Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Adware vendors buy Chrome Extensions to send ad- and malware-filled updates

arstechnica.com

Post reply on HN
Print view View original

41–50 of 111 posts

Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates

#41

Post by Danieru »

gazarsgo wrote: post #38
GigabyteCoin wrote: post #37

I wouldn't be surprised if some of the instances of this happening was the result of the original extension writer trying to boost his bottom line. (And not the work of shady malware marketers). It's easy to convince yourself you have been cheated when you know your extension has over 1M+ downloads and you only have ~!$100 sent to your donation button.

I forked an extension released under MIT license because of this -- original author pushing shady updates. After I re-released it on the Chrome Store, now I get emails trying to buy "my" extension from me.

That sounds like a fine grey-hat tactic. Fork existing extensions, generate several thousand fake installs. Then sell to the first bidder. Rinse & Repeat and you'll make a profit and turn the market for second hand extensions into a market for lemons.

If it happened enough the buyers would start being more cautious. The bar for minimal installs will go up and more proof will be expected. Soon enough the buyer's intentions will be clear to any extension owner.

Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates

#42

Post by eksith »

ronnier wrote: post #22

I was contacted and offered some payments to start including some sort of ads in my Chrome extension. As I understood it, it would inject ads and/or replace links on web pages with affiliate links. I declined their offer.

That's just creepy. Replacing page content, unless ad/spam blocking or specifically user-selected filtering, is completely unethical and totally falls under malware in my book.

Good on you for turning that down. You've saved your users a lot of aggravation.

Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates

#43

Post by mjn »

ufmace wrote: post #5

This is a disturbing situation, but it's hard to say what the best way of dealing with it is. The first thing most people reach for first is that extensions shouldn't auto-update. Personally, I disagree - I love silent auto-updates in general. It's a huge drag on the computing experience to have dozens of different widgets all requiring manual updates, all with different mechanisms and all on their own schedules. If…

Rather than only doing it via technical means like permissions, I'd be more comfortable with auto-updating but with some kind of human quality assurance. Two systems that manage to pull that off from very different cultural/economic starting points are Apple's app store, and Debian's software repository.

The Google model of an auto-updating but un-QA'd app store doesn't work for me, because it combines two things I really don't see as compatible: 1) low-friction updates; and 2) installation of arbitrary un-reviewed code from the internet. If you're going to do #2, then I want the friction of downloading a new executable. I want to go to a website, see if the company still exists, read the release notes, generally be cautious about installation of random executables off the internet. But if you're going to do #1, then since the updates are supposed to apply without significant review by me, someone else has to be vetting what goes into the repository for at least minimal non-evilness standards.

Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates

#44

Post by MasterScrat »

riquito wrote: post #14

It's not just a DOM change problem. What if an extension change owner and start sending pairs (domain/user's credentials) to someone else? What if one buy an extension to get bank sites accesses?

What's surprising is that extensions are by default not "Allowed in incognito", however they are allowed when using HTTPS and there is no option to disable them there.

Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates

#45

Post by MasterScrat »

Danieru wrote: post #41
gazarsgo wrote: post #38

Earlier quoted context omitted.

I forked an extension released under MIT license because of this -- original author pushing shady updates. After I re-released it on the Chrome Store, now I get emails trying to buy "my" extension from me.

That sounds like a fine grey-hat tactic. Fork existing extensions, generate several thousand fake installs. Then sell to the first bidder. Rinse & Repeat and you'll make a profit and turn the market for second hand extensions into a market for lemons. If it happened enough the buyers would start being more cautious. The bar for minimal installs will go up and more proof will be expected. Soon enough the buyer's inten…

I wouldn't be so optimistic.

> The bar for minimal installs will go up and more proof will be expected.

Or the Store would be flooded with infected cloned extensions that some idiots will install anyway.

> Soon enough the buyer's intentions will be clear to any extension owner.

That's not the problem: developers could trivially be informed of this risk when they submit their extension on the Store.

Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates

#46

Post by oniTony »

yaakov34 wrote: post #2

Can we start a petition for Google to let us disable extensions on specific sites? After reading the last few stories about this, I am quite sure I don't want any extensions whatsoever running in the same tab as my Gmail account. I think there is some extension that does this for you (turns off other extensions per site), but then we get into a "who guards the guardians" situation. Not to mention we need better and f…

Chrome doesn't run extensions by default in incognito mode.

> Because Google Chrome does not control how extensions handle your personal data, all extensions have been disabled for incognito windows. You can reenable them individually in the extensions manager.

Keeping your gmail tab in an incognito window might be a good approach.

Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates

#47

Post by MasterScrat »

mjn wrote: post #43
ufmace wrote: post #5

This is a disturbing situation, but it's hard to say what the best way of dealing with it is. The first thing most people reach for first is that extensions shouldn't auto-update. Personally, I disagree - I love silent auto-updates in general. It's a huge drag on the computing experience to have dozens of different widgets all requiring manual updates, all with different mechanisms and all on their own schedules. If…

Rather than only doing it via technical means like permissions, I'd be more comfortable with auto-updating but with some kind of human quality assurance. Two systems that manage to pull that off from very different cultural/economic starting points are Apple's app store, and Debian's software repository. The Google model of an auto-updating but un-QA'd app store doesn't work for me, because it combines two things I r…

> Rather than only doing it via technical means like permissions, I'd be more comfortable with auto-updating but with some kind of human quality assurance.

I agree on this.

The best solution for now would be a meta-extension that checks if you have compromised extensions installed and disable them.

The blacklist could be compiled based on the Store feedbacks (ratings dropping sharply? disabled.), a reporting system from the app, and also using automatic testing. For example run the extension on a sandboxed machine and check for requests to known shady domains.

Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates

#48

Post by beefsack »

oniTony wrote: post #46
yaakov34 wrote: post #2

Can we start a petition for Google to let us disable extensions on specific sites? After reading the last few stories about this, I am quite sure I don't want any extensions whatsoever running in the same tab as my Gmail account. I think there is some extension that does this for you (turns off other extensions per site), but then we get into a "who guards the guardians" situation. Not to mention we need better and f…

Chrome doesn't run extensions by default in incognito mode. > Because Google Chrome does not control how extensions handle your personal data, all extensions have been disabled for incognito windows. You can reenable them individually in the extensions manager. Keeping your gmail tab in an incognito window might be a good approach.

While it's a decent workaround, I wouldn't call it ideal, namely because it requires a second window open when you might be starved for screen real estate and also because accidentally opening your mail once in a normal window could cause damage.

Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates

#50

Post by ufmace »

kzahel wrote: post #31
ufmace wrote: post #5

This is a disturbing situation, but it's hard to say what the best way of dealing with it is. The first thing most people reach for first is that extensions shouldn't auto-update. Personally, I disagree - I love silent auto-updates in general. It's a huge drag on the computing experience to have dozens of different widgets all requiring manual updates, all with different mechanisms and all on their own schedules. If…

The problem is with users. They ignore the scary "access to all websites" dialogs and install extensions. Sites like pinterest have extensions that request these permissions, when they don't even need them. There's a way to have the extension only have access to the site you're on when you CLICK somewhere in your toolbar. There are fine grained permissions and optional permissions to specific hosts and ports and URL…

Looks like what we really need to do is to remove those universal permissions entirely, then. Say after some particular date, no new extensions or updates to existing ones are allowed unless they remove the universal permissions and switch to the site-specific ones.

Of course, then you need a solid extension update system where there's some way to alert the user of when an extension needs new permissions, and have them see and authorize them before the update goes active. Hopefully something like the way that Chome updates work now - instead of throwing a modal dialog at the user at some random time, have a tick or light in the UI somewhere that they need to do something.

Post reply on HN