Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The "Window Resizer" extension for Chrome now contains malware (2013)

productforums.google.com

Post reply on HN
Print view View original

51–60 of 124 posts

Re: The "Window Resizer" extension for Chrome now contains malware (2013)

#51

Post by wfunction »

ygra wrote: post #46
wfunction wrote: post #35

Earlier quoted context omitted.

Thanks, it's better than nothing at least. [Rant: the whole concept of auto-update-by-default is stupid. /Rant]

If there was something like »Updates for your extensions are available, install them now?« would it really help or would most users just say »yes«? They'd have no way of verifying that the update is benign or not anyway.

It should be more like "Updates for your extensions are available; they will be installed when Chrome is restarted. [OK] [Cancel automatic updates]".

Or basically anything that gives you the option to avoid doing so.

Re: The "Window Resizer" extension for Chrome now contains malware (2013)

#53

Post by onli »

silverlight wrote: post #28
Svip wrote: post #25

Earlier quoted context omitted.

The developer also seems to claim that the keylogger exists as well. If you want to take his word for it as well.

I just can't even fathom. Like, every email I've typed. Every interaction with any site. Credit card numbers. How is this not entirely illegal? And it certainly shows an incredible flaw in Chrome extensions. This extension didn't do this when I installed it. A silent auto-update though basically turned it into the worst malware I've ever had installed on my computer. How can any Chrome extension ever be trusted? Furt…

> How is this not entirely illegal?

Depending on where you live, this might very well be illegal. Unauthorized access and recording of private information of an IT-System is covered in some hacking parapgraphs, in the US and the EU (in the EU maybe as part of the cyber attack tools, as the keylogger would have recorded passwords).

Re: The "Window Resizer" extension for Chrome now contains malware (2013)

#54

Post by TheAcen »

timmclean wrote: post #52

I'm most concerned about the keylogging claims. Does anyone have a copy of the CRX so that we can determine if keystrokes were in fact being transmitted?

Seems as though he's aware of such a thing.

"No, that's bundled adware. If I wanted to give you malware, I would have added a keylogger which you wouldn't have ever discovered (ask around; it's technically possible). So stop whining already, uninstall the extension and move on with your life!" http://productforums.google.com/d/msg/chrome/mlAD1ygc0v0/FL6...

(Also, he's now posting on the linked thread. 7 minutes ago last reply.)

Re: The "Window Resizer" extension for Chrome now contains malware (2013)

#55

Post by tokenizerrr »

userbinator wrote: post #33
Svip wrote: post #25

Earlier quoted context omitted.

The developer also seems to claim that the keylogger exists as well. If you want to take his word for it as well.

What are Chrome extensions written in? I don't use Chrome but if it's JS then it wouldn't be difficult to verify these claims.

It isn't. You can just download the crx, unzip it and go to town. You can acquire the crx by downloading it from https://clients2.google.com/service/update2/crx?response=red... (replace the EXTENSIONIDHERE)

Re: The "Window Resizer" extension for Chrome now contains malware (2013)

#56

Post by timmclean »

TheAcen wrote: post #54
timmclean wrote: post #52

I'm most concerned about the keylogging claims. Does anyone have a copy of the CRX so that we can determine if keystrokes were in fact being transmitted?

Seems as though he's aware of such a thing. "No, that's bundled adware. If I wanted to give you malware, I would have added a keylogger which you wouldn't have ever discovered (ask around; it's technically possible). So stop whining already, uninstall the extension and move on with your life!" http://productforums.google.com/d/msg/chrome/mlAD1ygc0v0/FL6... (Also, he's now posting on the linked thread. 7 minutes ago l…

> I would have added a keylogger

seems to imply that he was not logging keystrokes, which conflicts directly with the first post in that thread:

> they are tracking all data and keystrokes. checked with wireshark.

It'd be nice to have a copy so that we can find out for ourselves.

Re: The "Window Resizer" extension for Chrome now contains malware (2013)

#57

Post by gokulk »

silverlight wrote: post #23

Whoa, wait. One guy in this thread is claiming that Window Resizer was sending all your keystrokes back to a central server based on what he saw in Wireshark. Can anyone else verify this? I've had this extension installed for...a year, at least. Do I need to now go change every single password on every site because chances are it's been keylogged? This is insane.

I googled the problem and opted out ecoasia from the extension settings when i noticed my urls getting redirected everytime. but i had no idea that the extensions can 'Access all data on all the websites'. now I notice most of my extensions like web developer, page ruler, web font previewer have this permissions. need further clarification from the chrome team as to what this exactly is. passwords? credit card numbers? can also be accessed by the extensions?

Re: The "Window Resizer" extension for Chrome now contains malware (2013)

#60

Post by [deleted] »

gokulk wrote: post #57
silverlight wrote: post #23

Whoa, wait. One guy in this thread is claiming that Window Resizer was sending all your keystrokes back to a central server based on what he saw in Wireshark. Can anyone else verify this? I've had this extension installed for...a year, at least. Do I need to now go change every single password on every site because chances are it's been keylogged? This is insane.

I googled the problem and opted out ecoasia from the extension settings when i noticed my urls getting redirected everytime. but i had no idea that the extensions can 'Access all data on all the websites'. now I notice most of my extensions like web developer, page ruler, web font previewer have this permissions. need further clarification from the chrome team as to what this exactly is. passwords? credit card number…

[deleted]
Post reply on HN