Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Using fake reviews to find dangerous extensions

krebsonsecurity.com

Post reply on HN
Print view View original

41–50 of 105 posts

Re: Using fake reviews to find dangerous extensions

#41

Post by gnicholas »

MattGaiser wrote: post #10

My team recently built a Chrome extension and expected to be grilled on permissions. We sailed through despite requesting access to all sorts of things. Their vetting seems strict from the outside, but does not seem like it after going through the process.

It's possible they are more focused on extensions with lots of users. My extensions with tens of thousands of users have been under increased scrutiny in the last year or two, and have had several false positive issues arise, which has been frustrating.

Re: Using fake reviews to find dangerous extensions

#42

Post by dylan604 »

voxl wrote: post #34
the_local_host wrote: post #4

I'm surprised anyone ever installs browser extensions, given how many malicious extensions exist, and how intrusive they are whether malicious or not.

How does your reasoning not apply to applications on any device?

not the person you are replying to, but for me, it applies the same. I only have uBlock Origin and password manager for extensions, and my phone has very few apps. I don't trust other devs to not succumb to temptation, so I don't use their apps. It would not be difficult for me to give up the smart phone for a feature phone.

Re: Using fake reviews to find dangerous extensions

#43

Post by [deleted] »

hedora wrote: post #27

> Additionally, Google’s account recovery tools indicate many different developer email addresses tied to extensions reviewed here share the same recovery email What?!? This work was done by an independent researcher. Why is google providing account recovery emails to the general public (and therefore attackers)?!? Edit: fixed typo; replaced “recovery passwords” with “recovery emails”

[deleted]

Re: Using fake reviews to find dangerous extensions

#44

Post by throwawayboise »

kenniskrag wrote: post #9
1cvmask wrote: post #2

Reviews are mathematical garbage even there are real reviewers because we all have different expectations and it varies completely across cultures and geographies.

I once watched a movie where the rating was "do you like the item on the left more than on the right". I'm not sure if it is mathematically possible to create a rank from it. I assume, that new items appear and have less comparisons than others.

I once helped develop a "survey" for a nonprofit org, which wanted to gain some insight on what they were doing well and what they could improve. One of the other people involved kept insisting on reducing the number of questions and complexity of the ratings. He said it all boiled down to one basic question, "would you use this service again" and while we didn't quite get that simple, in retrospect I think he was more right than wrong.

Maybe a boolean "would you buy this product again" is the basic question for a review. It's still open to being gamed, but only in one way.

Re: Using fake reviews to find dangerous extensions

#45

Post by throwawayboise »

sneak wrote: post #38

Any of Google's thousands of staff could have done this trivial research, too, but apparently it's no one's job over there: just like detecting the hijacked verified Twitter accounts that reply to almost all Elon tweets with cryptocurrency scam links that any non-Twitter person can find in 100 seconds, or the antivax hashtag spammers on Instagram, etc. These companies are very bad at being proactive in enforcing thei…

That was my reaction as well. If an external independent researcher can do this, Amazon, Google, and other big platforms surely have enough resources, smarts, and full access to all the data to identify and eliminate bogus accounts, shill reviews, and scammy or counterfeit products. Yet they don't do it.

Re: Using fake reviews to find dangerous extensions

#46

Post by welder »

dataviz1000 wrote: post #35
facorreia wrote: post #32

I treat each and every Chrome extension as potentially malware, given that there are plenty of instances of legit extensions being sold and repurposed, and Chrome will silently install malware on my machine because of its auto-update-without-asking-or-verifying policy. I only trust a few, select extensions from large companies that hopefully won't sell them to a shady hacker.

I build my own personal Chrome extensions to be used only by myself and I treat them as potentially malware every single time I type `npm install`. If I built an extension to share, I would likely make it completely with vanilla JavaScript.

Yes, for open source extensions that don't update often I load them unpacked from my local filesystem.

Re: Using fake reviews to find dangerous extensions

#47

Post by formerly_proven »

gnicholas wrote: post #21

> The extensions spoofed a range of consumer brands, including Adobe, Amazon, Facebook, HBO, Microsoft, Roku and Verizon Does the Chrome store not require that the dev account associated with these extensions be on the official corporate domains? That would seem like an easy way to prevent spoofing of Fortune 100 companies.

It's the opposite actually, the Chrome store forces the use of @gmail.com addresses, so e.g. Microsoft is publishing Chrome extensions from addresses like legitmicrosoftapps@gmail.com or microsoftofficextension@gmail.com

See: https://news.ycombinator.com/item?id=27192997 (no one could actually tell which where legit and which were not)

Re: Using fake reviews to find dangerous extensions

#48

Post by eps »

extesy wrote: post #22

> In other words, there a great many developers who are likely to be open to someone else buying up their creation along with their user base. As a maintainer of a relatively popular extension (hoverzoom+, ~360K users) I get business offers all the time [1]. A few of them are pretty good, actually. I'm not surprised that some developers eventually give up and take one of those offers. But I am surprised that there ar…

Woah. That's really quite something O_O

Re: Using fake reviews to find dangerous extensions

#49

Post by CharlesW »

donmcronald wrote: post #26
gnicholas wrote: post #21

> The extensions spoofed a range of consumer brands, including Adobe, Amazon, Facebook, HBO, Microsoft, Roku and Verizon Does the Chrome store not require that the dev account associated with these extensions be on the official corporate domains? That would seem like an easy way to prevent spoofing of Fortune 100 companies.

The trust industry is awful and somehow Google and Apple came up with worse versions. Simple domain validated publishing similar to Let's Encrypt would be way better for devs and users, but that would require Google and Apple to give up control and that doesn't happen in monopoly markets. Edit: And Microsoft. Between them those 3 companies are the gatekeepers of almost all (signed) app distribution.

> The trust industry is awful and somehow Google and Apple came up with worse versions.

You're putting them in the same bucket, but TFA calls out Google (and not Apple) for good reason.

> Between them those 3 companies are the gatekeepers of almost all (signed) app distribution.

And? I'm assuming you're not saying "software should not be signed", in which case I'm missing your point.

Re: Using fake reviews to find dangerous extensions

#50

Post by gnicholas »

formerly_proven wrote: post #47
gnicholas wrote: post #21

> The extensions spoofed a range of consumer brands, including Adobe, Amazon, Facebook, HBO, Microsoft, Roku and Verizon Does the Chrome store not require that the dev account associated with these extensions be on the official corporate domains? That would seem like an easy way to prevent spoofing of Fortune 100 companies.

It's the opposite actually, the Chrome store forces the use of @gmail.com addresses, so e.g. Microsoft is publishing Chrome extensions from addresses like legitmicrosoftapps@gmail.com or microsoftofficextension@gmail.com See: https://news.ycombinator.com/item?id=27192997 (no one could actually tell which where legit and which were not)

This isn't my experience. I created my dev account years ago with a non-gmail account. Admittedly, it is a corporate account that is managed by google, but I don't think there was any step in the process that required this.

It's possible that things have changed since I created my account nearly a decade ago, or that somehow I got a pass because google manages my domain's email. But they definitely do not force @gmail.com addresses for all devs.

EDIT: See this Microsoft extension [1] for example. It shows @microsoft.com, which is undoubtedly not managed by google like my little old startup's email is!

1: https://chrome.google.com/webstore/detail/microsoft-editor-s...

Post reply on HN