Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Release: OLED Mode extension for Chrome

github.com

Post reply on HN
Print view View original

31–38 of 38 posts

Re: Release: OLED Mode extension for Chrome

#31

Post by WindowsDev »

throw60289 wrote: post #17
WindowsDev wrote: post #15

Earlier quoted context omitted.

[flagged]

Why do the JavaScript files in repo "Chrome-OLED-Mode" reference sdmextension[.]com, a known C2 server in a Chrome extension malware campaign identified by GitLab Threat Intelligence? Is this a copy of the malicious "Super dark mode" extension? (ID: nlgphodeccebbcnkgmokeegopgpnjfkc) https://gitlab-com.gitlab.io/gl-security/security-tech-notes...

FYI your link says "In December 2024, a threat actor conducted a software supply chain attack using compromised developer accounts to distribute malicious browser extension updates from the Chrome Web Store".

The version I base my decompilation on is a v6.1.2 sourced from the Web Store on August 9, 2024. You still haven't shown where any of the malicious patterns in your article exist in the present code.

Re: Release: OLED Mode extension for Chrome

#32

Post by WindowsDev »

Etheryte wrote: post #30
WindowsDev wrote: post #26

Earlier quoted context omitted.

Typically the burden of proof would be on the one making the assertion that something is malicious, but I see mere accusations and paranoia is good enough for some people even with the code right in front of them. Two unused string constants doesn't mean much.

It very much does when someone else already pointed out that the same code has previously been show to include malware.

>that the same code has previously been show to include malware.

What was pointed out was, that the extension got compromised at our thereafter December 2024. The version I base this on was sourced from the Web Store August 2024 when it was a legit Chrome and Firefox extension with active 300,000+ users and existed since since 2020. Just because an extension gets compromised you think that retroactively means the old versions are unsafe too and now the code is haunted?

Re: Release: OLED Mode extension for Chrome

#33

Post by frfl »

WindowsDev wrote: post #28
frfl wrote: post #20

Earlier quoted context omitted.

This all feels very off. Part of the readme, and I hate to say it as it's almost become a trope at this point, feels like it was AI generated. Plus the commits are "file uploads". Plus the minified multi-MB source files. My spidey senses are tingling.

Congrats, you sewed enough paranoia that you got the submission taken down just suspicion alone. Strange though, on a community of developers, no one is able to show specifically how/and where it malicious. The extension contains no active network communications, no runtime use of webRequest or declarativeNetRequest, no dynamic code loading, and no modifications to HTTP response headers or CSP directives. References…

[flagged]

Re: Release: OLED Mode extension for Chrome

#34

Post by WindowsDev »

frfl wrote: post #33
WindowsDev wrote: post #28

Earlier quoted context omitted.

Congrats, you sewed enough paranoia that you got the submission taken down just suspicion alone. Strange though, on a community of developers, no one is able to show specifically how/and where it malicious. The extension contains no active network communications, no runtime use of webRequest or declarativeNetRequest, no dynamic code loading, and no modifications to HTTP response headers or CSP directives. References…

[flagged]

[flagged]

Re: Release: OLED Mode extension for Chrome

#36

Post by WindowsDev »

Etheryte wrote: post #22
WindowsDev wrote: post #14

Earlier quoted context omitted.

That React stuff is for the interface. It contains transpiled "minified" code so to cut back on the file size. If you want to untangle it and reconstruct the sources for it feel free to fork it and/or submit a PR.

This doesn't pass any kind of a sniff test. The file size doesn't need to be small for Github, they don't care. Likewise it doesn't need to be small for the extension since the extension is stored locally, not loaded over the network. Take your malware elsewhere.

>The file size doesn't need to be small for Github, they don't care. Likewise it doesn't need to be small for the extension since the extension is stored locally, not loaded over the network. Take your malware elsewhere.

It’s minified like this because it was being distributed to 100,000’s of users in the crx state it came from, as a courtesy to not waste their data / HDD space. Google was fine with it in this state for 5 years. Take your slander elsewhere.

Re: Release: OLED Mode extension for Chrome

#37

Post by hnlmorg »

WindowsDev wrote: post #34
frfl wrote: post #33

Earlier quoted context omitted.

[flagged]

[flagged]

I appreciate you feel attacked but the content of the repositories are suspicious. Zip files, executables missing source, readmes that are clearly incorrect (eg giving Windows install instructions for a macOS binary) and this particularly plugin is minified.

I could tell that this was due to lack of experience because there were other obvious mistakes you’d made which were harmless.

What you need to appreciate is that you’re asking people to install untrusted software on their computers. So while you might feel attacked, the burden of proof is actually with you to demonstrate that you are trustworthy.

And that means eating some humble pie here. Learning from the feedback you’re receiving and grow from it. Rather than demanding that the community fix your shortcomings. We don’t owe you our time any more than we owe you our devices to beta test your software projects.

Re: Release: OLED Mode extension for Chrome

#38

Post by WindowsDev »

hnlmorg wrote: post #37
WindowsDev wrote: post #34

Earlier quoted context omitted.

[flagged]

I appreciate you feel attacked but the content of the repositories are suspicious. Zip files, executables missing source, readmes that are clearly incorrect (eg giving Windows install instructions for a macOS binary) and this particularly plugin is minified. I could tell that this was due to lack of experience because there were other obvious mistakes you’d made which were harmless. What you need to appreciate is tha…

Thanks for your feedback. The source code for my windows binary projects(and visual studio .SLN files too) are available for all my projects if you care to look close enough. The .exe are prepared for convenience and is fully reproducible. I am correcting that typo in that macos utility(I admittedly wasn’t ready to launch that one for public release or announcement, fixing now). I maintain that all my extensions are 100% legitimate and will improve the code clarity on my next releases.
Post reply on HN