Slashdot Mirror
A Bug in Browser Extension Grammarly, Now Patched, Could Have Allowed an Attacker To Read Everything Users Wrote Online (gizmodo.com)
Copyediting app Grammarly included a gaping security hole that left users of its browser extension open to more embarrassment than just misspelled words. From a report: The Grammarly browser extension for Chrome and Firefox contained a "high severity bug" that was leaking authentication tokens, according to a bug report by Tavis Ormandy, a security researcher with Google's Project Zero. This meant that any website a Grammarly user visited could access the user's "documents, history, logs, and all other data," according to Ormandy. Grammarly provides automated copyediting for virtually anything you type into a browser that has the extension enabled, from blogs to tweets to emails to your attorney. In other words, there is an unfathomable number of scenarios in which this kind of major vulnerability could result in disastrous real-world consequences. Grammarly has approximately 22 million users, according to Ormandy, and the company told Gizmodo in an email that it "has no evidence that any user information was compromised" by the security hole. "We're continuing to monitor actively for any unusual activity," a Grammarly spokesperson said.
Based on the adverts I've seen for this service, it looks like it is first-and-foremost a browser-based keylogger anyway, with the copy editing features just being the hook to get people to install (and pay?) for the 'service'. The 'bug' is probably just that actors other than paying companies and intelligence agencies can get free access to the data.
Firefox recently switched to the WebExtensions model for browser extensions, which is basically Firefox's imitation of Chrome's extension system.
Firefox 57, which was released in the middle of November 2017, was hugely disruptive. It broke nearly all of Firefox's existing extensions, and worst of all, there are some existing extensions that couldn't even be reimplemented properly because WebExtensions is so crippled and limited.
The crippling of Firefox's extension system, which rendered Firefox nearly useless for many power users, was justified by saying that it made Firefox's users "safer". Of course, many sensible Firefox users were skeptical of these claims.
I think that this incident just goes to show that the Firefox users who questioned the security claims being made about WebExtensions were absolutely correct.
So now Firefox is not only crippled and much less useful than it was just a few months ago, but we haven't even realized any security gains from the switch over to the extension system that imitates Chrome's approach.
The Firefox 57 debacle was already bad enough, but this incident makes it even worse than it already was, I think.
for those that can spell
One more reason NOT to use extensions. Browsers are already insecure enough as it is.
From malware applications in operating systems to malware extensions in web browsers - we've come full circle. The browser is now the OS inside another OS.
I'm eagerly awaiting full-blown antivirus programs for web browsers since we obviously can't trust the Walled Garden(r) to protect us.
Just in case this point isn't clear to everyone, the famous Meltdown bug (exemplified precisely with an attacker reading in plain text the passwords you type in Chrome) belongs to a completely different level of problems. This article is about the given application/process (for this purpose, a plugin can be considered part of the same application) leaking some of the information which the user stored in it. Meltdown is about a different application/process presumably reading information of the target one (Chrome/plugin in this case) which is stored in the given computer's memory.
A quite descriptive analogy would be forgetting your wallet somewhere vs. someone reading your mind to know where your wallet is. I am not implying that exploiting meltdown is as unlikely as reading someone's mind, but it doesn't seem too easy anyway (not sure though). Anyone wanting to share some insights into all this is welcome to a previous discussion about it.
Custom Solvers 2.0 = Alvaro Carballo Garcia = varocarbas.
To be fair, Trumps's aides and campaign staff probably kept him as ignorant as possible, for fear of him revealing everything they did in braggart tweets.
This is nothing.
Just wait till Alexa throws her party.
That'll be where the real fun is at.
Check your premises.
Pwn3dly
I am just so relieved that this commercial browser extension that effects, by my rough count, approximately 1 out of every 500 people on earth (assuming Grammarly's user counts are accurate) and offers a feature that just about everybody has no use for at all has been fixed.
Why can a plug-in even reach all the authentication tokens? Shouldn't it be only able to reach its own data? Doesn't this seem like a bug more in Firefox than in Grammerly? It sounds like a sandbox violation.
users want powerful extentions (that means XUL) and they want security. Will browsers keep their users safe or will they do a Mr Robot on their data.
Egads, foiled again!
Considering Grammarly is advertised as a way for millennials to convert their horrific lack of grammar, spelling, and general knowledge of language to something approaching professional correspondence, who would *want* to read the raw text from before it was corrected? That's just masochism.
"A Bug in Browser Extension Grammarly, Now Patched, Could Have Allowed an Attacker To Read Everything Users Wrote Online"
Good thing the only place I used it was writing Wikipedia articles then.
..of their activites all the time right?
Luckily I have perfect grammar... And I don't need any thing like this... So glad.
Also he phones people in his social circles in New York and Florida which may be where some of the leaks came from.
Isn't this why we take English lessons in school? I suppose it could be helpful for ESL folk, but it seems like such a niche service...
emails to your attorney
Yeah, grownups writing emails to their attorney aren't using a webmail client, and don't have this crap installed anyway.
t) *sound of shredder going into standby*
t+1)
Requiem for the American Dream
Based on the adverts I've seen for this service, it looks like it is first-and-foremost a browser-based keylogger anyway, with the copy editing features just being the hook to get people to install (and pay?) for the 'service'.
Yup, I find it personally disturbing that people will let some shady 3rd party unknown server somewhere in Ukraine access (for "proof reading") every single thing they type online.
You're better off using some technology that can be installed locally (or on your own-controlled servers):
e.g.: LanguageTool
- it has a webextension
- it can be downloaded as a stand-alone version.
(- and of course, you can point the extension to the URL of your stand-alone server)
(both of the above are Free/Libre OpenSource Software, so auditable against nefarious code)
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
The plugin is a proof-reading tool.
It makes all the nice colored wavy line under your mistakes.
It works in an TEXTAREA> <INPUT TYPE="text"> etc.
This particular plug-in doesn't do the proof reading it self,
it sends the text-to-be-corrected to some cloud server where the actual proof reading algorithms run.
So for the plugin to work (and colored wavy line to appear), the plugin needs to send everything you type out of your computer.
It's basically a giant keylogger - BY DESIGN.
It's just that some attackers have found a way to tap into the traffic and benefit from the built-in key-loging too.
But it's the whole design of Grammarly which is flawed to begin with.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
The grammar/syntax is just much more limited that most languages. Any programming book is just a series of instructions to teach your meat computer how to program.