3 ms·
If you enumerate the ways browsers can make network requests, and if you have access to the source code of the extension, you could prepend the code with a bit
by fiddlerwoaroof 6y ago
If you enumerate the ways browsers can make network requests, and if you have access to the source code of the extension, you could prepend the code with a bit of JavaScript that replaces the various network-related functions and methods with code that logs and/or validates the URL before making a request.
- whoopdedo 6y agoThe attacker will then inspect itself to see if network loggers are being used, or if it's running in a test environment (network location, machine fingerprint, et.al.) then adapt its behavior accordingly to avoid setting off any warnings.
- fiddlerwoaroof 6y agoNo, I’m saying modify the source of the extension so that the extension can only make requests to a whitelist of urls. The extension might be able to disable malicious functionality or something, but you can be certain that it’s not making malicious requests.
- prox 6y agoOn my android tablet they checked if my keyboard was us/eu (rain down the malware) or russian/chinese (Keep the app as-is) And this was Google Play verified with a million downloads.