6 ms·

The reporter's experience with reporting Chrome Web Store malware reflects mine: Nobody at Google cares about malware enough to stop distributing it when people

The reporter's experience with reporting Chrome Web Store malware reflects mine: Nobody at Google cares about malware enough to stop distributing it when people report it. The "Report Abuse" button probably goes straight to an unmonitored spam folder. Hint to anyone working on security at Google: It actually doesn't matter what obscure zero-days you discover and patch when you distribute malware directly that relies on supported functionality. There's no need to exploit security holes when malware is simply permitted as-is. Shut the Chrome Web Store down until you're prepared to take it seriously.

classified 6y ago
As long as everyone keeps using Chrome and its Web Store Google won't change a thing. They don't exactly have a track record of listening to their users, to put it mildly.
- jchook 6y ago
  AFAIK even Chromium won't let you install an extension directly from a website. You must download it, keep it somewhere, turn on dev mode, and "load unpacked extension". It wont sync across browsers, etc. Compare this to Firefox which will sign your extension and let you distribute it directly through your website with a user-friendly experience.
  - dessant 6y ago
    Firefox is way behind Chrome on this front. You can't permanently install a private extension in the release version of Firefox, unless you upload the source code to their servers for signing, and the unlisted extension complies with their developer policy. Mozilla's stance on extension signing is hostile to users, there are several extensions that got remotely blocked for loading code from Google Translate [1]. This is software that you privately install for your own use, and Mozilla blocks it remotely in your browser. They've also rolled out the new version of Firefox for Android which only supports a couple of extensions that they have whitelisted. I can no longer use the extensions I have developed and published on Firefox Addons, and I can only imagine the grief it is causing for less technical users that have suddenly lost the productivity tools that they've relied on. They've also disabled about:config in the new version of Firefox for Android, you can no longer configure the browser that way. [1] https://www.jeremiahlee.com/posts/page-translator-is-dead/ https://www.jeremiahlee.com/posts/page-translator-is-dead/
    - kevingadd 6y ago
      I agree with your perspective that the extension signing model is user-hostile, but under no circumstances should a signed extension be loading remote code, even if it's google translate. Maybe if the remote code is also signed and you're asserting that it matches a SHA256 hash... but at that point just bundle it into your extension. If you allow loading remote code into an extension there's no point in signing or review or any other security measures because the extension is just malware waiting to happen. If you absolutely must load remote code, load it in the page context where it doesn't have access to dangerous extension-only APIs. This is my PoV as someone who maintained a 100k-weekly-user Chrome extension for 3 years: I hate the Chrome Web Store but the 'no remote code' policy is correct and Mozilla is correct to also enforce it.
      - deleted 6y ago
        [deleted]
    - bscphil 6y ago
      > You can't permanently install a private extension in the release version of Firefox For what it's worth (admittedly not very much), you can build the release version of Firefox yourself while allowing extension sideloading without even changing any code, it's just the "MOZ_REQUIRE_SIGNING" option. Obviously this is not a real possibility for everyone, but I do it for this and getting rid of Pocket, along with a few other small changes.
      - zeta0134 6y ago
        You can also just run the Developer release, which is mostly meant for authoring new extensions, but does respect the about:config flag to disable signature checking. Mozilla is in a tough spot as a browser vendor, since a sizable portion of their userbase is actually well served by the restrictions. Happily it's also open source, allowing true power users to do what they want with minimal fuss.
        dessant 6y ago
  - kwanbix 6y ago
    I don't know what version of chromium you use, but I can install without any problem.
dehrmann 6y ago
> It actually doesn't matter what obscure zero-days you discover and patch when you distribute malware directly that relies on supported functionality. Zero-days are often used by state actors, so their impact is larger, but less visible.
- drdaeman 6y ago
  Isn't it smaller? In my understanding, state-level actors are not exactly notorious for using exploits for mass surveillance (they use a little bit less controversial means to achieve this), zero-day stuff is typically for single valuable targets. Or am I wrong?
josefx 6y ago
> Nobody at Google cares about malware enough to stop distributing it when people report it. It seems to be a rather important bullet point every time they need a reason to cripple ad blockers even more. Google solving this issue is like Nestle solving world hunger: directly counterproductive to its main goals.
ghostwords 6y ago
From a now year-old EFF blog post [1] regarding Chrome extensions and the Google Manifest V3 "proposal": The “Report Abuse” link doesn't seem to produce results, obfuscated code doesn't seem to trigger red flags, and no one responds to user reviews. [1]: https://www.eff.org/deeplinks/2019/07/googles-plans-chrome-extensions-wont-really-help-security https://www.eff.org/deeplinks/2019/07/googles-plans-chrome-e...
- kevingadd 6y ago
  I wouldn't be surprised if their staff have no tooling for looking at user reviews, period. The UI for looking at user reviews of your own stuff as a developer is really, really bad and I know that in the past other Google properties have had this issue - YouTube annotations were invisible to their trust and safety staff, for example.
- jpalomaki 6y ago
  Likely ”report abuse” submissions are just one variable in a model that is used to determine propability of app being malicious. Or it might be that humans are just reviewing top N apps, sorted by number of reports.
grawprog 6y ago
>The "Report Abuse" button probably goes straight to an unmonitored spam folder That seems generous, I just assumed you were filling out a form that just deleted itself when you clicked send.
- wjsetzer 6y ago
  Even that's too generous. It's got to be just going to a socket somewhere that redirects to `/dev/null`
  - kn0where 6y ago
    I figured it sent a POST request to example.org
  - grawprog 6y ago
    You're a google employee aren't you?? Come on you can admit it.
  - julietteeb 6y ago
    They probably use https://devnull-as-a-service.com/ https://devnull-as-a-service.com/

classified 6y ago

As long as everyone keeps using Chrome and its Web Store Google won't change a thing. They don't exactly have a track record of listening to their users, to put it mildly.

jchook 6y ago
AFAIK even Chromium won't let you install an extension directly from a website. You must download it, keep it somewhere, turn on dev mode, and "load unpacked extension". It wont sync across browsers, etc. Compare this to Firefox which will sign your extension and let you distribute it directly through your website with a user-friendly experience.
- dessant 6y ago
  Firefox is way behind Chrome on this front. You can't permanently install a private extension in the release version of Firefox, unless you upload the source code to their servers for signing, and the unlisted extension complies with their developer policy. Mozilla's stance on extension signing is hostile to users, there are several extensions that got remotely blocked for loading code from Google Translate [1]. This is software that you privately install for your own use, and Mozilla blocks it remotely in your browser. They've also rolled out the new version of Firefox for Android which only supports a couple of extensions that they have whitelisted. I can no longer use the extensions I have developed and published on Firefox Addons, and I can only imagine the grief it is causing for less technical users that have suddenly lost the productivity tools that they've relied on. They've also disabled about:config in the new version of Firefox for Android, you can no longer configure the browser that way. [1] https://www.jeremiahlee.com/posts/page-translator-is-dead/ https://www.jeremiahlee.com/posts/page-translator-is-dead/
  - kevingadd 6y ago
    I agree with your perspective that the extension signing model is user-hostile, but under no circumstances should a signed extension be loading remote code, even if it's google translate. Maybe if the remote code is also signed and you're asserting that it matches a SHA256 hash... but at that point just bundle it into your extension. If you allow loading remote code into an extension there's no point in signing or review or any other security measures because the extension is just malware waiting to happen. If you absolutely must load remote code, load it in the page context where it doesn't have access to dangerous extension-only APIs. This is my PoV as someone who maintained a 100k-weekly-user Chrome extension for 3 years: I hate the Chrome Web Store but the 'no remote code' policy is correct and Mozilla is correct to also enforce it.
    - deleted 6y ago
      [deleted]
  - bscphil 6y ago
    > You can't permanently install a private extension in the release version of Firefox For what it's worth (admittedly not very much), you can build the release version of Firefox yourself while allowing extension sideloading without even changing any code, it's just the "MOZ_REQUIRE_SIGNING" option. Obviously this is not a real possibility for everyone, but I do it for this and getting rid of Pocket, along with a few other small changes.
    - zeta0134 6y ago
      You can also just run the Developer release, which is mostly meant for authoring new extensions, but does respect the about:config flag to disable signature checking. Mozilla is in a tough spot as a browser vendor, since a sizable portion of their userbase is actually well served by the restrictions. Happily it's also open source, allowing true power users to do what they want with minimal fuss.
      - dessant 6y ago
- kwanbix 6y ago
  I don't know what version of chromium you use, but I can install without any problem.

dehrmann 6y ago

> It actually doesn't matter what obscure zero-days you discover and patch when you distribute malware directly that relies on supported functionality. Zero-days are often used by state actors, so their impact is larger, but less visible.

drdaeman 6y ago
Isn't it smaller? In my understanding, state-level actors are not exactly notorious for using exploits for mass surveillance (they use a little bit less controversial means to achieve this), zero-day stuff is typically for single valuable targets. Or am I wrong?

josefx 6y ago

> Nobody at Google cares about malware enough to stop distributing it when people report it. It seems to be a rather important bullet point every time they need a reason to cripple ad blockers even more. Google solving this issue is like Nestle solving world hunger: directly counterproductive to its main goals.

ghostwords 6y ago

From a now year-old EFF blog post [1] regarding Chrome extensions and the Google Manifest V3 "proposal": The “Report Abuse” link doesn't seem to produce results, obfuscated code doesn't seem to trigger red flags, and no one responds to user reviews. [1]: https://www.eff.org/deeplinks/2019/07/googles-plans-chrome-extensions-wont-really-help-security https://www.eff.org/deeplinks/2019/07/googles-plans-chrome-e...

kevingadd 6y ago
I wouldn't be surprised if their staff have no tooling for looking at user reviews, period. The UI for looking at user reviews of your own stuff as a developer is really, really bad and I know that in the past other Google properties have had this issue - YouTube annotations were invisible to their trust and safety staff, for example.
jpalomaki 6y ago
Likely ”report abuse” submissions are just one variable in a model that is used to determine propability of app being malicious. Or it might be that humans are just reviewing top N apps, sorted by number of reports.

grawprog 6y ago

>The "Report Abuse" button probably goes straight to an unmonitored spam folder That seems generous, I just assumed you were filling out a form that just deleted itself when you clicked send.

wjsetzer 6y ago
Even that's too generous. It's got to be just going to a socket somewhere that redirects to `/dev/null`
- kn0where 6y ago
  I figured it sent a POST request to example.org
- grawprog 6y ago
  You're a google employee aren't you?? Come on you can admit it.
- julietteeb 6y ago
  They probably use https://devnull-as-a-service.com/ https://devnull-as-a-service.com/