Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google purges bad extensions from Chrome

bbc.com

Post reply on HN
Print view View original

21–30 of 93 posts

Re: Google purges bad extensions from Chrome

#21

Post by 13 »

wiradikusuma wrote: post #2

Just FYI, there are many cases of malware (presumably browser extensions) targeting online bankings in Indonesia recently. The typical flow is like this: 1. The user logs in to his/her online banking website. 2. The malware gets triggered and phones home with user's credentials. 3. The bad guy logs in using user's credentials in own computer. 4. The bad guy initiates bank transfer from user's account to his account.…

Doesn't even have to be that complicated, the malware can just rewrite the destination to the malware author's silently and wait for people to be sending money there anyway. It's a reasonably dangerous property of Google-style 2FA that they can be transposed without any warning. My bank attempts to get around this by only using SMS based tokens, and the first line of the SMS says exactly what is being sent and where.

Re: Google purges bad extensions from Chrome

#25

Post by aianus »

13 wrote: post #21
wiradikusuma wrote: post #2

Just FYI, there are many cases of malware (presumably browser extensions) targeting online bankings in Indonesia recently. The typical flow is like this: 1. The user logs in to his/her online banking website. 2. The malware gets triggered and phones home with user's credentials. 3. The bad guy logs in using user's credentials in own computer. 4. The bad guy initiates bank transfer from user's account to his account.…

Doesn't even have to be that complicated, the malware can just rewrite the destination to the malware author's silently and wait for people to be sending money there anyway. It's a reasonably dangerous property of Google-style 2FA that they can be transposed without any warning. My bank attempts to get around this by only using SMS based tokens, and the first line of the SMS says exactly what is being sent and where.

On the other hand, it's much easier to reroute a cell phone number through social engineering than to steal TOTP secrets.

Re: Google purges bad extensions from Chrome

#26

Post by tomjen3 »

STRML wrote: post #14
tomjen3 wrote: post #11

Earlier quoted context omitted.

>That alone sounds like it'd make it pretty easy to examine and remove Minified and obfuscated Javascript is not much easier to check than binary files and more difficult than e.g Java class files, at least without ProGuard.

Just as a reference, you might like this tool - I've gotten great results with some really gnarly minified/obfuscated JS. http://www.jsnice.org/

Oh there is a built in version in the Chrome debugger.

And it can sure handle js uglify, etc there are tools and systems that allow you to remove more than that and then it becomes really difficult to get a handle on WTF is going on.

Re: Google purges bad extensions from Chrome

#27

Post by narrowrail »

josteink wrote: post #23

So how long until AdBlock Plus and uBlock are "bad" extensions? Enjoy your walled garden. Soon enough the walls will be so high you wont even remember what a free browser felt like.

You can manually install extensions, which is how I install mine (e.g. µMatrix). I'd rather not have to use the Chrome store (and I prefer Chromium , as well).

Re: Google purges bad extensions from Chrome

#28

Post by 13 »

aianus wrote: post #25
13 wrote: post #21

Earlier quoted context omitted.

Doesn't even have to be that complicated, the malware can just rewrite the destination to the malware author's silently and wait for people to be sending money there anyway. It's a reasonably dangerous property of Google-style 2FA that they can be transposed without any warning. My bank attempts to get around this by only using SMS based tokens, and the first line of the SMS says exactly what is being sent and where.

On the other hand, it's much easier to reroute a cell phone number through social engineering than to steal TOTP secrets.

Is it really possible from an evil standpoint to get SMS rerouted to another number? I was looking into that a while ago (I wanted a prettier number, but didn't want to lose things associated with the old one) and the answer I got was that it's not something anybody can do. I get how the phone call rerouting stuff would go down, but not SMS rerouting.

Re: Google purges bad extensions from Chrome

#29

Post by amyjess »

narrowrail wrote: post #27
josteink wrote: post #23

So how long until AdBlock Plus and uBlock are "bad" extensions? Enjoy your walled garden. Soon enough the walls will be so high you wont even remember what a free browser felt like.

You can manually install extensions, which is how I install mine (e.g. µMatrix). I'd rather not have to use the Chrome store (and I prefer Chromium , as well).

> You can manually install extensions

Not on Chrome stable. You have to use beta, dev, or a Chromium build for that.

Re: Google purges bad extensions from Chrome

#30

Post by aareet »

angeNoble wrote: post #3

Does anyone know where one could find a list of offending plugins? I tried, but came up empty handed.

I had the same problem. I'd also like to know whether an extension purged from the store will be automatically removed from Chrome if it is installed or would have to be manually removed.
Post reply on HN