More malicious extensions in Chrome Web Store

216 点作者 campuscodi将近 2 年前

11 条评论

I am the developer of Voice In (<a href="https://chrome.google.com/webstore/detail/voice-in-speech-to-text-d/pjnefijmagpdjfhhkpljicbbpicelgko?hl=en" rel="nofollow">https://chrome.google.com/webstore/detail/voice-in-speech-to...</a>), a Chrome extension with 300k+ users. Every month, I have 2-3 folks reach out asking for one of two things:1) Something something Bing. Here is one from two days ago - <a href="https://imgur.com/a/KOwLRIC" rel="nofollow">https://imgur.com/a/KOwLRIC</a>2) They want anonymized web browsing data.Google just yesterday sent out an email cracking down on this. From the email:To better protect users' browsing experience, the Quality Guideline changes clarify that an extension's purpose is to provide complimentary functionality for the browsing experience and should not seek to hijack a user's browsing or search experience. This update aims to ensure that users have full control over their browsing sessions, without any unwarranted interruptions or manipulations. By enforcing this policy, we strive to foster a safer and more enjoyable environment for all Chrome users, where their trust and satisfaction remain our top priorities. Together, we can create a web ecosystem that respects users' autonomy and offers seamless browsing experiences that truly enhance their lives.

评论 #36147860 未加载

评论 #36147388 未加载

评论 #36149111 未加载

评论 #36149913 未加载

评论 #36147606 未加载

评论 #36154203 未加载

tjpnz将近 2 年前

I get a cold sweat whenever I use Chrome Web Store. How do I know that what I'm downloading is legitimate and not malware that's been made to look like another well known extension? The download counts aren't useful in determining that either, it's just a number and who's to know that it hasn't been manipulated by bots? I'm wary of suggestions that Google could implement a meaningful review process. They claim to do that for ads, yet it's not unusual to see ads in search for software that's obviously malware.

评论 #36148436 未加载

评论 #36150739 未加载

评论 #36149958 未加载

评论 #36147507 未加载

kevingadd将近 2 年前

This will continue to get worse until Google takes security seriously on the Web Store. They don't meaningfully review uploads and they don't seem to staff it well in general - they take a very long time to process DMCA-related stuff, and when they do flag something for review (VERY rare) the review can take a very long time. Maybe it's unreasonable for me to expect them to invest money into running their "Store" but maintaining a reasonably popular extension for a while gave me a very low opinion of the whole service.I always have gotten the impression that the Chrome Web Store is something they'd rather get rid of if extensions (especially ad blockers) weren't a necessary evil to maintain their market dominance in browsers. The install and update UX have always been kind of neglected and awkward, and the permissions model is bad. Manifest V3 "fixes" some of this, I guess.As of today if I go to the chrome web store and try to install the recommended extensions on the front page, all of the ones I checked need to "read and change all my data on all websites" in order to do things like add a context menu option or run a connection speed test. There's no way for an ordinary user to tell the difference between "Chrome's permission model is garbage so every extension asks for this horrible permission" and "This extension is malicious and is actually going to read/change all my data"

评论 #36147190 未加载

评论 #36147401 未加载

评论 #36147286 未加载

评论 #36147121 未加载

lewantmontreal将近 2 年前

Wasn’t manifest v3 supposed to prevent dynamically loaded code? As the article says these extensions are featured but (I think) the latest update to v3 says: “In January 2023, use of Manifest V3 will become a prerequisite for the Featured badge in the Chrome Web Store.”<a href="https://chromeos.dev/en/posts/manifest-v-3-migration-timeline-update" rel="nofollow">https://chromeos.dev/en/posts/manifest-v-3-migration-timelin...</a>

评论 #36148969 未加载

评论 #36147825 未加载

评论 #36147556 未加载

评论 #36147853 未加载

Joker_vD将近 2 年前

Every time I launch Chrome on one of my machines, it complains that an extension called "Privacy Test" has been disabled because of its dubiousness, reactivate/delete? I chose "Delete" every single time, and every single time, it comes back at the next Chrome restart. Apparently, it somehow managed to store itself into my Google account's sync data, because after several hours of googling apparently the only working way to get rid of it is to get a fresh Chrome install, not sync, then nuke all of the sync data.If only there was a way to see what's actually in the sync data and manage it on a more fine-grained level instead of having only a single "delete all" button or, you know, maybe Chrome could actually just bloody uninstall the extension I ordered it to uninstall? Maybe by the next century the technology will actually be there.

评论 #36149172 未加载

评论 #36148502 未加载

cm2012将近 2 年前

Okay so funny story: I once worked with a company with insane security rules. 2FA every time you log into any program on your computer. I had to get fingerprinted to get a company laptop. No installation privileges. it goes on and on. And I was just a consultant with no access to code or anything, this is just to be able to attend meetings and see google docs.Chrome extensions? No limitations at all, not even checked, add whatever you want.I thought that was pretty funny.

ibejoeb将近 2 年前

I make a lot of extensions, and I still don't know how the screening happens in the various stores. It's not working well, whatever it is. Part of the solution ought to require a submission in source format for easier screening, either by people or AI. (It can be obfuscated in-store if that's really what the developer wants.)

评论 #36150316 未加载

评论 #36151259 未加载

zenapollo将近 2 年前

I don’t understand why there’s not an fdroid-like store for open source chrome extensions. All my most important extensions are open source. I try to find ones that are. But I’m not savvy enough to do checksums and all that so i just trust the deployed app is the same one on GitHub.

评论 #36148609 未加载

almenon将近 2 年前

Chrome really needs to introduce a extension denylist. The effect of malicious extensions would be less if you could exclude banking and other sensitive websites.The current Allowlist is not sufficient because some extensions need to work across most sites.

munro将近 2 年前

<><>incoming rant<><>thank god i switched to firefox, not that i think their extension security is any better (naturally skeptic, as i assume everyone else is on here)i'm tired of google, the ad revenue model is a parasite on society. i just went to their office last week for some lame ass workshop. this company is rotting inside out. they do shitty software consulting now? obv yes their core technology is still incredibly valuable, but how have we not just rip that out of the company? (rhetorical) it's just an intuition, but i feel the end is neigh for google/rant/

评论 #36148037 未加载

评论 #36147705 未加载

评论 #36150195 未加载

评论 #36152181 未加载

评论 #36147805 未加载

Grom_PE将近 2 年前

I don't get how one is supposed to stay secure with the current way extensions work: all you have access to is a button that only installs and runs an extension, and at any point of time, it may automatically update with malicious code after the author has agreed to transfer control to someone else for an enticing sum of money. It happened several times before.To fix this, I've made my own UserJS that changes the "install" button into "download CRX", then I unpack the CRX file and remove the autoupdate URL from it so the code stays as it was when I last looked at it. Sometimes the extension's job is not worth having an extra extension installed (each spawns its own separate background process) so I paste the code into a userscript or a conglomerate extension instead.The chromium-based browser I use, Vivaldi, prevents injecting user scripts into "chrome.google.com" so I have to change the string in the browser binary to something like "chrame.google.com". Then it works.