Slashdot Mirror
Adware Vendors Buying Chrome Extensions, Injecting Ads
An anonymous reader writes "Ars reports that the developers of moderately popular Chrome extensions are being contacted and offered thousands of dollars to sell ownership of those extensions. The buyers are then adding adware and malware to the extensions and letting the auto-update roll it out to end users. The article says, 'When Tweet This Page started spewing ads and malware into my browser, the only initial sign was that ads on the Internet had suddenly become much more intrusive, and many auto-played sound. The extension only started injecting ads a few days after it was installed in an attempt to make it more difficult to detect. After a while, Google search became useless, because every link would redirect to some other webpage. My initial thought was to take an inventory of every program I had installed recently—I never suspected an update would bring in malware. I ran a ton of malware/virus scanners, and they all found nothing. I was only clued into the fact that Chrome was the culprit because the same thing started happening on my Chromebook—if I didn't notice that, the next step would have probably been a full wipe of my computer.'"
And that, ladies and gentlemen, is how the free market works.
The reputation of these plugins is worth money. The down side is that once the malware infected extensions are reported to Google, Google will kill them off in the browsers. They wont live long enough to make their money back. The adsheisters will quickly see their reputation vanish and their install base dwindle.
What makes this really bad is that it's difficult to permanently remove Chrome extensions sometimes. If I delete it, it will just show back up in a few minutes, probably because it's saved somewhere in my central account. Now with this out there...
FTFA : - "Chrome's extension auto-update mechanism silently pushed out the update "
Google need to disconnect their Chrome core update mechanism from the extension updates (unless ones of their own authorship). Of course, they cannot do anything about users accepting updates directly from independent extension writers.
Otherwise, Chrome is dead in the water.
The whole notion of automatic updates just doesn't make any sense.
Please assure that you're not one of those people who complain about users running unpatched Windows boxes because they turned off auto-update.
For the average non-techy user auto-update is the one thing I'd say is essential. They're not in any position to judge what parts of their system need, or don't need updates, and I'd rather that they trust in Google, or Microsoft, or even Canonical to decide for them.
Now, you can debate the fine points, about whether minor plug-ins should auto-update, or ask why Java on Windows boxes seems to want to update every third day, as does Adobe Reader, but in general I'd still argue that auto-updates are good security practice.
Three Squirrels
to my Firefox extension and they were all kinda shady. Extension development is kinda niche to begin with, so I figured they were planning something like this. I'm just surprised it took so long for people to notice.
I don't see it as a huge problem though. Most extension developers are like me, hobbiests and enthusiasts. There's really only a few big ones (like Adblock Plus and Firebug) and those are big enough they're not a target for these sorts of things.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
I can't imagine there an easy fix to this. Is it time to go to yet another browser?
Obviously what we need to be really secure is a Open Source browser.... uh... oh... never mind....
Three Squirrels
They already have. The option to allow ads from people that have paid AdBlock is checked by default. https://easylist-downloads.adblockplus.org/exceptionrules.txt
I think you typed in jest, but I think you are still spot-on.
The biggest problem I see is all these scripting thingies where webmasters can insist you run arbitrary code in order to view their page. The magic of our legal system allows them to do all this ""hold harmless" stuff regarding anything you ingest at their site. See if this "hold harmless" talk also applies to restaurants. It won't. You eat some restaurant's food and get sick, the restaurant owner has a lot of explaining to do. If common law held anyone who insisted arbitrary code be run in order to view content - hold them liable for malcontent - this would soon stop.
Business went to our Congress over the DMCA and had really stiff penalties legally levied on anyone who violated their business model. Any chance our Congress take our computer infrastructure integrity as seriously as they take the illegal downloading of a song?
If some business made it mandatory you eat one of their candies in order to enter the business, should they be held liable if the candies they insisted on caused a diabetic to go into a coma? Or should their relationship with the U.S. Congress insulate them from liability?
The difference I see is that business will organize and put their concerns before Congress and hound them until they pass whatever legislation they want, whereas voters seem to vote for whoever has the best sound bites, and do not hold their congressmen to their campaign promises. So we end up with software we can't trust.
I rant and rave all the time here bagging on Microsoft for caving in to special interests for things like backdoors and DRM, both of which are hijackable and used to annoy the hell out of those who lack the hacking skills to pirate the damm stuff in the first place. But then, very little of this is Microsoft's doing... its just that they provide the means for others to do this.
I posted a few days ago about Micrium's stuff. ( uC/OS II). I guess the only OS I consider truly secure. Rom-able. Why this is not the standard for standalone industrial controllers is beyond me.
I get so fed up with the way we do things in these Von-Neuman ( Princeton ) architecture machines where we mix code and data. I do not think anyone can really code a secure OS where there is no hardware line of demarcation over what is OS and what is user code. Personally, I would love to see someone come up with something like the Android - running ROM - on a Harvard machine, requiring a physical jumper to re-flash its ROM. Something completely open-source so nobody is trying to hide anything about the inner workings of the OS. The OS would be like a toolbox - handling all the devices on the system. And that's all it would do. Manage the TCP/IP stack, display, keyboard, USB port, HDD files, RAM, and sound. Virus? It will have to infect an app, which now will no longer have a proper signature when its files are verified by the OS's file hasher. Bad app? Delete it. Phoning home app? It HAS to go through the OS to get to the TCP/IP stack, and the OS will rat it out.
Running arbitrary code? Go ahead with Java. In RAM. In the data space. Interpreted. It can't really do anything the OS won't let it do... and its completely helpless to overwrite the OS so it can get its way, as it cannot install the necessary jumper plug that enables the write current.
We take something so simple, and make a helluva mess out of it, just so some special interests can manipulate it at everyone else's expense. Tragedy of the Commons.
"Prove all things; hold fast that which is good." [KJV: I Thessalonians 5:21]
Would anyone be surprised to learn the NSA has been doing similar tactics, strong-arming popular extension writer like ad-blockers to spy on users?
That's why I use a hosts file.
Where's that guy that aways talks about hosts files on here?
Patience... He's typing now. The clipboard only holds so much.
So you sit down and check on the health of your machine, you go through logs reading on what is vulnerable, and then you manually apply security patches.
How is this relevant in a discussion about what is best for a normal user again?
The normal user can barely be trusted to check in their car for a scheduled service let alone go through security updates one at a time. Like it or not the number of security threats caused by malicious updates is infinitesimal compared to the number of security threats caused by bugs which haven't been patched.
Many users probably have never heard of regedit. However, for someone posting on /. it shouldn't be that hard.
I've looked for regedit in the Fedora repo and I couldn't find it.
Some of what I say is fact, some is conjecture, the rest I'm just blowing out my ass...you guess.