4 ms·

Even with Manifest v3, if you suddenly have access to a browser extension (say, you bought the company making it) with global "inject a known content script tha

by btown 5y ago

Even with Manifest v3, if you suddenly have access to a browser extension (say, you bought the company making it) with global "inject a known content script that's been vetted by the Web Store and included in the extension bundle" permissions... it's possible to add obfuscated code in that content script that provides RCE on the page to the attacker. Imagine something like a modified form of jQuery that adds and immediately removes a script tag when provided specific inputs - inputs that would be expected to be controlled by the results of a web-based JSON endpoint that's core to the extension's functionality. Is the web store going to code review an entire minified jQuery? Can an automated system detect it? What if attackers hired someone who won IOCCC? The attackers have the upper hand here and can pull the trigger on any website they choose. Which is why Google might say Manifest v3 is all about security, but unless attackers get lazy and let their injectors get fingerprinted, it's all just airport-style security theater... that happens to strangle ad blockers... At any rate, cookies and other methods of XSS will begin to leak more and more, and defense in depth will become the paradigm of the day. Assume your employees' browsers are compromised and plan accordingly.

shadowgovt 5y ago
That's the thing though... 90% of attackers are bad at their job. Even if it traps mostly people who aren't investing IOCCC levels of cleverness into the problem or buying companies for the purpose of getting malicious extensions into the Chrome web store, it makes the system safer for the average user. Certainly safer than the system is if any script kiddie can just use the manifest V2 permissions to turn a clock app into a keylogger. And if the model is as breakable as you claim, I don't worry about the fate of ad blockers.. after all, nothing prevents them from using the exploit you just described, right? Use a modified jQuery to add and remove a script tag to figure out what needs to be blocked?
- btown 5y ago
  As far as I can tell, you could, and will still be able to, make ads invisible based on dynamic data, but under Manifest v3 you would not be able to prevent the ads from downloading (and sharing private information, including your FLOC cohorts) based on dynamic heuristics, because Manifest v3 makes it impossible to use anything other than a simple, limited-length blocklist to prevent a network request from being made. See: https://developer.chrome.com/docs/extensions/mv3/intro/mv3-overview/#network-request-modification https://developer.chrome.com/docs/extensions/mv3/intro/mv3-o... It's a decrease in privacy being sold as an improvement in security and performance. Could they have instead implemented a persistent super-sandbox for network-blocking heuristic code that addresses the performance and security issues, while still enabling dynamic network blocking? Probably! But why would they, when the primary use case is heuristic-based ad blocking? And I suppose you're right - part of any defense in depth is reducing the number of first-level successes. And it's very possible it was script kiddies who sold the cookies to the actual attackers in the EA case. But there's more going on here than just security.

by btown 5y ago

shadowgovt 5y ago

That's the thing though... 90% of attackers are bad at their job. Even if it traps mostly people who aren't investing IOCCC levels of cleverness into the problem or buying companies for the purpose of getting malicious extensions into the Chrome web store, it makes the system safer for the average user. Certainly safer than the system is if any script kiddie can just use the manifest V2 permissions to turn a clock app into a keylogger. And if the model is as breakable as you claim, I don't worry about the fate of ad blockers.. after all, nothing prevents them from using the exploit you just described, right? Use a modified jQuery to add and remove a script tag to figure out what needs to be blocked?

btown 5y ago
As far as I can tell, you could, and will still be able to, make ads invisible based on dynamic data, but under Manifest v3 you would not be able to prevent the ads from downloading (and sharing private information, including your FLOC cohorts) based on dynamic heuristics, because Manifest v3 makes it impossible to use anything other than a simple, limited-length blocklist to prevent a network request from being made. See: https://developer.chrome.com/docs/extensions/mv3/intro/mv3-overview/#network-request-modification https://developer.chrome.com/docs/extensions/mv3/intro/mv3-o... It's a decrease in privacy being sold as an improvement in security and performance. Could they have instead implemented a persistent super-sandbox for network-blocking heuristic code that addresses the performance and security issues, while still enabling dynamic network blocking? Probably! But why would they, when the primary use case is heuristic-based ad blocking? And I suppose you're right - part of any defense in depth is reducing the number of first-level successes. And it's very possible it was script kiddies who sold the cookies to the actual attackers in the EA case. But there's more going on here than just security.