Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Using fake reviews to find dangerous extensions

krebsonsecurity.com

Post reply on HN
Print view View original

51–60 of 105 posts

Re: Using fake reviews to find dangerous extensions

#51

Post by texasbigdata »

extesy wrote: post #22

> In other words, there a great many developers who are likely to be open to someone else buying up their creation along with their user base. As a maintainer of a relatively popular extension (hoverzoom+, ~360K users) I get business offers all the time [1]. A few of them are pretty good, actually. I'm not surprised that some developers eventually give up and take one of those offers. But I am surprised that there ar…

Woah indeed. Just doing the math it's about $1k per year for 10k-$15k users? Roughly?

That could be very enticing for a lot of developers.

Thanks for sharing this.

Re: Using fake reviews to find dangerous extensions

#52

Post by formerly_proven »

gnicholas wrote: post #50
formerly_proven wrote: post #47

Earlier quoted context omitted.

It's the opposite actually, the Chrome store forces the use of @gmail.com addresses, so e.g. Microsoft is publishing Chrome extensions from addresses like legitmicrosoftapps@gmail.com or microsoftofficextension@gmail.com See: https://news.ycombinator.com/item?id=27192997 (no one could actually tell which where legit and which were not)

This isn't my experience. I created my dev account years ago with a non-gmail account. Admittedly, it is a corporate account that is managed by google, but I don't think there was any step in the process that required this. It's possible that things have changed since I created my account nearly a decade ago, or that somehow I got a pass because google manages my domain's email. But they definitely do not force @gmai…

> it is a corporate account that is managed by google

All the counter-examples I could find in the linked thread are Google Mail (for Business), which is functionally the same as requiring a gmail account in that it requires Google to be your mail-provider.

Re: Using fake reviews to find dangerous extensions

#53

Post by ant6n »

matheusmoreira wrote: post #33
the_local_host wrote: post #4

I'm surprised anyone ever installs browser extensions, given how many malicious extensions exist, and how intrusive they are whether malicious or not.

Yeah. The only extensions people should install are uBlock Origin and EFF extensions like Privacy Badger. All others are potential malware. I get downvoted a lot every time I post this here.

But the question is, how can I install uBlock Origin knowing I got the official version and not a malware infested one.

Re: Using fake reviews to find dangerous extensions

#54

Post by rand0mx1 »

ant6n wrote: post #53
matheusmoreira wrote: post #33

Earlier quoted context omitted.

Yeah. The only extensions people should install are uBlock Origin and EFF extensions like Privacy Badger. All others are potential malware. I get downvoted a lot every time I post this here.

But the question is, how can I install uBlock Origin knowing I got the official version and not a malware infested one.

You can follow ublock origin subreddit

Re: Using fake reviews to find dangerous extensions

#55

Post by trutannus »

dataviz1000 wrote: post #35
facorreia wrote: post #32

I treat each and every Chrome extension as potentially malware, given that there are plenty of instances of legit extensions being sold and repurposed, and Chrome will silently install malware on my machine because of its auto-update-without-asking-or-verifying policy. I only trust a few, select extensions from large companies that hopefully won't sell them to a shady hacker.

I build my own personal Chrome extensions to be used only by myself and I treat them as potentially malware every single time I type `npm install`. If I built an extension to share, I would likely make it completely with vanilla JavaScript.

One approach would be to intercept your own traffic with Fiddler as a proxy for a few hours after installing and look for any nefarious requests. This is a pretty effective way to run a basic security audit.

Re: Using fake reviews to find dangerous extensions

#56

Post by bellyfullofbac »

kodon wrote: post #25
the_local_host wrote: post #4

I'm surprised anyone ever installs browser extensions, given how many malicious extensions exist, and how intrusive they are whether malicious or not.

I had this amazing extension for Google play music. it had cover art and some great hot keys. I noticed a bug with it pulling low Rez cover art sometimes so I tried to see if I could fix it in the source code. The GitHub repo was not public anymore, so I made the changes locally and it worked. I emailed the dev (his email was on the about section of the extension). He told me that the code was no longer public becaus…

But you could've probably taken the local copy and removed the update URL so it doesn't update itself anymore.

Anyway, since you said "Google Play Music" it's no longer relevant is it.

Re: Using fake reviews to find dangerous extensions

#57

Post by squiggleblaz »

voxl wrote: post #34
the_local_host wrote: post #4

I'm surprised anyone ever installs browser extensions, given how many malicious extensions exist, and how intrusive they are whether malicious or not.

How does your reasoning not apply to applications on any device?

Linux users who install their apps via a package manager (other than, iiuc, AUR) have at least the vetting of a third party. And this is why a lot of work goes into reproduceable builds and minimal bootstraps.

Apps provided on any platform by major, trusted vendors are much more likely to be safe. Apple/Microsoft/Adobe might find themselves compelled to add a government backdoor, but they're probably not going to chuck in code to send your credit card number to the darkweb.

As for install random programs from unknown vendors on the Google Play Store, yeah, I'm a bit nervous about that. It would be nice if we could manage trust on such platforms in some way, but all we can do is hope to be on guard at all times. Google clearly doesn't care if you get hacked by a third party, as long as they don't do it directly.

Re: Using fake reviews to find dangerous extensions

#58

Post by ocdtrekkie »

voxl wrote: post #34
the_local_host wrote: post #4

I'm surprised anyone ever installs browser extensions, given how many malicious extensions exist, and how intrusive they are whether malicious or not.

How does your reasoning not apply to applications on any device?

Web browsers do a lot of sandboxing to prevent outside tampering by other applications. Your secured content is encrypted by HTTPS between the server and your browser... but extensions sit inside the browser sandbox, often with full access to your decrypted web traffic.

If most of your secure information is handled via web browsers, as is usually the case today, extensions are drastically more risky than arbitrary software, because of the privileged place in the stack they operate.

Re: Using fake reviews to find dangerous extensions

#59

Post by ehsankia »

extesy wrote: post #22

> In other words, there a great many developers who are likely to be open to someone else buying up their creation along with their user base. As a maintainer of a relatively popular extension (hoverzoom+, ~360K users) I get business offers all the time [1]. A few of them are pretty good, actually. I'm not surprised that some developers eventually give up and take one of those offers. But I am surprised that there ar…

I moved from old HoverZoom to Imagus, wasn't aware a reboot of HoverZoom around, thanks for sharing. I'm curious how the sieves and also writing custom sieves compare, if anyone has experience with both.

Re: Using fake reviews to find dangerous extensions

#60

Post by throwawaaarrgh »

extesy wrote: post #22

> In other words, there a great many developers who are likely to be open to someone else buying up their creation along with their user base. As a maintainer of a relatively popular extension (hoverzoom+, ~360K users) I get business offers all the time [1]. A few of them are pretty good, actually. I'm not surprised that some developers eventually give up and take one of those offers. But I am surprised that there ar…

Do you think reporting these requests to the store(s) in question might result in investigation, or at the least, a list of suspicious investors to use to vet extensions/apps?
Post reply on HN