5 ms·

A big problem is also with unmaintained extensions that are being bought my malicious players (or developers' accounts hijacked), which then slap on an adware s

A big problem is also with unmaintained extensions that are being bought my malicious players (or developers' accounts hijacked), which then slap on an adware script and push a new version. That way, a previously good extension with a legitimate reason for "accessing your data on all websites" can silently become malicious.

Animats 10y ago
Yes. Mozilla also allows that, which is really sleazy for Mozilla.
- michaelbuckbee 10y ago
  It's a hard problem as many extensions do the equivalent of loading in a script from a remote site as part of their start -up process (consider an adblocker that regularly pulls down and updates list of ad definitions). You could imagine that a malicious company would put through a "clean" version for testing and then once approved swap the script for the one loading malware.
- Sylos 10y ago
  Uhm, Mozilla does a code review of every extension or update to an extension before it gets published on AMO, so it should hardly be possible for a malicious third party to do malicious things...
  - Animats 10y ago
    There's an outfit called WIPS which buys up abandoned Firefox add-ons and puts adware and spyware in them.[1] BlockSite [2] is an example. This was approved by Mozilla AMO.[3] [1] http://www.ghacks.net/2013/03/12/mozilla-needs-a-new-audit-process-in-regards-to-add-on-ownership-changes/ http://www.ghacks.net/2013/03/12/mozilla-needs-a-new-audit-p... [2] https://addons.mozilla.org/en-US/firefox/addon/blocksite/reviews/?page=3 https://addons.mozilla.org/en-US/firefox/addon/blocksite/rev... [3] https://bugzilla.mozilla.org/show_bug.cgi?id=903799 https://bugzilla.mozilla.org/show_bug.cgi?id=903799
- rhelmer 10y ago
  I don't think it's sleazy, while Mozilla does review all add-ons, it's hard to restrict what an extension right now since they can access internal APIs and there isn't really a permission system to speak of. Additionally, JS is a dynamic language so it's difficult to provide adequate automated scanning for malicious intent. Even so, extension authors can be quite clever in how they hide malicious behavior, especially if there's financial reward involved. WebExtensions (https://wiki.mozilla.org/WebExtensions https://wiki.mozilla.org/WebExtensions) add a permission system, have a much smaller attack surface, and should help to alleviate this problem. This combined with automated scanning + human review and For Chrome, I think Google prefers a combination of automated scanning and quick response, without upfront human review (based on https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/43824.pdf https://static.googleusercontent.com/media/research.google.c...)
- lorenzhs 10y ago
  Google deletes them fairly quickly, at least the couple of times I heard of these things or removed them from friends'/colleagues' computers they were already gone from the Chrome Web Store. That Mozilla bug you linked in another comment reads like an awfully misguided application of policy. One of these extensions I came across automatically closed about:extensions every time I opened it to prevent uninstallation. Eventually went through the chrome task manager, killing extensions one by one until I found the right one by trial and error. Very frustrating to debug.

Animats 10y ago

Yes. Mozilla also allows that, which is really sleazy for Mozilla.

michaelbuckbee 10y ago
It's a hard problem as many extensions do the equivalent of loading in a script from a remote site as part of their start -up process (consider an adblocker that regularly pulls down and updates list of ad definitions). You could imagine that a malicious company would put through a "clean" version for testing and then once approved swap the script for the one loading malware.
Sylos 10y ago
Uhm, Mozilla does a code review of every extension or update to an extension before it gets published on AMO, so it should hardly be possible for a malicious third party to do malicious things...
- Animats 10y ago
  There's an outfit called WIPS which buys up abandoned Firefox add-ons and puts adware and spyware in them.[1] BlockSite [2] is an example. This was approved by Mozilla AMO.[3] [1] http://www.ghacks.net/2013/03/12/mozilla-needs-a-new-audit-process-in-regards-to-add-on-ownership-changes/ http://www.ghacks.net/2013/03/12/mozilla-needs-a-new-audit-p... [2] https://addons.mozilla.org/en-US/firefox/addon/blocksite/reviews/?page=3 https://addons.mozilla.org/en-US/firefox/addon/blocksite/rev... [3] https://bugzilla.mozilla.org/show_bug.cgi?id=903799 https://bugzilla.mozilla.org/show_bug.cgi?id=903799
rhelmer 10y ago
I don't think it's sleazy, while Mozilla does review all add-ons, it's hard to restrict what an extension right now since they can access internal APIs and there isn't really a permission system to speak of. Additionally, JS is a dynamic language so it's difficult to provide adequate automated scanning for malicious intent. Even so, extension authors can be quite clever in how they hide malicious behavior, especially if there's financial reward involved. WebExtensions (https://wiki.mozilla.org/WebExtensions https://wiki.mozilla.org/WebExtensions) add a permission system, have a much smaller attack surface, and should help to alleviate this problem. This combined with automated scanning + human review and For Chrome, I think Google prefers a combination of automated scanning and quick response, without upfront human review (based on https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/43824.pdf https://static.googleusercontent.com/media/research.google.c...)
lorenzhs 10y ago
Google deletes them fairly quickly, at least the couple of times I heard of these things or removed them from friends'/colleagues' computers they were already gone from the Chrome Web Store. That Mozilla bug you linked in another comment reads like an awfully misguided application of policy. One of these extensions I came across automatically closed about:extensions every time I opened it to prevent uninstallation. Eventually went through the chrome task manager, killing extensions one by one until I found the right one by trial and error. Very frustrating to debug.