5 ms·

Think twice before installing Chrome extensions

53 points by vgnet 15y ago

andrenotgiant 15y ago
The possibility of what malicious extensions could gain access to (credit card #s, passwords, bank accounts, email accounts), combined with the ease of installing and lack of suspicion users have with these extensions really scares me. Does anyone know how actively moderated the Chrome Extensions store is? I know recently Google made all developers use a credit card to verify names better, but this seems more of a reactive safety measure, i.e. after lots of people get hacked, Google can provide prosecutors with information.
- aderaynal 15y ago
  it is not moderated at all. Updates to existing extensions are available within seconds on the chrome webstore...
- deleted 15y ago
  [deleted]
matznerd 15y ago
It is definitely not moderated, I've had multiple plugins inject ads into my web browsing. One was a Facebook app to enlarge photos and it started adding these banners to the sides of facebook. I though it was Facebook using a new form of ads until I realized otherwise. I had another do it on yelp...
Adaptive 15y ago
Chrome extension users are suffering Warning Fatigue. The user can review some information about access permissions but so many extensions make the same plea: "i know that my extension is using lots of permissions, but it's totally safe". Much like Windows and Android, the endless alerts about permissions and confirmations, while perhaps holding real information, end up becoming little more than noise. Combine that with a free-fire zone where apparently little moderation or pruning occurs... it's bad news waiting to happen. (edit: I'm a Chrome user in addition to FF and I use a lot of extensions... they are super useful, but I have serious concerns about this)
- glimcat 15y ago
  It's not not just Chrome. A better behavior would be selective approval. Extension asks for permissions for X, Y, and Z. You allow X and Z but deny Y. Any features affected fall back to an alternate state or are disabled. User is given clear access to control the permission states and clear feedback as to which permissions affect which features. Information about feature dependencies is available prior to install, particularly if they are arbitrary dependencies like "send us all your personal info or the software does nothing." Is this going to happen? Probably not. Application-level firewalls help somewhat, in some cases, for expert users. Sometimes "use different software" helps, but there are many cases where that's not viable.
  - kulkarnic 15y ago
    I think an even better policy is to let the browser prompt if the permissions that the extension demands are grossly above those required for its purported purpose. It may seem like a hard machine learning problem, but it seems to me that one could catch the most blatant offenders easily-- changing background colors at \.facebook.com should not require the ability to communicate with malwarehost.com or the ability to read data across all websites. Combine this with the fact that most extensions people install are not* malicious, and you already have a decent training corpus (to treat this as a one-class classifier) Edit: escape characters
    - glimcat 15y ago
      I'd be happy just seeing prominent and clear icons for major threat types, e.g. access to personal data, elevated device access, and so forth. Make them large and suitably threatening. It wouldn't completely solve the problem, but it could take back a lot of ground.
- aboodman 15y ago
  Reducing the typical permission level, and the resulting warning fatigue, is our team's highest priority right now. For example, the new permissions API can be used to request permissions at runtime, rather that install time: http://code.google.com/chrome/extensions/permissions.html http://code.google.com/chrome/extensions/permissions.html And the new webRequest API can be used by many extensions in lieu of content scripts: http://code.google.com/chrome/extensions/webRequest.html http://code.google.com/chrome/extensions/webRequest.html There's a lot more we have planned though. Personally, I would like to eventually get to a world where many extensions - in particular the ones that novice users usually see - require no warnings at all. I think that can be done by putting access to most elevated privileges behind explicit user gestures (like clicking a button or invoking a keyboard shortcut). In general, balancing utility and security in a browser extension system turns out to be a very, um, interesting design problem. But I think we have some good, new ideas coming. Now, just need to implement them.
fruchtose 15y ago
The article does a good job of showing what can go wrong with Chrome, but I have a gripe with the article itself. Notice, it uses very subtle fear mongering in the way they printed the JavaScript code. At first glance, I thought it was going to be a screenshot of a Windows BSOD. I'm not sure what the author is trying to accomplish (code = evil?) but at the very least the screenshots are ugly and garish.
- dchest 15y ago
  BSOD? It's a pretty known old color scheme used in many DOS programs (https://encrypted.google.com/search?tbm=isch&q=dos+editor https://encrypted.google.com/search?tbm=isch&q=dos+edito...). This one is probably from FAR Manager's editor/viewer. What color scheme does your text editor have? Is it evil and fear mongering?
  - fruchtose 15y ago
    Pardon my ignorance, but the last time I saw DOS was around the time I was six years old. Thank you for providing some insight on this subject. DOS text editors are before my time.

53 points by vgnet 15y ago

The possibility of what malicious extensions could gain access to (credit card #s, passwords, bank accounts, email accounts), combined with the ease of installing and lack of suspicion users have with these extensions really scares me. Does anyone know how actively moderated the Chrome Extensions store is? I know recently Google made all developers use a credit card to verify names better, but this seems more of a reactive safety measure, i.e. after lots of people get hacked, Google can provide prosecutors with information.

aderaynal 15y ago
it is not moderated at all. Updates to existing extensions are available within seconds on the chrome webstore...
deleted 15y ago
[deleted]

matznerd 15y ago

It is definitely not moderated, I've had multiple plugins inject ads into my web browsing. One was a Facebook app to enlarge photos and it started adding these banners to the sides of facebook. I though it was Facebook using a new form of ads until I realized otherwise. I had another do it on yelp...

Adaptive 15y ago

Chrome extension users are suffering Warning Fatigue. The user can review some information about access permissions but so many extensions make the same plea: "i know that my extension is using lots of permissions, but it's totally safe". Much like Windows and Android, the endless alerts about permissions and confirmations, while perhaps holding real information, end up becoming little more than noise. Combine that with a free-fire zone where apparently little moderation or pruning occurs... it's bad news waiting to happen. (edit: I'm a Chrome user in addition to FF and I use a lot of extensions... they are super useful, but I have serious concerns about this)

glimcat 15y ago
It's not not just Chrome. A better behavior would be selective approval. Extension asks for permissions for X, Y, and Z. You allow X and Z but deny Y. Any features affected fall back to an alternate state or are disabled. User is given clear access to control the permission states and clear feedback as to which permissions affect which features. Information about feature dependencies is available prior to install, particularly if they are arbitrary dependencies like "send us all your personal info or the software does nothing." Is this going to happen? Probably not. Application-level firewalls help somewhat, in some cases, for expert users. Sometimes "use different software" helps, but there are many cases where that's not viable.
- kulkarnic 15y ago
  I think an even better policy is to let the browser prompt if the permissions that the extension demands are grossly above those required for its purported purpose. It may seem like a hard machine learning problem, but it seems to me that one could catch the most blatant offenders easily-- changing background colors at \.facebook.com should not require the ability to communicate with malwarehost.com or the ability to read data across all websites. Combine this with the fact that most extensions people install are not* malicious, and you already have a decent training corpus (to treat this as a one-class classifier) Edit: escape characters
  - glimcat 15y ago
    I'd be happy just seeing prominent and clear icons for major threat types, e.g. access to personal data, elevated device access, and so forth. Make them large and suitably threatening. It wouldn't completely solve the problem, but it could take back a lot of ground.
aboodman 15y ago
Reducing the typical permission level, and the resulting warning fatigue, is our team's highest priority right now. For example, the new permissions API can be used to request permissions at runtime, rather that install time: http://code.google.com/chrome/extensions/permissions.html http://code.google.com/chrome/extensions/permissions.html And the new webRequest API can be used by many extensions in lieu of content scripts: http://code.google.com/chrome/extensions/webRequest.html http://code.google.com/chrome/extensions/webRequest.html There's a lot more we have planned though. Personally, I would like to eventually get to a world where many extensions - in particular the ones that novice users usually see - require no warnings at all. I think that can be done by putting access to most elevated privileges behind explicit user gestures (like clicking a button or invoking a keyboard shortcut). In general, balancing utility and security in a browser extension system turns out to be a very, um, interesting design problem. But I think we have some good, new ideas coming. Now, just need to implement them.

fruchtose 15y ago

The article does a good job of showing what can go wrong with Chrome, but I have a gripe with the article itself. Notice, it uses very subtle fear mongering in the way they printed the JavaScript code. At first glance, I thought it was going to be a screenshot of a Windows BSOD. I'm not sure what the author is trying to accomplish (code = evil?) but at the very least the screenshots are ugly and garish.

dchest 15y ago
BSOD? It's a pretty known old color scheme used in many DOS programs (https://encrypted.google.com/search?tbm=isch&q=dos+editor https://encrypted.google.com/search?tbm=isch&q=dos+edito...). This one is probably from FAR Manager's editor/viewer. What color scheme does your text editor have? Is it evil and fear mongering?
- fruchtose 15y ago
  Pardon my ignorance, but the last time I saw DOS was around the time I was six years old. Thank you for providing some insight on this subject. DOS text editors are before my time.