Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google purges bad extensions from Chrome

bbc.com

Post reply on HN
Print view View original

51–60 of 93 posts

Re: Google purges bad extensions from Chrome

#51

Post by seanp2k2 »

13 wrote: post #28
aianus wrote: post #25

Earlier quoted context omitted.

On the other hand, it's much easier to reroute a cell phone number through social engineering than to steal TOTP secrets.

Is it really possible from an evil standpoint to get SMS rerouted to another number? I was looking into that a while ago (I wanted a prettier number, but didn't want to lose things associated with the old one) and the answer I got was that it's not something anybody can do. I get how the phone call rerouting stuff would go down, but not SMS rerouting.

GrandCentral / Google Voice used to be able to do this, along with tons of other awesome stuff for VoIP nerds. You could bring whatever DIDs you had (IIRC they also sold them for a reasonable fee) and set up routing however you wanted, and you could trunk to your own SIP server if you wanted to e.g. Set up a phone menu to drive your home automation.

Not sure if any of that still works with GVoice, but if not, I'd look into doing it with Twilio possibly.

Re: Google purges bad extensions from Chrome

#52

Post by seanp2k2 »

bad_user wrote: post #20

> "You would expect that an extension that injects or replaces advertisements is malicious, but then you have AdBlock that creates an ad-free browsing experience and is technically very similar." AdBlock is very clear in what it does and users install it because they want to block ads, whereas users are usually not aware when an extension injects ads. As a note, the Awesome Screenshot extension for Firefox asks you i…

Yeah, but ABP also has white listed ads: http://techcrunch.com/2013/07/06/google-and-others-reportedl...

Ghostery has a bit of a different model, but they're no saints: http://www.technologyreview.com/news/516156/a-popular-ad-blo...

I guess the lure of selling use data is just too great for any commercial entity to control the source of these as blockers. uBlock and PrivacyBadger are still clean AFAIK.

Re: Google purges bad extensions from Chrome

#53

Post by tokenizerrr »

greggman wrote: post #19
arcatek wrote: post #16

Earlier quoted context omitted.

A good thing would probably to have a way to see the requests triggered by installed extensions. Even checking this list once in a while and manually reporting the suspicious ones with a "report" button would make these rogue extensions almost worthless.

Just a guess but can you see those in the DevTools on the Network tab? Needs to be open before you load the page. I'd check but I don't have any extensions installed except WTF and the WebGL Inspector.

This depends on what/how the extension is accessing the network. They have a background page and they can inject scripts on visited pages. If they are injecting scripts which then make the requests then it would show up in the DevTools on the page you are visiting, but this is uncommon.

Instead it is far more likely for the extension to make the requests from their background page (which has elevated permissions) which is essentially its own page with its own inspector. You can inspect each extension individually by going to your extension listing, enabling developer mode and inspecting the background page of the extension you suspect.

Re: Google purges bad extensions from Chrome

#54

Post by kuschku »

sandinmyjoints wrote: post #34

> Preliminary results revealed that 5% of people accessing Google every day have been caught out by at least one malicious extension. How might they have detected what extensions are installed in their visitor's browsers? Is there a way to enumerate installed extensions? http://browserspy.dk/ and https://panopticlick.eff.org/ detect plugins, but those aren't the same as extensions.

Google probably compares all the JS and HTML of the resulting page in-browser with the code that they originally delivered, allowing them to see if an extension or userscript manipulated it.

Re: Google purges bad extensions from Chrome

#55

Post by fragmede »

sandinmyjoints wrote: post #34

> Preliminary results revealed that 5% of people accessing Google every day have been caught out by at least one malicious extension. How might they have detected what extensions are installed in their visitor's browsers? Is there a way to enumerate installed extensions? http://browserspy.dk/ and https://panopticlick.eff.org/ detect plugins, but those aren't the same as extensions.

The article mentions Google was involved in the research, so they just went by the number of downloads of malware extensions on their store.

Re: Google purges bad extensions from Chrome

#56

Post by kardos »

Istof wrote: post #38
dankohn1 wrote: post #9

This is fantastic news. The Quick Note Chrome extension from Diigo (now removed) submits every URL visited to a third-party server and those URLs are then crawled the next day. We just switched our 25 member customer service team to Chromeboxes and were very concerned to find soon after that an EC2-based crawler was querying private URLs of our platform. Because the Chrome Web Store had not banned bad actors like Dii…

somewhat unrelated but if you email a private URL to a Microsoft email address, they will also crawl it, about once a month (I get an email anytime someone access it and MS bot is the only one accessing it). Not sure if Google also does that...

This is why I always put a user/pass on any private URL

I don't think their URL scanners are clever enough to dig through emails and try user/pass combos

Re: Google purges bad extensions from Chrome

#57

Post by obisw4n »

angeNoble wrote: post #3

Does anyone know where one could find a list of offending plugins? I tried, but came up empty handed.

I've been in contact with someone from Google Security and this was their answer:

"I spoke to the team that maintains that list and they don't have plans to make it public, if you would be willing to share some ideas on how to better protect people from this unwanted software I would be happy to pass it on but due to the nature of the work (trying to stay one step ahead of bad guys) we probably won't be able to share anything back."

I'm the author of this anti-adware addon called "Extension Defender" and it would greatly help my users if I could use their list, because while they extensions were removed from the Webstore, does that mean it was forcibly removed from their PC? Probably not.

Plug: https://chrome.google.com/webstore/detail/extension-defender...

Re: Google purges bad extensions from Chrome

#58

Post by pyre »

afarrell wrote: post #15
mmahemoff wrote: post #4

"This extension will have access to your browsing history and private data on all websites". Which is usually accompanied by the developer apologising and explaining they have to declare this in order to provide the extension's core functionality. Users then learn to ignore these warnings, malicious extensions ensue. I'm glad Google is taking malicious extensions seriously, but purging is a difficult semi-manual effo…

It sounds like you would need the ability to access all the data on the page but not be able to phone home. Enforcing that sounds like a nightmare.

Right now extensions can provide a regex of the URLs that they will be enabled on. Obviously a malicious developer will just say "all" though.

Re: Google purges bad extensions from Chrome

#59

Post by crisnoble »

arcatek wrote: post #16
dankohn1 wrote: post #9

This is fantastic news. The Quick Note Chrome extension from Diigo (now removed) submits every URL visited to a third-party server and those URLs are then crawled the next day. We just switched our 25 member customer service team to Chromeboxes and were very concerned to find soon after that an EC2-based crawler was querying private URLs of our platform. Because the Chrome Web Store had not banned bad actors like Dii…

A good thing would probably to have a way to see the requests triggered by installed extensions. Even checking this list once in a while and manually reporting the suspicious ones with a "report" button would make these rogue extensions almost worthless.

Have you tried out the new "Chrome Apps & Extensions Developer Tool" https://chrome.google.com/webstore/detail/chrome-apps-extens... ?

It appears to log what actions each application and extension performs, view permissions, and debug the extensions' background pages

Post reply on HN