TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

The "Window Resizer" extension for Chrome now contains malware (2013)

230 点作者 iamartnez超过 11 年前

30 条评论

8ig8超过 11 年前
Reddit discussion from last month:<p><a href="http://www.reddit.com/r/YouShouldKnow/comments/1snyyl/ysk_the_chrome_extension_called_window_resizer/" rel="nofollow">http:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;YouShouldKnow&#x2F;comments&#x2F;1snyyl&#x2F;ysk_th...</a><p>Also, alternative as discussed on SO:<p><a href="http://stackoverflow.com/questions/20775775/alternative-to-chrome-extension-window-resizer" rel="nofollow">http:&#x2F;&#x2F;stackoverflow.com&#x2F;questions&#x2F;20775775&#x2F;alternative-to-c...</a><p>See it in action:<p><a href="http://chrisbalt.com/blog/2013/12/20/link-hijacking-through-chrome-extensions-and-other-security-risks.html" rel="nofollow">http:&#x2F;&#x2F;chrisbalt.com&#x2F;blog&#x2F;2013&#x2F;12&#x2F;20&#x2F;link-hijacking-through-...</a><p>Edit: Related:<p><a href="http://superuser.com/questions/694825/why-my-google-search-results-are-all-directed-via-http-www-ecosia-org" rel="nofollow">http:&#x2F;&#x2F;superuser.com&#x2F;questions&#x2F;694825&#x2F;why-my-google-search-r...</a><p><a href="http://windowresizer.userecho.com/topic/353032-did-you-pull-your-extension-from-the-google-store/" rel="nofollow">http:&#x2F;&#x2F;windowresizer.userecho.com&#x2F;topic&#x2F;353032-did-you-pull-...</a>
评论 #7053993 未加载
Svip超过 11 年前
What is more interesting is the reaction from the developer himself. He seems to be completely unimpressed by the criticism. Noting that one permits Chrome extensions to do stuff, and they would have seen this permission the extension required when they updated or installed it.<p>Furthermore, he is quoted as joking about how he could have sold the extension to someone to get your passwords and whatnot (but ensures us that he hasn&#x27;t done so).
评论 #7048321 未加载
评论 #7048507 未加载
iamartnez超过 11 年前
Since Chrome auto-updates extensions, users are likely not aware of this change.<p>I&#x27;ve been using the extension for several months until I noticed the transparent redirection. In fact, the only reason I noticed the redirect is when it failed. I clicked on a Google search result and got stuck on a blank page like this:<p><pre><code> http:&#x2F;&#x2F;ecolink3.ecosia.org&#x2F;?key=3cdcd4dc082e3c7b860abe4608b6925d&amp;out=http%3A%2F%2Fwww.usatoday.com%2Fstory%2Fpopcandy%2F2013%2F01%2F15%2Ffred-armisen-ira-glass-this-american-life%2F1836079%2F&amp;cuid=2</code></pre>
评论 #7048314 未加载
评论 #7049296 未加载
评论 #7048698 未加载
评论 #7048427 未加载
silverlight超过 11 年前
Whoa, wait. One guy in this thread is claiming that Window Resizer was sending all your keystrokes back to a central server based on what he saw in Wireshark. Can anyone else verify this? I&#x27;ve had this extension installed for...a year, at least. Do I need to now go change every single password on every site because chances are it&#x27;s been keylogged? This is insane.
评论 #7048560 未加载
评论 #7049123 未加载
评论 #7049408 未加载
评论 #7051358 未加载
miles超过 11 年前
The linked discussion is back from mid-December and the extension has been removed from the Chrome Web Store:<p><a href="https://chrome.google.com/webstore/detail/window-resizer/kkelicaakdanhinjdeammmilcgefonfh" rel="nofollow">https:&#x2F;&#x2F;chrome.google.com&#x2F;webstore&#x2F;detail&#x2F;window-resizer&#x2F;kke...</a>
评论 #7048228 未加载
评论 #7048252 未加载
sergiotapia超过 11 年前
Google really REALLY needs to up their game. <a href="https://news.ycombinator.com/item?id=7046240" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=7046240</a><p>I don&#x27;t feel safe using their services anymore.
评论 #7051372 未加载
teknover超过 11 年前
Story sharing time!<p>I run a local user group that educates developers on Google&#x27;s technologies that while proudly independent from Google, has a great working relationship with their developer relations teams.<p>Back in March of 2012 (that&#x27;s almost two years ago) I first brought to the attention of the Chrome developer relations team an extension called Bookmark Sentry that essentially contained a trojan that hijacks links to serve up spam ads. You can read more about it here: <a href="http://stopmalvertising.com/malvertisements/beware-of-the-google-chrome-extension-neat-bookmarks.html" rel="nofollow">http:&#x2F;&#x2F;stopmalvertising.com&#x2F;malvertisements&#x2F;beware-of-the-go...</a><p>What I found troubling was the response back. I received an official response that it was within compliance of Chrome App Store policies. Specifically I was told:<p>&quot;Ad injections are not in violation of the Chrome Web Store program policies. The policy requires that ads must be presented in the context of the extension or, when present within another page, ads must be outside the page&#x27;s normal flow and clearly state which extension they are bundled with. We believe that ads are a legitimate way to monetize, but that they should be a known cost to the extension user.&quot;<p>I certainly hope since then they&#x27;ve changed their policy on this issue and are actively policing and enforcing against spyware and malware.<p>Chrome App extensions can access extremely sensitive data such as webforms with credit card, contact details, passwords and more and in the wrong hands can do untold damage.
chrislomax超过 11 年前
I noticed this about a month back. I was browsing the web one Saturday morning and spotted an &quot;Eco link&quot; next to the search results. Most of them were big sites, like Amazon and eBay etc.<p>I immediately emailed one of our SEO guys with a snippet of the page and said, &quot;we need to know how to do this in Google, it must be a new feature&quot;. I stupidly assumed it was a new feature Google had rolled out. When he replied that he can&#x27;t see it I started googling the problem, most of the results pertained to Malware and I was shocked, I&#x27;m a very careful browser in general.<p>When I started digging around it was only then I started switching off my plugins 1 by 1 and the eco link went when I switched off the browser resizer, I was honestly shocked. I knew the developer wasn&#x27;t supporting the plugin any more due to funding but I didn&#x27;t think it would go in that direction, I expected it to just fade away.<p>No, I didn&#x27;t read the updates on the product. I don&#x27;t have time to read updates on products, especially plugins. After reading his comments on there, there is no remorse for his actions. He is nothing more than a simple malware spreader, he should apply for a job at SourceForge.
评论 #7050353 未加载
评论 #7050236 未加载
评论 #7051895 未加载
nestlequ1k超过 11 年前
I ran into this. I only found out because ecolink went down for a while. So when I clicked on google search results, it would error out while trying to redirect.<p>Valuable lesson learned. I never thought a chrome developer would be quite so stupid to pull something like this. Now I&#x27;ll keep my eye on every extension.<p>And yes, you should never install Window Resizer, or anything else Ionut Botizan (the developer) releases again.
morgante超过 11 年前
This is completely egregious. Deleting now.<p>I love that the developer&#x27;s defense is that he could have sold our passwords to someone but (supposedly) didn&#x27;t. That really instills confidence in his morals, doesn&#x27;t it?
评论 #7050071 未加载
评论 #7056757 未加载
tmikaeld超过 11 年前
When developing my first Chrome Extension, it didn&#x27;t take me long until i got the thought of &quot;keylogging might be possible&quot;.<p>So i tried it, and sure - i was even able to replace password logins in the DOM with fake ones.<p>Firefox extensions does the same thing really, so now i only use a few &quot;safe&quot; extensions.<p>I&#x27;m surprised that this hasen&#x27;t gotten more attention.
评论 #7049983 未加载
评论 #7049517 未加载
评论 #7049539 未加载
taspeotis超过 11 年前
Is it correct to class this as malware? I get that the portmanteau is &quot;malicious software&quot; and hijacking your Google search results isn&#x27;t the friendliest thing to do but I think this is closer to &quot;adware&quot; than &quot;malware&quot;.<p>Although the author seems like a bit of a di- ...fficult person, maybe we should coin the term &quot;dickware&quot; to cover this sort of software.<p>EDIT: I missed the keylogging bit, thanks to everybody that pointed it out. Adware + Spyware = Malware.
评论 #7048413 未加载
评论 #7048414 未加载
评论 #7048410 未加载
评论 #7048447 未加载
Erwin超过 11 年前
Hover Zoom had a similar problem recently, but still exists on the Chrome store. Up until a certain version, their data collection did nothing much (perhaps save non-existing domain hits).<p>Then they partnered with someone and started sending certain form data (!!) to a third party -- claiming they wanted to collect anonymous demographic information. It didn&#x27;t help that the script injection on all pages (which I discovered when debugging with the web tools) used some shady domains with no web presence.<p>They claim they did not send e.g. any password data -- but they perfectly could have. I tried reporting the extension on the store as did many others, but that had no effect. The developer seems to have reverted that bit of the code -- for now.
评论 #7050603 未加载
chippy超过 11 年前
Someone should (and I just might) write an extension that updates a list of evil extensions and authors and warns the user when they have a bad extension or try to install a new extension on that list. Powered by a blocklist type of listing and community moderated.
chrisbalt超过 11 年前
Really what this boils down to, imho, is a need to educate users on the meaning of the permissions that are granted (with approval) to these extensions. Certainly the vast majority of users confirm the security permissions without comprehending the weight of access they&#x27;ve just provided the extension author.<p>With JavaScript, it&#x27;s nearly impossible for Chrome to reasonably explain, with any level of granularity, what exactly an extension will do with its access - hence the &quot;access your data on all websites&quot; warning.<p>A proof of concept to demonstrate how you can take advantage of this access for nefarious reasons, even after getting approval into the Chrome Web Store, would be quite simple.<p>Long&#x2F;short of it is: make sure you trust the author of any extension you install!
Chirael超过 11 年前
Wow, I had noticed the clickjacking of my Google result links (to ecolink) but had no idea who&#x2F;what was doing it. Very glad this mystery is finally solved! Thanks for posting this.
callesgg超过 11 年前
What a dickhead.
siliconviking超过 11 年前
Classic!<p>&quot;There is no such thing as bad publicity&quot; by Ionut Botizan<p>(Source: <a href="http://productforums.google.com/d/msg/chrome/mlAD1ygc0v0/1MP8G-WsfFkJ" rel="nofollow">http:&#x2F;&#x2F;productforums.google.com&#x2F;d&#x2F;msg&#x2F;chrome&#x2F;mlAD1ygc0v0&#x2F;1MP...</a>)
susi22超过 11 年前
Same with Read later fast: It rewrites all your URLs:<p><a href="https://chrome.google.com/webstore/detail/read-later-fast/decdfngdidijkdjgbknlnepdljfaepji" rel="nofollow">https:&#x2F;&#x2F;chrome.google.com&#x2F;webstore&#x2F;detail&#x2F;read-later-fast&#x2F;de...</a>
timmclean超过 11 年前
I&#x27;m most concerned about the keylogging claims. Does anyone have a copy of the CRX so that we can determine if keystrokes were in fact being transmitted?
评论 #7056044 未加载
评论 #7049384 未加载
评论 #7059823 未加载
评论 #7056031 未加载
评论 #7080593 未加载
评论 #7053433 未加载
cristiantincu超过 11 年前
Here’s how you disable “EcoLinks” if you have this extension installed and enabled:<p>chrome-extension:&#x2F;&#x2F;kkelicaakdanhinjdeammmilcgefonfh&#x2F;ecosia.html<p>Uncheck “Enable EcoLinks”.
评论 #7049900 未加载
chriscareycode超过 11 年前
Ive been having those bad URLs for a couple weeks now and thought Google was really off their game since many times the pages came up dead. Wow.
aragot超过 11 年前
Note to the developer: Next time you make a malware, also use it to remove all bad references to your extension from HN and newspapers...
jhwhite超过 11 年前
I saw the ecosia redirects popping up in some instances but couldn&#x27;t figure out where they were coming from.<p>The extension is now uninstalled.
jbrooksuk超过 11 年前
Shame, because it&#x27;s a good resizer. I happened to uninstall it back in November, but my co-worker is still (was) using it.
pawelkomarnicki超过 11 年前
Monday started with a massive WTF ;)
nailer超过 11 年前
Do we know where he was <i>sending</i> the keystrokes?<p>Was it logging all keystrokes in Chrome ever?
wnevets超过 11 年前
The extension hasn&#x27;t existed on the chrome app store for months. Why is this news on HN now? It wasnt malware either, it was ecolinks garbage for google search results that you could opt-out of.
评论 #7048798 未加载
prafuitu超过 11 年前
It is adware, not malware!<p>The original post on productforums.google.com is complete <i>BS</i> and the extension was NOT suspended because of that, but because it failed to make it clear, in the context of the ads, which extension enabled the EcoLinks. This is not the first, nor last, piece of software that uses ads in order to support its development.<p>Also, the extension never logged anything from the users. All the &quot;keylogger&quot; stuff is just rumors started by people who are either incapable of reading a sentence from start to end or are knowingly lying about it.<p>It didn&#x27;t alter the search results either. Those were exactly what Google returned for your search, nothing more, nothing less.<p>There was no malicious intent whatsoever. The whole purpose was to support further development of the extension through some form of advertising which you could disable at any point. The disable option was not even hidden among the other options; it had a dedicated page with a link in the main menu that only consisted of a checkbox - it was that simple and obvious.<p>Another false rumor is that the setting would enable itself automatically. No, it didn&#x27;t! The only way that it would re-enable itself was to remove the extension and then install it right back. On uninstall all settings are lost and it fallbacks to the defaults.<p>The source code is plain HTML &amp; JavaScript and it has always been available for anyone to review. Anyone could download the .CRX file and unzip it (it&#x27;s just a <i>special</i> ZIP file) or take a look in the &#x2F;%USER_FOLDER%&#x2F;&lt;PATH_TO_CHROME&gt;&#x2F;Extensions&#x2F;kkelicaakdanhinjdeammmilcgefonfh folder (this varies based on your operating system) where the installed extension is. The source code has also been available at <a href="http://ionut-botizan.net" rel="nofollow">http:&#x2F;&#x2F;ionut-botizan.net</a><p>If you don&#x27;t know JavaScript, you don&#x27;t have to take my word for it; there is this prominent person in the web industry that, although he does not endorse this extension, has reviewed the code and confirmed there was no keylogger there: <a href="https://news.ycombinator.com/item?id=7048156#up_7056031" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=7048156#up_7056031</a><p>Another false accusation is that I bragged about how &quot;I could sell your personal data and it wouldn&#x27;t matter to me&quot;.<p>What I actually said is that &quot;I could sell MY EXTENSION (as in transfer all rights and ownership to someone else) and it shouldn&#x27;t matter to me (from a legal standpoint) what the buyer would do with it, be it collecting your private data or whatever&quot;. That claim was made just to point out that in fact I do care about the users&#x27; privacy and I chose not to sell the extension, even though I received plenty of offers. Some people asked &quot;how could I even think of that&quot;? Well, the extension is my property and receiving all those offers put me in the position where I had to think about it, whether I liked it or not.<p>In conclusion, yes, I admit the opt-out pattern is not the friendliest one and the whole thing could have been handled in some other way, but the reality is far from all these claims that I sneakily added malware to the extension, logged your keys and private data and sell all that to third parties or whatever.<p>The reality is I took your Google search results and converted them to sponsored links, plain and simple. All data that was transmitted when you clicked a search result was about the same that is sent whenever you click on any other ad or banner, which can not, in any circumstances, be used to identify you personally.<p>I am the developer and this is my answer; no excuses, just stating the facts. Learn what you want from it.
评论 #7058781 未加载
aabalkan超过 11 年前
Haha that&#x27;s so funny. The developer has involved in the discussion and he is seriously defending himself. What is wrong with him lol.