Slashdot Mirror
Adware Vendors Buying Chrome Extensions, Injecting Ads
An anonymous reader writes "Ars reports that the developers of moderately popular Chrome extensions are being contacted and offered thousands of dollars to sell ownership of those extensions. The buyers are then adding adware and malware to the extensions and letting the auto-update roll it out to end users. The article says, 'When Tweet This Page started spewing ads and malware into my browser, the only initial sign was that ads on the Internet had suddenly become much more intrusive, and many auto-played sound. The extension only started injecting ads a few days after it was installed in an attempt to make it more difficult to detect. After a while, Google search became useless, because every link would redirect to some other webpage. My initial thought was to take an inventory of every program I had installed recently—I never suspected an update would bring in malware. I ran a ton of malware/virus scanners, and they all found nothing. I was only clued into the fact that Chrome was the culprit because the same thing started happening on my Chromebook—if I didn't notice that, the next step would have probably been a full wipe of my computer.'"
And that, ladies and gentlemen, is how the free market works.
The reputation of these plugins is worth money. The down side is that once the malware infected extensions are reported to Google, Google will kill them off in the browsers. They wont live long enough to make their money back. The adsheisters will quickly see their reputation vanish and their install base dwindle.
What makes this really bad is that it's difficult to permanently remove Chrome extensions sometimes. If I delete it, it will just show back up in a few minutes, probably because it's saved somewhere in my central account. Now with this out there...
I've seen contract gigs like the following, more than once, on boards such as Guru.com. One specific contract offer wanted code that would reset the, uh, "users" homepage to a URL to be specified by the client, then make it impossible for the "user" to set any other homepage. That's it. Perhaps I'm in the wrong business. It's a lot harder than I thought to get a job as an iOS developer, but I am really good with assembly code, debugging and reverse engineering. Perhaps I should write malware for the Russian Mob.
Please mail me URLs of software employers.
FTFA : - "Chrome's extension auto-update mechanism silently pushed out the update "
Google need to disconnect their Chrome core update mechanism from the extension updates (unless ones of their own authorship). Of course, they cannot do anything about users accepting updates directly from independent extension writers.
Otherwise, Chrome is dead in the water.
The commenters in arstechnica also mentioned search engine hijacking too. Maleare if you ask me?
This and advertisers circumventing adblock which was mentioned yesterday shows a war.
Is IE the only defense? Firefox has a lot more powerful API for extensions and add ons so I wonder if that is unsafe as well? However Mozilla has a greater track record in protecting freedom and privacy as an organization. Taco was an infamous extension that did what ghostery does for Firefox but a spammer bought it and ruined it.
http://saveie6.com/
The whole notion of automatic updates just doesn't make any sense.
Please assure that you're not one of those people who complain about users running unpatched Windows boxes because they turned off auto-update.
For the average non-techy user auto-update is the one thing I'd say is essential. They're not in any position to judge what parts of their system need, or don't need updates, and I'd rather that they trust in Google, or Microsoft, or even Canonical to decide for them.
Now, you can debate the fine points, about whether minor plug-ins should auto-update, or ask why Java on Windows boxes seems to want to update every third day, as does Adobe Reader, but in general I'd still argue that auto-updates are good security practice.
Three Squirrels
to my Firefox extension and they were all kinda shady. Extension development is kinda niche to begin with, so I figured they were planning something like this. I'm just surprised it took so long for people to notice.
I don't see it as a huge problem though. Most extension developers are like me, hobbiests and enthusiasts. There's really only a few big ones (like Adblock Plus and Firebug) and those are big enough they're not a target for these sorts of things.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
...these malware companies buy out AdBlock. :-/
Koans and fables for the software engineer
Many people have defected from IE due to its problems with malware and adware. Firefox, but more so Chrome seemed to be safe. So now that the awesome, "safe alternative" browser is compromised, what's next? I can't imagine there an easy fix to this. Is it time to go to yet another browser?
This is almost like how pharmaceutical scientists keep having to modify and discover new antibiotics. The current batch of drugs eventually becomes less and less effective and the bacteria become resistant, prompting us to constantly evolve the offerings.
Yeah no security risk at all to not autoupdate a platform that executes code
http://saveie6.com/
Automatic updates, by themselves, are an awful security practice. They mean that whoever writes the updates can install (intentionally or unintentionally) damaging code on all users' machines without the knowledge or choice of the user.
Automatic updates are a good security practice only if the user is willing to give their unconditional trust to the author for the entire time that the updater is running. This is not always the case. The possibility of an ownership transfer is one reason why it is not. Another is that I may not trust some companies to fully test their software before pushing it, so I don't want their updates until it is confirmed that the update doesn't brick my machine or break essential functionality.
Googles bottom line is to make advertising through its networks and its platforms as seamless and easy as possible. The only reason this model would be shunned is if its not generating appropriate revenue for google. Given the unorthodox nature of the advertisements, and the fact they circumvent per-click revenue entirely, they will probably see a crackdown.
but dont take this to imply Google cares how and when you get to see advertising. If you need proof, just try to find AdBlock Plus on the play store. google unceremoniously axed it in 2010 because the platform isnt designed to do what you want in spite of the models lucrative approach to its users as a saleable product. the ad-only vendors in Chrome will be warned to include some marketable widget or product. A cud if you will for the consumer that is their cow to chew.
Good people go to bed earlier.
Specifically, can we assume that any extension loaded into Firefox via the official extensions repository, is open-source, and that someone from Mozilla is checking the extension before an update is released?
Not a problem. When you set up Chrome, as you're connecting your account you just configure sync to not sync extensions and apps. That'll prevent the auto-download of them. If you need to clean up sync'd data, it's a dance: get Chrome sync'd up, turn off sync so the local copy is disconnected from the sync'd data, go to your dashboard and clear your sync'd data, then configure what you want sync'd and reenable sync.
Would anyone be surprised to learn the NSA has been doing similar tactics, strong-arming popular extension writer like ad-blockers to spy on users?
That's why I use a hosts file.
Where's that guy that aways talks about hosts files on here?
Patience... He's typing now. The clipboard only holds so much.
So you sit down and check on the health of your machine, you go through logs reading on what is vulnerable, and then you manually apply security patches.
How is this relevant in a discussion about what is best for a normal user again?
The normal user can barely be trusted to check in their car for a scheduled service let alone go through security updates one at a time. Like it or not the number of security threats caused by malicious updates is infinitesimal compared to the number of security threats caused by bugs which haven't been patched.
One new thing is Mozilla pushing updates at me while I am using their product. As It is Saturday night, and I work in IT, i found my self working. Ok. Happens. While I am working feverishly on browser-access-to-console stuff, my browser locks up. Oh.. I was suppposed to know it was time for an update? Another is Java. Was take a remote/virtual training when the Java powered screen scraper (which worked great!! thanks NX for the Fedora compatible version!) decided that the JVM was not current (1.7_45 vs 1.7_51) and quit. SO I lost 20 minutes of class while I scrambled for a fix. Any cloud/Interweb based service could change how it works at any second,. Is this acceptible to businesses that think the sugary sweet cloud is so dreamy, but in reality its so far from a secure and predictable platform. Now this blatant demonstration of how the unwiting user is riding a rollercoaster in the dark, and fed chuff by and advertising machine that feels obligated to clamp ones eyes open like that scene from Clockwork Orange. The latest is now Verizon's Anti-Neutrality powers - http://www.csmonitor.com/Business/Saving-Money/2014/0116/Net-neutrality-ruling-How-Verizon-decision-affects-consumers Used to be that the Internet was a path to good information, it seems as comfortable/predictable/business-ready as a funhouse..... thats not too fun. Can we start a new internet?
Time for a new Political party in the US (or two!) One is off the rails Other cant pony up a leader.
Whenever I see adds on a webpage, I inspect the elements, see what is serving the adds and add it to my router's block list. Bam no more adds.
Mean what you say...say what you mean.
and this is exactly why I don't allow auto updates. I take the time to read up on the vulnerabilities but as I tend to run Gentoo,
You got me, as soon as you said GENTOO. Ok another self flagellating penguin. Either that or a frustrated MSCE that moved over to Linux a few years back just to really experience some excruciating pain instead of hearing others scream in agony all the time to tech support about WINDOWS UPDATE. Oh the irony.
This message was not sent from an iPhone because Peter Sellers really was a deviated prevert without a dime for the call
No, Firefox isn't safer. Mozilla sold out last year.. This came up when Wips bought up a number of plug-ins, including BlockSite, and installed spyware with a ransomware "opt-in" feature. (Opt in, or we block Flickr, etc.)
Mozilla policy: "These features (spyware, etc.) cannot be introduced into an update of a fully-reviewed add-on; the opt-in change process must be part of the initial review."
Jorge Villalobos, Mozilla management-level employee: That's outdated, since we don't enforce that policy. As long as the feature is opt in, it is acceptable to introduce it in an update.
63 add-ons from Wips were found by a search last year.
Chrome **does** warn about new permissions, in fact it's more than that - it just disables them, and leaves you a message - "Such and such extensions requires new permissions, so it has been disabled.", and it's up to you to go and re-enable it.
Many users probably have never heard of regedit. However, for someone posting on /. it shouldn't be that hard.
I've looked for regedit in the Fedora repo and I couldn't find it.
Some of what I say is fact, some is conjecture, the rest I'm just blowing out my ass...you guess.