Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Adware vendors buy Chrome Extensions to send ad- and malware-filled updates

arstechnica.com

Post reply on HN
Print view View original

71–80 of 111 posts

Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates

#71

Post by dredmorbius »

eksith wrote: post #42
ronnier wrote: post #22

I was contacted and offered some payments to start including some sort of ads in my Chrome extension. As I understood it, it would inject ads and/or replace links on web pages with affiliate links. I declined their offer.

That's just creepy. Replacing page content, unless ad/spam blocking or specifically user-selected filtering, is completely unethical and totally falls under malware in my book. Good on you for turning that down. You've saved your users a lot of aggravation.

If you think about it: as formulated, virtually all present Web advertising works via content injection. You're just (nominally) limiting who gets to insert content.

Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates

#72

Post by dredmorbius »

27182818284 wrote: post #10
quadrangle wrote: post #6

Obligatory note: Another example of why we should only run Free Software and only from trusted sources. Users of Trisquel or gNewSense never have problems like this.

Obligatory response that not everyone has time or training to examine code for problems. Google is a trusted source.

Obligatory response that you're not relying solely on your own ability to examine code for problems, but the entire universe of those able to do so.

With proprietary code, you're restricted to audits done by those whom the code author has allowed to do so (or who have surreptitiously obtained the source ... and having done so, put themselves at legal risk by disclosing their findings).

Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates

#73

Post by rithi »

Noticed link injection last week and tracked it down to a very useful extension called World Clocks [1]. Had a hard time trying to report it - finally tracked down the Report abuse button inside the details tab on the store.

One thing I noticed is that recent reviews of an extension are more accurate than the rating of the extension. Of course Google could mine these comments to track down problematic extensions and yank them.

[1] http://goo.gl/DGqW1

Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates

#74

Post by wmt »

atesti wrote: post #55

There is an easy solution: Follow http://superuser.com/questions/290280/how-to-download-chrome... in order to download the crx file manually. Then unzip it and vet it manually to be clean. Copy it in a folder, enable extension developer mode in Chrome and install the local copy of the extension. No autoupdate, everything's fine. Unfortunately Google plans to disallow local extensions, which is a major disaster and ve…

Easy solution to any chrome extension possibly getting sold to spam ads is to disable automatic updates and manually inspect and install all updates for all of my extensions?

Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates

#76

Post by midas007 »

anonymfus wrote: post #18
yaakov34 wrote: post #2

Can we start a petition for Google to let us disable extensions on specific sites? After reading the last few stories about this, I am quite sure I don't want any extensions whatsoever running in the same tab as my Gmail account. I think there is some extension that does this for you (turns off other extensions per site), but then we get into a "who guards the guardians" situation. Not to mention we need better and f…

Opera 12 has ability to disable access of specific extensions to https sites and/or private tabs (by default access to https sites is enabled and to private tabs is disabled). May be there is a hope that they implement it in Blink based Opera, but now they only have ability to disable access of specific extensions to private windows and have no private tabs at all.

Opera 12 is ancient history. Opera 18 is now basically Chrome without the ability to set a custom search engine as default. Even with sqlite hacks, there's no way to set DDG as default on the stable release versions.

(I use FF.)

Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates

#77

Post by nikcub »

yaakov34 wrote: post #2

Can we start a petition for Google to let us disable extensions on specific sites? After reading the last few stories about this, I am quite sure I don't want any extensions whatsoever running in the same tab as my Gmail account. I think there is some extension that does this for you (turns off other extensions per site), but then we get into a "who guards the guardians" situation. Not to mention we need better and f…

I achieve this by having multiple users in Chrome. My main user is signed into my google account and has no extensions installed and all plugins disabled, I only access gmail and google services with it.

My second user account is logged into basic services like HN, reddit, amazon and has only adblock and disconnect installed.

A third user is not logged in anywhere and has adblock and a half-dozen other extensions installed including UA switcher. No plugins installed and cookies + cache cleared every day.

4th user has all the anonimity extensions installed and has privoxy + tor set as the proxy

I use Facebook in a completely different browser again, YouTube and video watching in yet another and development in chromium.

7 or 8 different cookie stores, and a throwaway temp email account associated with the 3rd and 4th user for signing up to services.

Start out by creating a separate user for browsing sites and eventually develop your own way to split up your web browsing profiles.

This can get a bit messy when you try and access from tablet or mobikle , but I'd rather not have a single large profile and a huge exploit surface and sacrifice browsing history and remembering passwords.

Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates

#78

Post by pasbesoin »

Steuard wrote: post #62
riquito wrote: post #12

Earlier quoted context omitted.

To run a new, separated Firefox with a (possibly) different profile firefox -no-remote -ProfileManager It's always handy to have a "vanilla" profile, to compare how much the extensions tuned down the browser or try to understand if the error that you're seeing is caused by an extension. Having a "privacy" profile with some ad-hoc extensions helps too.

Mind you, -ProfileManager actually opens to the full profile manager interface (where you select a profile to run, or create a new one, or whatever). You can load a specific profile (that already exists) directly by replacing "-ProfileManager" with "-P [profile name]". (Omitting the name will open the manager, too.) https://developer.mozilla.org/en-US/docs/Mozilla/Command_Lin...

Ah, I guess that's why I remembered -p -- or -P, as the case may be.

Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates

#79

Post by MichaelGG »

MasterScrat wrote: post #44
riquito wrote: post #14

It's not just a DOM change problem. What if an extension change owner and start sending pairs (domain/user's credentials) to someone else? What if one buy an extension to get bank sites accesses?

What's surprising is that extensions are by default not "Allowed in incognito", however they are allowed when using HTTPS and there is no option to disable them there.

HTTPS shouldn't be thought as just for secure sites, but just as the default. 4chan and this site run on HTTPS yet I wouldn't want to disable extensions for them because of that.

Re: Adware vendors buy Chrome Extensions to send ad- and malware-filled updates

#80

Post by MichaelGG »

edtechdev wrote: post #57
atesti wrote: post #55

There is an easy solution: Follow http://superuser.com/questions/290280/how-to-download-chrome... in order to download the crx file manually. Then unzip it and vet it manually to be clean. Copy it in a folder, enable extension developer mode in Chrome and install the local copy of the extension. No autoupdate, everything's fine. Unfortunately Google plans to disallow local extensions, which is a major disaster and ve…

I mistakenly installed a Minecraft modloader for my son without checking it out first. It silently installed a couple of local Chrome extensions that injected ads in every page. It would reinstall them (again, silently) every time you deleted them. It wasn't detected by Microsoft Defender or Avast until I ran Malwarebytes which took care of the problem. So, pardon my french, but no freaking way do I want any local Ch…

If you are running arbitrary code on your box, then local installed Chrome extensions aren't the real problem now, are they?

That code could, I dunno, run a local HTTP/S proxy (install a trusted cert) and MiTM your HTTP requests and inject ads that way. Or about a million other things.

And it's funny Chrome is trying to prevent apps from doing that, when they themselves do the same thing: In Windows, pinning to the taskbar is supposed to be user-only. But Chrome circumvents that and pins anyways, actively avoiding user preference. (And they drop an icon on the desktop, without asking.)

Post reply on HN