Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The "Window Resizer" extension for Chrome now contains malware (2013)

productforums.google.com

Post reply on HN
Print view View original

41–50 of 124 posts

Re: The "Window Resizer" extension for Chrome now contains malware (2013)

#41

Post by erichurkman »

Svip wrote: post #25
silverlight wrote: post #23

Whoa, wait. One guy in this thread is claiming that Window Resizer was sending all your keystrokes back to a central server based on what he saw in Wireshark. Can anyone else verify this? I've had this extension installed for...a year, at least. Do I need to now go change every single password on every site because chances are it's been keylogged? This is insane.

The developer also seems to claim that the keylogger exists as well. If you want to take his word for it as well.

Where did you see that from the author?

Re: The "Window Resizer" extension for Chrome now contains malware (2013)

#42

Post by paulirish »

hendersoon wrote: post #5
miles wrote: post #2

The linked discussion is back from mid-December and the extension has been removed from the Chrome Web Store: https://chrome.google.com/webstore/detail/window-resizer/kke...

Smooth Gestures (lfkgmnnajiljnolcgolmmgnecgldgeld) has done the same thing for well over a year now. I (and many others) reported the addon to Google, but it still remains. What does it take to get something like this removed?

In the extension text, they say: "This extension is ad supported, you can disable your support by going to the options and making a one-time donation. We depend on your support, but we understand if you would prefer to withhold it."

This, from what I can tell, plays within the bounds of Chrome's policy on extensions.

(I also spent some time looking at the extension source to verify that the only annoying thing they do is inject ads according to this whitelist: http://goo.gl/3WAej6 Nothing else caught my eye. )

Re: The "Window Resizer" extension for Chrome now contains malware (2013)

#43

Post by hrjet »

orf wrote: post #38
dudus wrote: post #26

Earlier quoted context omitted.

I would. Why wouldn't you?

I would, but that then means that the chrome web store is riddled with malware which isn't a nice thought and doesn't bode well for its future as something that is supposed to be more secure than traditional native platforms.

Something that was supposed to be secure is not. So you stop calling malware, malware?

Move on.

Re: The "Window Resizer" extension for Chrome now contains malware (2013)

#44

Post by orf »

hrjet wrote: post #43
orf wrote: post #38

Earlier quoted context omitted.

I would, but that then means that the chrome web store is riddled with malware which isn't a nice thought and doesn't bode well for its future as something that is supposed to be more secure than traditional native platforms.

Something that was supposed to be secure is not. So you stop calling malware, malware? Move on.

I was agreeing with him, perhaps I should have phrased it better.

Re: The "Window Resizer" extension for Chrome now contains malware (2013)

#45

Post by hendersoon »

paulirish wrote: post #42
hendersoon wrote: post #5

Earlier quoted context omitted.

Smooth Gestures (lfkgmnnajiljnolcgolmmgnecgldgeld) has done the same thing for well over a year now. I (and many others) reported the addon to Google, but it still remains. What does it take to get something like this removed?

In the extension text, they say: "This extension is ad supported, you can disable your support by going to the options and making a one-time donation. We depend on your support, but we understand if you would prefer to withhold it." This, from what I can tell, plays within the bounds of Chrome's policy on extensions. (I also spent some time looking at the extension source to verify that the only annoying thing they d…

https://developers.google.com/chrome/web-store/program_polic...

Of all the stuff under "Interfering with Third-party Ads and Websites", it only complies with "This behavior is clearly disclosed to the user." IMO obviously.

Re: The "Window Resizer" extension for Chrome now contains malware (2013)

#46

Post by ygra »

wfunction wrote: post #35
joshschreuder wrote: post #34

Earlier quoted context omitted.

Not sure if you can or not, but you can use this: https://chrome.google.com/webstore/detail/extensions-update-... Which pops up a toast notification whenever an extension gets updated so you can investigate (Chrome doesn't force changelogs on updates either so you might have to dig deeper into the code). If you don't mind having another extension which could be doing nefarious things.

Thanks, it's better than nothing at least. [Rant: the whole concept of auto-update-by-default is stupid. /Rant]

If there was something like »Updates for your extensions are available, install them now?« would it really help or would most users just say »yes«? They'd have no way of verifying that the update is benign or not anyway.

Re: The "Window Resizer" extension for Chrome now contains malware (2013)

#47

Post by gorhill »

silverlight wrote: post #23

Whoa, wait. One guy in this thread is claiming that Window Resizer was sending all your keystrokes back to a central server based on what he saw in Wireshark. Can anyone else verify this? I've had this extension installed for...a year, at least. Do I need to now go change every single password on every site because chances are it's been keylogged? This is insane.

I wrote an extension (HTTP Switchboard) which can log and filter behind-the-scene requests, which also comprise net requests made by extensions. I suppose this could be used to validate that an extension connects to a remote server. In any case, it can be set to selectively block/allow net traffic of extensions.

Even without this extension, it is possible to open the dev console of a specific extension and look at the detailed net traffic of a specific extension in the network tab. Somewhat simpler than running wireshark, so more within reach of the average user.

Re: The "Window Resizer" extension for Chrome now contains malware (2013)

#48

Post by derleth3 »

hendersoon wrote: post #5
miles wrote: post #2

The linked discussion is back from mid-December and the extension has been removed from the Chrome Web Store: https://chrome.google.com/webstore/detail/window-resizer/kke...

Smooth Gestures (lfkgmnnajiljnolcgolmmgnecgldgeld) has done the same thing for well over a year now. I (and many others) reported the addon to Google, but it still remains. What does it take to get something like this removed?

> Smooth Gestures (lfkgmnnajiljnolcgolmmgnecgldgeld)

What in the world does the part in parentheses refer to?

Re: The "Window Resizer" extension for Chrome now contains malware (2013)

#49

Post by tmikaeld »

When developing my first Chrome Extension, it didn't take me long until i got the thought of "keylogging might be possible".

So i tried it, and sure - i was even able to replace password logins in the DOM with fake ones.

Firefox extensions does the same thing really, so now i only use a few "safe" extensions.

I'm surprised that this hasen't gotten more attention.

Re: The "Window Resizer" extension for Chrome now contains malware (2013)

#50

Post by charlesism »

iamartnez wrote: post #3

Since Chrome auto-updates extensions, users are likely not aware of this change. I've been using the extension for several months until I noticed the transparent redirection. In fact, the only reason I noticed the redirect is when it failed. I clicked on a Google search result and got stuck on a blank page like this: http://ecolink3.ecosia.org/?key=3cdcd4dc082e3c7b860abe4608b6925d&out=http%3A%2F%2Fwww.usatoday.com%2F…

Google made a big mistake by not including a GUI option to manageme auto-updates. I write an extension that interacts with data on a financial website, and this policy of forcing automatic updates on all extensions is dangerous. It means I can not guarantee my users my extension is 100% safe, even if they audit its javascript files, because if I were a bad guy, I would still have the power to update the code in the dead of night. It's not very attractive to tell users they can only protect themselves if they both understand javascript, and also dig through files to manually disable auto-updates.
Post reply on HN