Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Using fake reviews to find dangerous extensions

krebsonsecurity.com

Post reply on HN
Print view View original

81–90 of 105 posts

Re: Using fake reviews to find dangerous extensions

#81

Post by deckard1 »

user-the-name wrote: post #40
Jverse wrote: post #5

Earlier quoted context omitted.

Everyone's use case is different. There are definitely a lot of very useful extensions available.

Of course there are, but the point is, you can not really trust any of them. Today they will be very useful, tomorrow they may be malware, and there is no way for you to know or protect yourself.

This is true of anything you find on github as well.

Open source works on the idea that "given enough eyeballs, all bugs are shallow." The thing people forget is the "enough eyeballs" part. As if people are sitting around auditing every sub-dependency of a sub-dependency of React.

In addition, I don't know of any package repository that requires the authoritative source[1] from github to match the compiled/minified/etc. package that is uploaded and published. And I suspect most repos are vulnerable to this.

There are many popular but unloved packages out there.

[1] I'd also point out how incredibly stupidly dangerous it is that the open source community has basically given Microsoft the keys to be the authoritative source for all of open source. No one has learned a damn thing. And, somewhat ironically, Microsoft buying out an entire user base for their own nefarious purposes really fits the topic at hand.

Re: Using fake reviews to find dangerous extensions

#82

Post by trutannus »

kortilla wrote: post #67
trutannus wrote: post #55

Earlier quoted context omitted.

One approach would be to intercept your own traffic with Fiddler as a proxy for a few hours after installing and look for any nefarious requests. This is a pretty effective way to run a basic security audit.

Only effective against ones that don’t have activation criteria.

Yep, but it's a good start. Why I called it a "basic audit".

Re: Using fake reviews to find dangerous extensions

#83

Post by gorhill »

ant6n wrote: post #61
rand0mx1 wrote: post #54

Earlier quoted context omitted.

You can follow ublock origin subreddit

You'd think that download links would be prominently feautured on subreddit, but its not the case: https://www.reddit.com/r/uBlockOrigin/

The official "home" of uBlock Origin is the GitHub repo[1], you will find all the correct information there.

[1] https://github.com/gorhill/uBlock

Re: Using fake reviews to find dangerous extensions

#84

Post by namrog84 »

xingyzt wrote: post #23
macNchz wrote: post #18

Earlier quoted context omitted.

Five years ago I had a whole bunch of extensions, but that ended whenever it was that I first learned that there were bad actors buying legitimate extensions from their developers and filling them with malware. After that I dramatically reduced the number I had installed, down to basically a password manager and ublock origin. The brief install-time vetting I used to do would would do nothing to prevent an auto updat…

Can confirm. As a dev of an extension with 10k users I get 3-4 emails a month in my spam which ask me to monetize my extension by secretly changing its users' search engines. My extension is open-source and quite small, but if the change was sneaked in I think most of the users would not notice. I stick to using userscripts for the most part since you can easily check their downloaded source and disable updates. Exam…

Open source doesn't solve it completely.. What you have in repo and what is published doesn't have to be the same thing. Unless people are doing the extra effort to compare them, which is extremely rare unless its quite popular. I've seen this happen a few times.

Re: Using fake reviews to find dangerous extensions

#85

Post by fendy3002 »

Jverse wrote: post #5
the_local_host wrote: post #4

I'm surprised anyone ever installs browser extensions, given how many malicious extensions exist, and how intrusive they are whether malicious or not.

Everyone's use case is different. There are definitely a lot of very useful extensions available.

Indeed, it's more required if you're a web developer. Extension to capture whole screen (including scrolled screen), color picker, ruler, even magnifying glass are the ones I usually use.

Re: Using fake reviews to find dangerous extensions

#86

Post by gnicholas »

extesy wrote: post #22

> In other words, there a great many developers who are likely to be open to someone else buying up their creation along with their user base. As a maintainer of a relatively popular extension (hoverzoom+, ~360K users) I get business offers all the time [1]. A few of them are pretty good, actually. I'm not surprised that some developers eventually give up and take one of those offers. But I am surprised that there ar…

The Hover Zoom extension I'm seeing in the Chrome Store [1] refers to a prior version that was overrun by malware and removed from the store.

> This is an open source version of the original HoverZoom extension which is now overrun by malware and deleted from store. In this version all spyware has been removed, many bugs were fixed and new features were added.

Were you involved with the project when that all went down?

1: https://chrome.google.com/webstore/detail/hover-zoom%20/pccc...

Re: Using fake reviews to find dangerous extensions

#87

Post by dang »

extesy wrote: post #22

> In other words, there a great many developers who are likely to be open to someone else buying up their creation along with their user base. As a maintainer of a relatively popular extension (hoverzoom+, ~360K users) I get business offers all the time [1]. A few of them are pretty good, actually. I'm not surprised that some developers eventually give up and take one of those offers. But I am surprised that there ar…

Related current thread based on that link:

Many temptations of an open-source Chrome extension developer - https://news.ycombinator.com/item?id=27327892

Re: Using fake reviews to find dangerous extensions

#88

Post by alphabet9000 »

I have a chrome extension with about 30k users and have always felt like the chrome web store feels sketchy and frankly dangerous. Particularly when dealing with extensions that offer highly desired features on hugely popular sites, e.g. 'download all images off a user's Instagram'. It's ripe for abuse, especially luring in hundreds of thousands of users when the extension is 'fine' then switching over to something not fine.

There are two things that I think would be beneficial: allowing users to easily disable the extension from automatically updating, and allow users to be able to see the source code of the extension directly in the chrome web store. I hope they already have some kind of internal monitoring system for their reviews to set off an internal alert if someone says 'malware' etc and to investigate further.

Re: Using fake reviews to find dangerous extensions

#89

Post by sunsipples »

xingyzt wrote: post #23
macNchz wrote: post #18

Earlier quoted context omitted.

Five years ago I had a whole bunch of extensions, but that ended whenever it was that I first learned that there were bad actors buying legitimate extensions from their developers and filling them with malware. After that I dramatically reduced the number I had installed, down to basically a password manager and ublock origin. The brief install-time vetting I used to do would would do nothing to prevent an auto updat…

Can confirm. As a dev of an extension with 10k users I get 3-4 emails a month in my spam which ask me to monetize my extension by secretly changing its users' search engines. My extension is open-source and quite small, but if the change was sneaked in I think most of the users would not notice. I stick to using userscripts for the most part since you can easily check their downloaded source and disable updates. Exam…

"You are might curious to know if it is allowed? And I must say that this is completely allowed!"

I feel like this would make a great corporate logo for a discount legal firm on It's Always Sunny In Philadelphia that Charlie would start when high on Elmer's glue.

Re: Using fake reviews to find dangerous extensions

#90

Post by extesy »

gnicholas wrote: post #86
extesy wrote: post #22

> In other words, there a great many developers who are likely to be open to someone else buying up their creation along with their user base. As a maintainer of a relatively popular extension (hoverzoom+, ~360K users) I get business offers all the time [1]. A few of them are pretty good, actually. I'm not surprised that some developers eventually give up and take one of those offers. But I am surprised that there ar…

The Hover Zoom extension I'm seeing in the Chrome Store [1] refers to a prior version that was overrun by malware and removed from the store. > This is an open source version of the original HoverZoom extension which is now overrun by malware and deleted from store. In this version all spyware has been removed, many bugs were fixed and new features were added. Were you involved with the project when that all went dow…

No, that was a different developer.
Post reply on HN