Haha that's so funny. The developer has involved in the discussion and he is seriously defending himself. What is wrong with him lol.
The "Window Resizer" extension for Chrome now contains malware (2013)
61–70 of 124 posts
Re: The "Window Resizer" extension for Chrome now contains malware (2013)
#62Earlier quoted context omitted.
I just can't even fathom. Like, every email I've typed. Every interaction with any site. Credit card numbers. How is this not entirely illegal? And it certainly shows an incredible flaw in Chrome extensions. This extension didn't do this when I installed it. A silent auto-update though basically turned it into the worst malware I've ever had installed on my computer. How can any Chrome extension ever be trusted? Furt…
A chrome extension can make network connections that you won't (normally) see in Dev Tools using a background page. You'll see the connections if you inspect the background page directly but most users won't. Unfortunately this is simply a byproduct of the web's (and browsers') botched security model; there is no way to allow extensions to modify pages without them being able to read the pages, and if they can read t…
Pop fiddler on your machines and look for yourselves.
Re: The "Window Resizer" extension for Chrome now contains malware (2013)
#63Monday started with a massive WTF ;)
Re: The "Window Resizer" extension for Chrome now contains malware (2013)
#64When developing my first Chrome Extension, it didn't take me long until i got the thought of "keylogging might be possible". So i tried it, and sure - i was even able to replace password logins in the DOM with fake ones. Firefox extensions does the same thing really, so now i only use a few "safe" extensions. I'm surprised that this hasen't gotten more attention.
Now I have to wonder... What permissions do Firefox extensions have? How do I check or verify these things?
Re: The "Window Resizer" extension for Chrome now contains malware (2013)
#65When developing my first Chrome Extension, it didn't take me long until i got the thought of "keylogging might be possible". So i tried it, and sure - i was even able to replace password logins in the DOM with fake ones. Firefox extensions does the same thing really, so now i only use a few "safe" extensions. I'm surprised that this hasen't gotten more attention.
I'm pretty judicious when trying extensions... but really only use a handful of them.
Re: The "Window Resizer" extension for Chrome now contains malware (2013)
#66Earlier quoted context omitted.
That is interesting. It could be criticism of the existing system. Or he could have other goals/intentions.
He asks specifically if he has broken some rules in Google Chrome's terms of service, where another user replies with quotations from the ToS. He barks at that saying his extension is allowed to do what he does, because his extension does reveal exactly what it does, if you read its permissions carefully. Although, I cannot confirm whether that is true, but that's what he is saying. I have no idea what he is up to; b…
He does indicate the user gives the OK to 'access all data on all websites' - like most extensions do, come to think of it. I do think things like that should be more fine-grained, and/or that developers have to indicate /why/ they need that access.
Re: The "Window Resizer" extension for Chrome now contains malware (2013)
#67Whoa, wait. One guy in this thread is claiming that Window Resizer was sending all your keystrokes back to a central server based on what he saw in Wireshark. Can anyone else verify this? I've had this extension installed for...a year, at least. Do I need to now go change every single password on every site because chances are it's been keylogged? This is insane.
I googled the problem and opted out ecoasia from the extension settings when i noticed my urls getting redirected everytime. but i had no idea that the extensions can 'Access all data on all the websites'. now I notice most of my extensions like web developer, page ruler, web font previewer have this permissions. need further clarification from the chrome team as to what this exactly is. passwords? credit card number…
Pretty much, yeah. The 'access all data on all websites' permission basically gives the extension access to injecting Javascript in all of your pages, which gives the extension full access to the DOM, and thus access to password and credit card fields.
Re: The "Window Resizer" extension for Chrome now contains malware (2013)
#68Earlier quoted context omitted.
I would. Why wouldn't you?
I would, but that then means that the chrome web store is riddled with malware which isn't a nice thought and doesn't bode well for its future as something that is supposed to be more secure than traditional native platforms.
Considering that Google search result ads are riddled with malware* and Google AdSense ads are riddled with malware and that Google Play has numerous ongoing issues with Android malware, I don't think it's really surprising that the Google Chrome Extensions store is also riddled with malware.
* Which my mother confirmed JUST THIS WEEKEND by searching Google for Firefox and Spider Solitaire clicking one of the Google ads up top for each to get the download and... 2 hours of cleaning later and removing 18 different malware apps. Then just deciding it was faster to restore it to a factory image.
* * Which I'm trying to block one by one using the pitiful tools that Google makes available to block individual adsense advertisers.
Re: The "Window Resizer" extension for Chrome now contains malware (2013)
#69Earlier quoted context omitted.
The developer also seems to claim that the keylogger exists as well. If you want to take his word for it as well.
Where did you see that from the author?
Technically, he is quoted by another poster further up in the discussion. But the developer does not deny this quote.
Re: The "Window Resizer" extension for Chrome now contains malware (2013)
#70When developing my first Chrome Extension, it didn't take me long until i got the thought of "keylogging might be possible". So i tried it, and sure - i was even able to replace password logins in the DOM with fake ones. Firefox extensions does the same thing really, so now i only use a few "safe" extensions. I'm surprised that this hasen't gotten more attention.
Now I have to wonder... What permissions do Firefox extensions have? How do I check or verify these things?
Firefox extensions have the same permissions as browser itself.