - and even there it's a hit and miss if you have NFC.

Apple, on the other hand, doesn't have developer-accessible NFC anywhere.

This is a real shame.

Re: Our Copyfish extension was stolen and adware-infested

#172

Post by mikegerwitz »

This is why it is important to cryptographically sign releases. Browsers are a huge problem with this.

All of the software I use is signed at some point in the chain (be it by the actual author or by the package manager, who'd better be verifying signatures if they're available, otherwise at least not blindly updating), _except for my browser extensions_. Most of it is also _reproducible_! I can get around this for some things---I use GNU Guix in addition to Debian, and they package some extensions. I need to start using them.

Of course, the signature should really come from the actual author, not the package maintainer for a particular distro; there's room for error. In the case of a project being hijacked (e.g. Copyfish), hopefully a maintainer would notice. Git commit and tag signing is an easy way to do this if you don't separately sign releases; package maintainers should be building from source.

In the case of Copyfish: if the browser validated signatures from the authors, then this would have been thwarted.

(Maybe there is some code signing protections in place? I'm not an extension developer for either Chromium or Firefox; please let me know if something does exist!)

Re: Our Copyfish extension was stolen and adware-infested

#173

Post by FussyZeus »

cyphar wrote: post #170
FussyZeus wrote: post #167

Earlier quoted context omitted.

> veneer of trust provided by the Chrome web store Seriously? Who trusts the Chrome store or the Android store for that matter? If you've ever once submitted an app and seen how loose the security is, I can't see how you'd have any faith in their system.

You're viscously agreeing here. "Veneer" means a very thin layer of pretty material on top of cheaper material -- in this context the comment was saying that the trust afforded to Google is skin-deep and is probably unjustified.

Ahh you're quite right. Apologies, not enough coffee yet.

Re: Our Copyfish extension was stolen and adware-infested

#174

Post by gargravarr »

Spear phishing is remarkably effective, even against tech-savvy people. One of the most alarming aspects is that we've become trained to click links in emails as soon as we see some trustworthy indication, be it something we were expecting, a spoofed sender or copying Google's layout, further re-enforced by an accurate login page clone.

I think the best defence here is to condition ourselves out of this behaviour. If you receive a link in an email, don't click it - view the source or paste it into a text document and examine it. And if you aren't expecting an email, such as Google emailing out of the blue, go to the known-trusted site and see if there's any pending notifications.

Seems we need to stop trusting email.

Re: Our Copyfish extension was stolen and adware-infested

#175

Post by occultist_throw »

gorhill wrote: post #161
krackers wrote: post #103

I guess this is as good a place as any to post that I noticed something similar had happened to [User-Agent Switcher for Google Chrome]( https://chrome.google.com/webstore/detail/user-agent-switche... ) and [Block Site]( https://chrome.google.com/webstore/detail/block-site/eiimnmi... ). The "report abuse" link on the page is useless. The former is very insidious in that it actually hides the malware in a .jpg file th…

> it actually hides the malware in a .jpg file that appears benign at first (promo.jpg for anyone who wants to analyze) but when loaded in a canvas element and decoded in some manner I am guessing the extensions had a "content_security_policy" key in its manifest[1], with a 'unsafe-eval' CSP directive in its value? Any extension which declare such CSP directive in its manifest should be presumed malicious until furth…

So how does unsafe-eval and loading scripts dynamically pass any sort of "google security scan"?

It would seem obvious that the moment a script tries to load arbitrary code outside of the package, it should fail.

Re: Our Copyfish extension was stolen and adware-infested

#176

Post by macNchz »

mikegerwitz wrote: post #172

This is why it is important to cryptographically sign releases. Browsers are a huge problem with this. All of the software I use is signed at some point in the chain (be it by the actual author or by the package manager, who'd better be verifying signatures if they're available, otherwise at least not blindly updating), _except for my browser extensions_. Most of it is also _reproducible_! I can get around this for s…

My understanding is that Chrome extensions are indeed signed and you can't upload updates without signing the new package with the same key, so presumably the attacker had access to the private key after phishing the Google password.

Perhaps it was stored somewhere accessible by that account? Or accidentally packaged with the extension itself? If that were the case the spear phishing attack would make sense: someone scraping the Chrome store for extensions that contain a key file, then phishing their developer account credentials would be more efficient than phishing credentials without knowing beforehand whether you'd be able to get the private key and update the extension.

https://developer.chrome.com/extensions/packaging

Re: Our Copyfish extension was stolen and adware-infested

#177

Post by likpok »

logicallee wrote: post #117
Animats wrote: post #107

Earlier quoted context omitted.

We should never have to read a title "disable immediately" by a developer. In a news article. If you want to change that, start contacting reporters from mainstream media. If this hits the New York Times or the Wall Street Journal, or at least Techdirt, Google might notice.

Google is staffed by geniuses who also read HN and I feel it is sufficient that I suggested one possible correct solution here on HN. I am sure they'll introduce some solution to this problems. (I mean some way for them to disable compromised extensions centrally.) I am not personally an extension developer and don't run many.

The people you need to convince is Google management, so that they prioritize this over everything else on the roadmap. One easy way to do that from outside is to make it actually a priority, by making it a PR issue. Otherwise it turns into one of those perennial 'things we want to do' that never beats out the critical items on the roadmap.

Re: Our Copyfish extension was stolen and adware-infested

#179

Post by IncRnd »

Endy wrote: post #37

While I understand how some people can take this as a cautionary tale in favor of 2FA, as someone who doesn't like it and won't use it, I guess my mindset is very simple. There's the old saw that over time, computing has evolved from smart people in front of dumb terminals into dumb people in front of "smart" terminals. This attack is proof of it; and while 2FA might have had an impact, the major issue here is that w…

> The lesson here is: never trust anyone or anything.

I find it interesting that most people who replied to your post were upset with you. The first maxim of programming is, "all input is evil." Good Internet Hygiene means not to click links in emails.

Re: Our Copyfish extension was stolen and adware-infested

#180

Post by IncRnd »

logicallee wrote: post #95

We should never have to read a title "disable immediately" by a developer. In a news article. That is not how this should be distributed, in case the original developer is the one distributing the news. Instead, Google should generate an emergency disable code that a developer can put into a simple web form from anywhere in the world, even if the developer has been locked out of every one of their accounts, which imm…

That is a good start but isn't sufficient. Many browsers exist on networks that are airgapped or are off of the Internet for extended periods of time. Plus, there are regulations or policies in many places that forbid this type of action.
Post reply on HN