7 ms·

Adobe angers Chrome users by bundling browser plugin with security update

224 points by ckrailo 10y ago

kylec 10y ago
At this point, browsers should block all plugins not explicitly installed through the browser. I can't think of any circumstances in which I would be happy to find that some software I installed has automatically installed a browser plugin.
- zeta0134 10y ago
  Chrome, to its credit, doesn't automatically load extensions that are installed this way. (Or at least it shouldn't; I've seen enough malicious Chrome extensions in my tech support years that I suspect there's a way to bypass this prompt.) That doesn't excuse the practice though; no software update should install additional features without the user's consent, and this is a practice that seems to be all too common in the industry.
  - dawnerd 10y ago
    It's pretty easy to open up a webpage that says "install this extension to finish installation" or update or what have you. Simple fact is, most computer users are not very tech savvy and will trust what their computers tell them if it looks official enough - especially if it's from a major player like Adobe.
  - deleted 10y ago
    [deleted]
  - captn3m0 10y ago
    I'd presented a short talk on bypassing the prompts in both Chrome and Firefox a few years ago (2013), and it was possible by just recreating the appropriate registry entries for Windows and few changes in preferences.json. Was slightly easier for Firefox (few entries in SQLite, iirc). However both browsers lock the data stored, so you had to force a restart as well.
    - scarlac 10y ago
      How could a browser protect itself from being "infected" from the underlying OS layer? Given that the malicious installer has administrative access, it's a hole new set of challenges if they can't trust their own filesystem.
      - captn3m0 10y ago
        It really can't, at the end of the day, which was the major point raised during the QA. Also, you don't need Admin rights, seeing as Chrome installation works without admin rights, and all user data is maintained on a user-directory structure.
        Klathmon 10y ago
        Which is why chrome is moving toward a policy of only allowing web store extensions, end of story. It sucks, and nobody is happy with it, but at the end of the day it's the only thing that seems to be working.
        throwaway7767 10y ago
        I expect to see these same companies try ever more fragile and bad methods to bypass these restrictions. If chrome refuses to load extensions from disk, they'll inject themselves into the process address space somewhere, which as a bonus will likely introduce sandbox escape vulnerabilities. This is what the AV vendors are doing these days.
        Klathmon 10y ago
        They already try to do that. Hell some have even gone as far as to remove chrome, and install their own "infected" chromium compiled with their extension whitelisted and updates disabled. It's terrifying. And while you could make a case for this "not being chrome's problem", the fact is that it's really hurting their user base, so they can't not do something about it.
- gsnedders 10y ago
  The problem is how do you distinguish plugins installed through the browser versus not: at the end of the day, this falls into the typical DRM problem of how do you enforce restrictions (in this case, what can install plugins). The direction browsers are all taking is requiring them to be signed by the browser vendor, effectively making them gatekeepers (and you can't have a preference to disable it, because if you did you could just install a plugin by disabling the preference (i.e., edit the config file) and then install the plugin normally). That really sucks too, sadly.
  - deleted 10y ago
    [deleted]
  - epistasis 10y ago
    The alternative to DRM would be OS level sandboxing of applications, and particularly their installs. There are a multitude of benefits that would come from that.
Esau 10y ago
"The extension also collects basic information and sends this to Adobe. This tracking appears to be on by default, though it can be disabled through the extension's options page." Another company collecting telemetry that you have to opt-out of. This needs to be illegal because often, by the time most people learn of the option, their information has already been snarfed.
- pawadu 10y ago
  Does anyone know if they collect data for everything you do or just when you open a PDF file?
  - huffmsa 10y ago
    Assume it's everything, because why wouldn't it be? They can't upsell you if they only track your usage of existing products.
jimjimjim 10y ago
Jeeze adobe, try digging up.
jamesgaston 10y ago
I have a vague recollection of an incident, years ago, whereby Adobe installed Macafee whenever you installed a flash update. There was a little checkbox to control this, but it was checked by default. Pissed me off, i had get macafee off my computer pronto as it didn't get along with the anti virus i had already installed.
- adobeemp23 10y ago
  Yup. There was a huge internal commotion about this on our employee only general mailing list. The person who reported it was very shrewd, reporting the behavior as an open ended performance question. Employees in the Bay Area inmediately hated it. A VP had to step in and stop the discussion because it was happening in spite of our collective objection.
- solnyshok 10y ago
  they still do it
- pjmlp 10y ago
  It still happens. They "suggest" by default to try out Macafee and Intel True Store (not sure about the name).
Falkon1313 10y ago
> The plugin seeks permission to do three things; "read and change all data on the websites you visit," "manage your downloads," and "communicate with cooperating native applications." [...] > it's likely that the extension itself is harmless enough That seems unlikely given Adobe's history of truly awful security flaws. It wasn't that long ago when they thought that it would be a good idea for their add-on to pre-render PDFs in RAM silently in the background, including executing any embedded code without any sandboxing. Combined with browsers' prefetching of urls in a page (so that it would load quicker in case you clicked it), this caused a number of rootkit and other malware infections - from links that people didn't even click in search results and URLs served up in advertising or in comments/forum posts. The only permission needed by a PDF viewer should be 'display PDF document content'. It shouldn't need to read or change other data, manage downloads, or communicate with anything to display an e-book or document. If it does, it's probably not harmless.
- fpgeek 10y ago
  I'm not saying the permission request isn't overbroad, but "manage downloads" seems potentially reasonable. I'd imagine that some permission along those lines would be required for a PDF viewer to start displaying a document before it is completely downloaded. Now I don't know that that is what they were using it for, whether they could have made a narrower permission request, and so on, but permissions are permissions because we want to permit them some of the time. I think it is counterproductive to dismiss requests before evaluating them. That's the kind of behavior that leads to kitchen-sink permission requests from the start (when users are most motivated to try something) because a developer doesn't trust that they'll get a reasonable targeted request tomorrow.
showmerunner 10y ago
"Fake news!" -Adobe
natch 10y ago
Meanwhile, in the same ethical bucket, Oracle as recently as a week ago is adding a Yahoo! toolbar to your browser when you update Java, unless you uncheck their pre-checked opt-in checkbox. Sigh.
- seanp2k2 10y ago
  The scary things that happen when as a company, "hey, it's not like our users could possibly hate us more!" is true...and you're doing well financially for long periods of time.
  - PeterisP 10y ago
    There's no contradiction when the overlap between 'users' and 'customers' is as small as in the Oracle Java situation.
    - ReverseCold 10y ago
      Which is why I'm so glad openjdk for Windows has a clean installer now. Malware free installer, works identically to the Oracle version performance wise (according to me, no real tests done), etc.
- sbuttgereit 10y ago
  My recollection is that this behavior in the Java updater actually pre-dates Oracle's acquisition of Sun. I think at one time it was for a different toolbar ('Ask!' maybe)... but it's not new by any means. Having said that, of course just because Sun may have started the practice doesn't mean Oracle gets a pass for merely continuing it.... unless there was some long, long terms sort of contractual things: which I highly doubt.
- reustle 10y ago
  Don't worry, Yahoo! (Altaba?) probably won't be pushing the toolbar for much longer :)
  - 10y ago
peteretep 10y ago
Someone really really needs to fix browser plugin permission system so that control can be very very fine-grained, and it's easy to review what information has been passed back and forth.
- Noseshine 10y ago
  Yeah, but only about 5% of users are going to benefit from such a feature.
caconym_ 10y ago
My mom was a bit upset when I told her she couldn't install Adobe or Oracle software on her new computer (iMac) a few years ago, but today the thing still runs like it just came out of the box. Do the right thing, and tell your family and friends to stay away from this malware.
- deleted 10y ago
  [deleted]
Traubenfuchs 10y ago
I really wonder how it feels to create user-hostile software like that that is borderline malicious and barely adds any value.
- crispyambulance 10y ago
  That's an interesting question. There was a good thread here on exactly that (https://news.ycombinator.com/item?id=11806739 https://news.ycombinator.com/item?id=11806739) a while back. It was a Backchannel story about an "adtech" company in Philly: "The Perks Are Great. Just Don’t Ask Us What We Do." Basically, a surprisingly large number of employees don't know or don't care about the ethics of what a small number of leaders in their company do. Others justify such actions to themselves in convoluted ways. Only a small number truly can't deal with it.
robin_reala 10y ago
Given that Chrome itself was often bundled with Adobe Flash and Reader security updates I’m not sure they’ve got much of a case. https://forums.adobe.com/thread/1053973 https://forums.adobe.com/thread/1053973
huffmsa 10y ago
My current beef with Adobe is that they took a perfectly good mobile version of Photoshop for Android, broke it into 5 separate applications, that when combined, don't even reach the full functionality of the application they are replacing. Oh and they're each the size of the original app. Who signs off on this?
- pawadu 10y ago
  The management was probably given a bonus for expanding their mobile presence five-fold between 2015 and 2016 :)
bostand 10y ago
Isn't this against the chrome ToS? Can Google retaliate by removing their extension from the store?
- crispyambulance 10y ago
  Perhaps they can be persuaded if enough people report it as abuse. There's an option to do that when you remove extensions.
ksk 10y ago
Well, do the users know that Chrome itself sends a bunch of data to Google? On principle, I consider both Adobe and Google's practices to be abhorrent, but practically speaking Google definitely has the better record on product reliability and security.

224 points by ckrailo 10y ago

kylec 10y ago

At this point, browsers should block all plugins not explicitly installed through the browser. I can't think of any circumstances in which I would be happy to find that some software I installed has automatically installed a browser plugin.

zeta0134 10y ago
Chrome, to its credit, doesn't automatically load extensions that are installed this way. (Or at least it shouldn't; I've seen enough malicious Chrome extensions in my tech support years that I suspect there's a way to bypass this prompt.) That doesn't excuse the practice though; no software update should install additional features without the user's consent, and this is a practice that seems to be all too common in the industry.
- dawnerd 10y ago
  It's pretty easy to open up a webpage that says "install this extension to finish installation" or update or what have you. Simple fact is, most computer users are not very tech savvy and will trust what their computers tell them if it looks official enough - especially if it's from a major player like Adobe.
- deleted 10y ago
  [deleted]
- captn3m0 10y ago
  I'd presented a short talk on bypassing the prompts in both Chrome and Firefox a few years ago (2013), and it was possible by just recreating the appropriate registry entries for Windows and few changes in preferences.json. Was slightly easier for Firefox (few entries in SQLite, iirc). However both browsers lock the data stored, so you had to force a restart as well.
  - scarlac 10y ago
    How could a browser protect itself from being "infected" from the underlying OS layer? Given that the malicious installer has administrative access, it's a hole new set of challenges if they can't trust their own filesystem.
    - captn3m0 10y ago
      It really can't, at the end of the day, which was the major point raised during the QA. Also, you don't need Admin rights, seeing as Chrome installation works without admin rights, and all user data is maintained on a user-directory structure.
      - Klathmon 10y ago
        Which is why chrome is moving toward a policy of only allowing web store extensions, end of story. It sucks, and nobody is happy with it, but at the end of the day it's the only thing that seems to be working.
        throwaway7767 10y ago
        I expect to see these same companies try ever more fragile and bad methods to bypass these restrictions. If chrome refuses to load extensions from disk, they'll inject themselves into the process address space somewhere, which as a bonus will likely introduce sandbox escape vulnerabilities. This is what the AV vendors are doing these days.
        Klathmon 10y ago
        They already try to do that. Hell some have even gone as far as to remove chrome, and install their own "infected" chromium compiled with their extension whitelisted and updates disabled. It's terrifying. And while you could make a case for this "not being chrome's problem", the fact is that it's really hurting their user base, so they can't not do something about it.
gsnedders 10y ago
The problem is how do you distinguish plugins installed through the browser versus not: at the end of the day, this falls into the typical DRM problem of how do you enforce restrictions (in this case, what can install plugins). The direction browsers are all taking is requiring them to be signed by the browser vendor, effectively making them gatekeepers (and you can't have a preference to disable it, because if you did you could just install a plugin by disabling the preference (i.e., edit the config file) and then install the plugin normally). That really sucks too, sadly.
- deleted 10y ago
  [deleted]
- epistasis 10y ago
  The alternative to DRM would be OS level sandboxing of applications, and particularly their installs. There are a multitude of benefits that would come from that.

Esau 10y ago

"The extension also collects basic information and sends this to Adobe. This tracking appears to be on by default, though it can be disabled through the extension's options page." Another company collecting telemetry that you have to opt-out of. This needs to be illegal because often, by the time most people learn of the option, their information has already been snarfed.

pawadu 10y ago
Does anyone know if they collect data for everything you do or just when you open a PDF file?
- huffmsa 10y ago
  Assume it's everything, because why wouldn't it be? They can't upsell you if they only track your usage of existing products.

jimjimjim 10y ago

Jeeze adobe, try digging up.

jamesgaston 10y ago

I have a vague recollection of an incident, years ago, whereby Adobe installed Macafee whenever you installed a flash update. There was a little checkbox to control this, but it was checked by default. Pissed me off, i had get macafee off my computer pronto as it didn't get along with the anti virus i had already installed.

adobeemp23 10y ago
Yup. There was a huge internal commotion about this on our employee only general mailing list. The person who reported it was very shrewd, reporting the behavior as an open ended performance question. Employees in the Bay Area inmediately hated it. A VP had to step in and stop the discussion because it was happening in spite of our collective objection.
solnyshok 10y ago
they still do it
pjmlp 10y ago
It still happens. They "suggest" by default to try out Macafee and Intel True Store (not sure about the name).

Falkon1313 10y ago

> The plugin seeks permission to do three things; "read and change all data on the websites you visit," "manage your downloads," and "communicate with cooperating native applications." [...] > it's likely that the extension itself is harmless enough That seems unlikely given Adobe's history of truly awful security flaws. It wasn't that long ago when they thought that it would be a good idea for their add-on to pre-render PDFs in RAM silently in the background, including executing any embedded code without any sandboxing. Combined with browsers' prefetching of urls in a page (so that it would load quicker in case you clicked it), this caused a number of rootkit and other malware infections - from links that people didn't even click in search results and URLs served up in advertising or in comments/forum posts. The only permission needed by a PDF viewer should be 'display PDF document content'. It shouldn't need to read or change other data, manage downloads, or communicate with anything to display an e-book or document. If it does, it's probably not harmless.

fpgeek 10y ago
I'm not saying the permission request isn't overbroad, but "manage downloads" seems potentially reasonable. I'd imagine that some permission along those lines would be required for a PDF viewer to start displaying a document before it is completely downloaded. Now I don't know that that is what they were using it for, whether they could have made a narrower permission request, and so on, but permissions are permissions because we want to permit them some of the time. I think it is counterproductive to dismiss requests before evaluating them. That's the kind of behavior that leads to kitchen-sink permission requests from the start (when users are most motivated to try something) because a developer doesn't trust that they'll get a reasonable targeted request tomorrow.

showmerunner 10y ago

"Fake news!" -Adobe

natch 10y ago

Meanwhile, in the same ethical bucket, Oracle as recently as a week ago is adding a Yahoo! toolbar to your browser when you update Java, unless you uncheck their pre-checked opt-in checkbox. Sigh.

seanp2k2 10y ago
The scary things that happen when as a company, "hey, it's not like our users could possibly hate us more!" is true...and you're doing well financially for long periods of time.
- PeterisP 10y ago
  There's no contradiction when the overlap between 'users' and 'customers' is as small as in the Oracle Java situation.
  - ReverseCold 10y ago
    Which is why I'm so glad openjdk for Windows has a clean installer now. Malware free installer, works identically to the Oracle version performance wise (according to me, no real tests done), etc.
sbuttgereit 10y ago
My recollection is that this behavior in the Java updater actually pre-dates Oracle's acquisition of Sun. I think at one time it was for a different toolbar ('Ask!' maybe)... but it's not new by any means. Having said that, of course just because Sun may have started the practice doesn't mean Oracle gets a pass for merely continuing it.... unless there was some long, long terms sort of contractual things: which I highly doubt.
reustle 10y ago
Don't worry, Yahoo! (Altaba?) probably won't be pushing the toolbar for much longer :)
- 10y ago

peteretep 10y ago

Someone really really needs to fix browser plugin permission system so that control can be very very fine-grained, and it's easy to review what information has been passed back and forth.

Noseshine 10y ago
Yeah, but only about 5% of users are going to benefit from such a feature.

caconym_ 10y ago

My mom was a bit upset when I told her she couldn't install Adobe or Oracle software on her new computer (iMac) a few years ago, but today the thing still runs like it just came out of the box. Do the right thing, and tell your family and friends to stay away from this malware.

deleted 10y ago
[deleted]

Traubenfuchs 10y ago

I really wonder how it feels to create user-hostile software like that that is borderline malicious and barely adds any value.

crispyambulance 10y ago
That's an interesting question. There was a good thread here on exactly that (https://news.ycombinator.com/item?id=11806739 https://news.ycombinator.com/item?id=11806739) a while back. It was a Backchannel story about an "adtech" company in Philly: "The Perks Are Great. Just Don’t Ask Us What We Do." Basically, a surprisingly large number of employees don't know or don't care about the ethics of what a small number of leaders in their company do. Others justify such actions to themselves in convoluted ways. Only a small number truly can't deal with it.

robin_reala 10y ago

Given that Chrome itself was often bundled with Adobe Flash and Reader security updates I’m not sure they’ve got much of a case. https://forums.adobe.com/thread/1053973 https://forums.adobe.com/thread/1053973

huffmsa 10y ago

My current beef with Adobe is that they took a perfectly good mobile version of Photoshop for Android, broke it into 5 separate applications, that when combined, don't even reach the full functionality of the application they are replacing. Oh and they're each the size of the original app. Who signs off on this?

pawadu 10y ago
The management was probably given a bonus for expanding their mobile presence five-fold between 2015 and 2016 :)

bostand 10y ago

Isn't this against the chrome ToS? Can Google retaliate by removing their extension from the store?

crispyambulance 10y ago
Perhaps they can be persuaded if enough people report it as abuse. There's an option to do that when you remove extensions.

ksk 10y ago

Well, do the users know that Chrome itself sends a bunch of data to Google? On principle, I consider both Adobe and Google's practices to be abhorrent, but practically speaking Google definitely has the better record on product reliability and security.