Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Using fake reviews to find dangerous extensions

krebsonsecurity.com

Post reply on HN
Print view View original

71–80 of 105 posts

Re: Using fake reviews to find dangerous extensions

#71

Post by gnicholas »

throwawaaarrgh wrote: post #60
extesy wrote: post #22

> In other words, there a great many developers who are likely to be open to someone else buying up their creation along with their user base. As a maintainer of a relatively popular extension (hoverzoom+, ~360K users) I get business offers all the time [1]. A few of them are pretty good, actually. I'm not surprised that some developers eventually give up and take one of those offers. But I am surprised that there ar…

Do you think reporting these requests to the store(s) in question might result in investigation, or at the least, a list of suspicious investors to use to vet extensions/apps?

Seems like the stores could investigate this on their own by creating fake extensions that appear to have lots of users.

Re: Using fake reviews to find dangerous extensions

#72

Post by gnicholas »

This thread exposes the challenge of running a business based on a Chrome extension. On the one hand, most users are not savvy enough to install extensions or even understand what they are.

On the other hand, someone who is very savvy knows that the permissions required by many/most browser extensions create an opportunity for massive privacy intrusions and security risks.

It's hard to create a business aimed at people who are savvy enough to know what extensions are but not savvy enough to realize what a huge risk they represent.

note: it's also possible to sell to super-unsavvy users, who do not know what extensions are but are willing to install them anyway.

Re: Using fake reviews to find dangerous extensions

#73

Post by dmix »

extesy wrote: post #22

> In other words, there a great many developers who are likely to be open to someone else buying up their creation along with their user base. As a maintainer of a relatively popular extension (hoverzoom+, ~360K users) I get business offers all the time [1]. A few of them are pretty good, actually. I'm not surprised that some developers eventually give up and take one of those offers. But I am surprised that there ar…

Reminds me of Pirate Bay posting those DMCA emails or takedown notices. Of course not in the same league as random "Business Development" cold emails but it's interesting to public service.

Especially for other extension devs to see who may share similar experiences and helping exposing a pattern of waste-of-time proposals (which I think at that point over values any assumed privacy it was a cold email after all).

Half of those were probably scammers anyway.

Re: Using fake reviews to find dangerous extensions

#74

Post by bozzcl »

8note wrote: post #70
bozzcl wrote: post #65

Ah, this takes me back! On my first job, our CEO asked me to look at some fraud transaction data from an airline and use a graph database to gather some insights from it. His idea was to show that to some executives from the airline as a prototype to get some buy-in to build a fraud detection tool from them. The data source basically contained account IDs, billing addresses, credit card hashes and whether an account…

Likely, it worked for a couple months until the bad actors found a cheap bypass to your detection method.

Such is the war against fraud.

Re: Using fake reviews to find dangerous extensions

#75

Post by londons_explore »

kortilla wrote: post #67
trutannus wrote: post #55

Earlier quoted context omitted.

One approach would be to intercept your own traffic with Fiddler as a proxy for a few hours after installing and look for any nefarious requests. This is a pretty effective way to run a basic security audit.

Only effective against ones that don’t have activation criteria.

Usually the activation criteria will be "Contact this server and see what it tells me to do".

An extension developer ought to know the exact purpose of every network request their extension makes, so inspecting network logs is indeed a good plan.

Just remember there are ways to detect if the developer tools panel is open...

Re: Using fake reviews to find dangerous extensions

#76

Post by theiz »

I live in the Netherlands. We speak dutch. This makes it quite handy to pick fake reviews since these are (almost) always bad translations. Why does no one look outside the main language areas and compare these? Most reviews are on global stuff anyway.

Re: Using fake reviews to find dangerous extensions

#77

Post by ChrisClark »

formerly_proven wrote: post #47
gnicholas wrote: post #21

> The extensions spoofed a range of consumer brands, including Adobe, Amazon, Facebook, HBO, Microsoft, Roku and Verizon Does the Chrome store not require that the dev account associated with these extensions be on the official corporate domains? That would seem like an easy way to prevent spoofing of Fortune 100 companies.

It's the opposite actually, the Chrome store forces the use of @gmail.com addresses, so e.g. Microsoft is publishing Chrome extensions from addresses like legitmicrosoftapps@gmail.com or microsoftofficextension@gmail.com See: https://news.ycombinator.com/item?id=27192997 (no one could actually tell which where legit and which were not)

It's because of that thread that people mistakenly believe you need a gmail.com address. A bunch of people in that thread guessed you needed a gmail.com address. Others immediately said no, you don't need it and showed examples.

But this is how misinformation spreads. Many people only read it and believe it without looking closer.

We just trust that other people know what they are talking about. :)

... Also I could be wrong, I'm trusting the counter examples in that thread. :D

Re: Using fake reviews to find dangerous extensions

#78

Post by londons_explore »

gnicholas wrote: post #50
formerly_proven wrote: post #47

Earlier quoted context omitted.

It's the opposite actually, the Chrome store forces the use of @gmail.com addresses, so e.g. Microsoft is publishing Chrome extensions from addresses like legitmicrosoftapps@gmail.com or microsoftofficextension@gmail.com See: https://news.ycombinator.com/item?id=27192997 (no one could actually tell which where legit and which were not)

This isn't my experience. I created my dev account years ago with a non-gmail account. Admittedly, it is a corporate account that is managed by google, but I don't think there was any step in the process that required this. It's possible that things have changed since I created my account nearly a decade ago, or that somehow I got a pass because google manages my domain's email. But they definitely do not force @gmai…

It is possible to make a non-gmail and non-gsuite google account... Just it isn't obvious how to do so.

You need to go to any google signin page, click "Create account" > "For myself" > "Use my current email instead".

You can then use that to make chrome extensions.

Re: Using fake reviews to find dangerous extensions

#80

Post by ceejayoz »

londons_explore wrote: post #75
kortilla wrote: post #67

Earlier quoted context omitted.

Only effective against ones that don’t have activation criteria.

Usually the activation criteria will be "Contact this server and see what it tells me to do". An extension developer ought to know the exact purpose of every network request their extension makes, so inspecting network logs is indeed a good plan. Just remember there are ways to detect if the developer tools panel is open...

> Usually the activation criteria will be "Contact this server and see what it tells me to do".

Right, but it could be set up to only do that starting six months after installation or something.

Post reply on HN