Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The "Window Resizer" extension for Chrome now contains malware (2013)

productforums.google.com

Post reply on HN
Print view View original

21–30 of 124 posts

Re: The "Window Resizer" extension for Chrome now contains malware (2013)

#21

Post by tomswartz07 »

darklrd wrote: post #18
Svip wrote: post #9

Earlier quoted context omitted.

He asks specifically if he has broken some rules in Google Chrome's terms of service, where another user replies with quotations from the ToS. He barks at that saying his extension is allowed to do what he does, because his extension does reveal exactly what it does, if you read its permissions carefully. Although, I cannot confirm whether that is true, but that's what he is saying. I have no idea what he is up to; b…

They seem to have an automated review process unless the extension is flagged for manual review. Source - https://developers.google.com/chrome/web-store/faq#faq-gen-0... .

In my experience, the review is only for the first upload. Updates don't seem to be reviewed?

Re: The "Window Resizer" extension for Chrome now contains malware (2013)

#22

Post by tomswartz07 »

darklrd wrote: post #18
Svip wrote: post #9

Earlier quoted context omitted.

He asks specifically if he has broken some rules in Google Chrome's terms of service, where another user replies with quotations from the ToS. He barks at that saying his extension is allowed to do what he does, because his extension does reveal exactly what it does, if you read its permissions carefully. Although, I cannot confirm whether that is true, but that's what he is saying. I have no idea what he is up to; b…

They seem to have an automated review process unless the extension is flagged for manual review. Source - https://developers.google.com/chrome/web-store/faq#faq-gen-0... .

In my experience, the review is only for the first upload. Updates don't seem to be reviewed?

Re: The "Window Resizer" extension for Chrome now contains malware (2013)

#23

Post by silverlight »

Whoa, wait. One guy in this thread is claiming that Window Resizer was sending all your keystrokes back to a central server based on what he saw in Wireshark. Can anyone else verify this? I've had this extension installed for...a year, at least. Do I need to now go change every single password on every site because chances are it's been keylogged? This is insane.

Re: The "Window Resizer" extension for Chrome now contains malware (2013)

#24

Post by [deleted] »

Svip wrote: post #6

What is more interesting is the reaction from the developer himself. He seems to be completely unimpressed by the criticism. Noting that one permits Chrome extensions to do stuff, and they would have seen this permission the extension required when they updated or installed it. Furthermore, he is quoted as joking about how he could have sold the extension to someone to get your passwords and whatnot (but ensures us t…

[deleted]

Re: The "Window Resizer" extension for Chrome now contains malware (2013)

#25

Post by Svip »

silverlight wrote: post #23

Whoa, wait. One guy in this thread is claiming that Window Resizer was sending all your keystrokes back to a central server based on what he saw in Wireshark. Can anyone else verify this? I've had this extension installed for...a year, at least. Do I need to now go change every single password on every site because chances are it's been keylogged? This is insane.

The developer also seems to claim that the keylogger exists as well. If you want to take his word for it as well.

Re: The "Window Resizer" extension for Chrome now contains malware (2013)

#26

Post by dudus »

orf wrote: post #17
Bud wrote: post #14

Earlier quoted context omitted.

It's inserting fake search results and running a keystroke monitor. To me this isn't even a close call; of course it's malware. I would also say that any developer who would do this simply can't be trusted; if he will do this, he might do just about anything else. He doesn't seem to have any regard for others.

a hell of a lot of chrome extensions inject adverts and other tracking code into websites you visit, like Facebook and youtube. would you class those extensions as malware as well?

I would. Why wouldn't you?

Re: The "Window Resizer" extension for Chrome now contains malware (2013)

#28

Post by silverlight »

Svip wrote: post #25
silverlight wrote: post #23

Whoa, wait. One guy in this thread is claiming that Window Resizer was sending all your keystrokes back to a central server based on what he saw in Wireshark. Can anyone else verify this? I've had this extension installed for...a year, at least. Do I need to now go change every single password on every site because chances are it's been keylogged? This is insane.

The developer also seems to claim that the keylogger exists as well. If you want to take his word for it as well.

I just can't even fathom. Like, every email I've typed. Every interaction with any site. Credit card numbers.

How is this not entirely illegal?

And it certainly shows an incredible flaw in Chrome extensions. This extension didn't do this when I installed it. A silent auto-update though basically turned it into the worst malware I've ever had installed on my computer. How can any Chrome extension ever be trusted?

Furthermore, I spend a lot of time in Chrome Dev Tools, and the Network tab and I are no stranger. I would easily have noticed if my keystrokes were being sent back to a server and it was shown in there. So not only can an extension be silently updated, but it's capable of using a network connection that doesn't appear in the Chrome Network tab, that only Wireshark can reveal? That seems almost as ridiculous as what the extension author did.

Post reply on HN