Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The "Window Resizer" extension for Chrome now contains malware (2013)

productforums.google.com

Post reply on HN
Print view View original

101–110 of 124 posts

Re: The "Window Resizer" extension for Chrome now contains malware (2013)

#101

Post by chrisbalt »

paulirish wrote: post #42
hendersoon wrote: post #5

Earlier quoted context omitted.

Smooth Gestures (lfkgmnnajiljnolcgolmmgnecgldgeld) has done the same thing for well over a year now. I (and many others) reported the addon to Google, but it still remains. What does it take to get something like this removed?

In the extension text, they say: "This extension is ad supported, you can disable your support by going to the options and making a one-time donation. We depend on your support, but we understand if you would prefer to withhold it." This, from what I can tell, plays within the bounds of Chrome's policy on extensions. (I also spent some time looking at the extension source to verify that the only annoying thing they d…

Seems like the quintessential dark pattern is to have a "feature" like this enabled by default. Further, I discovered that the feature would re-enable on a regular cadence - perhaps every time the extension was updated.

Re: The "Window Resizer" extension for Chrome now contains malware (2013)

#102

Post by chrisbalt »

Really what this boils down to, imho, is a need to educate users on the meaning of the permissions that are granted (with approval) to these extensions. Certainly the vast majority of users confirm the security permissions without comprehending the weight of access they've just provided the extension author.

With JavaScript, it's nearly impossible for Chrome to reasonably explain, with any level of granularity, what exactly an extension will do with its access - hence the "access your data on all websites" warning.

A proof of concept to demonstrate how you can take advantage of this access for nefarious reasons, even after getting approval into the Chrome Web Store, would be quite simple.

Long/short of it is: make sure you trust the author of any extension you install!

Re: The "Window Resizer" extension for Chrome now contains malware (2013)

#104

Post by aragot »

Cthulhu_ wrote: post #66
Svip wrote: post #9

Earlier quoted context omitted.

He asks specifically if he has broken some rules in Google Chrome's terms of service, where another user replies with quotations from the ToS. He barks at that saying his extension is allowed to do what he does, because his extension does reveal exactly what it does, if you read its permissions carefully. Although, I cannot confirm whether that is true, but that's what he is saying. I have no idea what he is up to; b…

He does indicate the user gives the OK to 'access all data on all websites' - like most extensions do, come to think of it. I do think things like that should be more fine-grained, and/or that developers have to indicate /why/ they need that access.

I really, really have a problems with this permission:

- For a very few extensions, I allow it, but it is very clear that it is an open gateway for hackers,

- Most often, I deeply regret I can't even tell Chrome that I allow the extension on a subset of sites... At least not my gmail please...

- So the base rule is, never install something which requires all perms, obviously.

Users have been warned properly. They're at the mercy of untrustable people.

Re: The "Window Resizer" extension for Chrome now contains malware (2013)

#105

Post by aragot »

bronsoja wrote: post #97
darklrd wrote: post #18

Earlier quoted context omitted.

They seem to have an automated review process unless the extension is flagged for manual review. Source - https://developers.google.com/chrome/web-store/faq#faq-gen-0... .

Yeah, seems like they should maybe institute some type of manual review for any type of "global" permissions. It would impede the well-behaving apps that legitimately need global permissions, but it might be worth it.

... or incentive them not to request universe permissions.

Re: The "Window Resizer" extension for Chrome now contains malware (2013)

#107

Post by paulirish »

timmclean wrote: post #52

I'm most concerned about the keylogging claims. Does anyone have a copy of the CRX so that we can determine if keystrokes were in fact being transmitted?

I looked at the source and it did not capture keystrokes for this purpose. His comments also indicate he did not add this behavior to the extension.

Re: The "Window Resizer" extension for Chrome now contains malware (2013)

#108

Post by prafuitu »

timmclean wrote: post #52

I'm most concerned about the keylogging claims. Does anyone have a copy of the CRX so that we can determine if keystrokes were in fact being transmitted?

Holly crap, this really got out of hand!

NO! It wasn't logging anything! The only thing it was doing was proxying clicks on search results through Ecosia's analytics servers instead of Google's.

Anyone who still has the extension installed can view the source code by looking in their /%USER_FOLDER%//Extensions/kkelicaakdanhinjdeammmilcgefonfh The extension is also available at http://ionut-botizan.net/window-resizer/ both as a .zip and .crx file.

Re: The "Window Resizer" extension for Chrome now contains malware (2013)

#109

Post by prafuitu »

chrisbalt wrote: post #100
8ig8 wrote: post #10

Reddit discussion from last month: http://www.reddit.com/r/YouShouldKnow/comments/1snyyl/ysk_th... Also, alternative as discussed on SO: http://stackoverflow.com/questions/20775775/alternative-to-c... See it in action: http://chrisbalt.com/blog/2013/12/20/link-hijacking-through-... Edit: Related: http://superuser.com/questions/694825/why-my-google-search-r... http://windowresizer.userecho.com/topic/353032-did-you-pul…

One thing I wish I had called out more clearly in my post ("See it in action") was the fact that the "feature" would re-enable itself after every update of the extension, which seemed to be quite frequently. It's a shame; it really was a feature-packed, helpful extension.

No it doesn't re-enable after any update. It only re-enables if you uninstall the extension and install it back, because settings are lost and it switches to the default. Please check your facts before making such claims, ok? Anyone with minimal JavaScript skills can look at the source code and see exactly what's happening!

Thanks!

Re: The "Window Resizer" extension for Chrome now contains malware (2013)

#110

Post by prafuitu »

Svip wrote: post #25
silverlight wrote: post #23

Whoa, wait. One guy in this thread is claiming that Window Resizer was sending all your keystrokes back to a central server based on what he saw in Wireshark. Can anyone else verify this? I've had this extension installed for...a year, at least. Do I need to now go change every single password on every site because chances are it's been keylogged? This is insane.

The developer also seems to claim that the keylogger exists as well. If you want to take his word for it as well.

Where do I claim that?!! WTF?!
Post reply on HN