Slashdot Mirror
A Bug in Browser Extension Grammarly, Now Patched, Could Have Allowed an Attacker To Read Everything Users Wrote Online (gizmodo.com)
Copyediting app Grammarly included a gaping security hole that left users of its browser extension open to more embarrassment than just misspelled words. From a report: The Grammarly browser extension for Chrome and Firefox contained a "high severity bug" that was leaking authentication tokens, according to a bug report by Tavis Ormandy, a security researcher with Google's Project Zero. This meant that any website a Grammarly user visited could access the user's "documents, history, logs, and all other data," according to Ormandy. Grammarly provides automated copyediting for virtually anything you type into a browser that has the extension enabled, from blogs to tweets to emails to your attorney. In other words, there is an unfathomable number of scenarios in which this kind of major vulnerability could result in disastrous real-world consequences. Grammarly has approximately 22 million users, according to Ormandy, and the company told Gizmodo in an email that it "has no evidence that any user information was compromised" by the security hole. "We're continuing to monitor actively for any unusual activity," a Grammarly spokesperson said.
Based on the adverts I've seen for this service, it looks like it is first-and-foremost a browser-based keylogger anyway, with the copy editing features just being the hook to get people to install (and pay?) for the 'service'. The 'bug' is probably just that actors other than paying companies and intelligence agencies can get free access to the data.
Firefox recently switched to the WebExtensions model for browser extensions, which is basically Firefox's imitation of Chrome's extension system.
Firefox 57, which was released in the middle of November 2017, was hugely disruptive. It broke nearly all of Firefox's existing extensions, and worst of all, there are some existing extensions that couldn't even be reimplemented properly because WebExtensions is so crippled and limited.
The crippling of Firefox's extension system, which rendered Firefox nearly useless for many power users, was justified by saying that it made Firefox's users "safer". Of course, many sensible Firefox users were skeptical of these claims.
I think that this incident just goes to show that the Firefox users who questioned the security claims being made about WebExtensions were absolutely correct.
So now Firefox is not only crippled and much less useful than it was just a few months ago, but we haven't even realized any security gains from the switch over to the extension system that imitates Chrome's approach.
The Firefox 57 debacle was already bad enough, but this incident makes it even worse than it already was, I think.
From malware applications in operating systems to malware extensions in web browsers - we've come full circle. The browser is now the OS inside another OS.
I'm eagerly awaiting full-blown antivirus programs for web browsers since we obviously can't trust the Walled Garden(r) to protect us.
Just in case this point isn't clear to everyone, the famous Meltdown bug (exemplified precisely with an attacker reading in plain text the passwords you type in Chrome) belongs to a completely different level of problems. This article is about the given application/process (for this purpose, a plugin can be considered part of the same application) leaking some of the information which the user stored in it. Meltdown is about a different application/process presumably reading information of the target one (Chrome/plugin in this case) which is stored in the given computer's memory.
A quite descriptive analogy would be forgetting your wallet somewhere vs. someone reading your mind to know where your wallet is. I am not implying that exploiting meltdown is as unlikely as reading someone's mind, but it doesn't seem too easy anyway (not sure though). Anyone wanting to share some insights into all this is welcome to a previous discussion about it.
Custom Solvers 2.0 = Alvaro Carballo Garcia = varocarbas.
This is nothing.
Just wait till Alexa throws her party.
That'll be where the real fun is at.
Check your premises.
I am just so relieved that this commercial browser extension that effects, by my rough count, approximately 1 out of every 500 people on earth (assuming Grammarly's user counts are accurate) and offers a feature that just about everybody has no use for at all has been fixed.
Why can a plug-in even reach all the authentication tokens? Shouldn't it be only able to reach its own data? Doesn't this seem like a bug more in Firefox than in Grammerly? It sounds like a sandbox violation.
Egads, foiled again!
"A Bug in Browser Extension Grammarly, Now Patched, Could Have Allowed an Attacker To Read Everything Users Wrote Online"
Good thing the only place I used it was writing Wikipedia articles then.
And some of us are experts at programming who have studied the field for decades, yet compilers and static analysis tools are always finding errors in our code (and many still go unnoticed). I guess we don't need those analysis tools, either, we should just try harder and hope for the best?
t) *sound of shredder going into standby*
t+1)
Requiem for the American Dream
Based on the adverts I've seen for this service, it looks like it is first-and-foremost a browser-based keylogger anyway, with the copy editing features just being the hook to get people to install (and pay?) for the 'service'.
Yup, I find it personally disturbing that people will let some shady 3rd party unknown server somewhere in Ukraine access (for "proof reading") every single thing they type online.
You're better off using some technology that can be installed locally (or on your own-controlled servers):
e.g.: LanguageTool
- it has a webextension
- it can be downloaded as a stand-alone version.
(- and of course, you can point the extension to the URL of your stand-alone server)
(both of the above are Free/Libre OpenSource Software, so auditable against nefarious code)
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
The plugin is a proof-reading tool.
It makes all the nice colored wavy line under your mistakes.
It works in an TEXTAREA> <INPUT TYPE="text"> etc.
This particular plug-in doesn't do the proof reading it self,
it sends the text-to-be-corrected to some cloud server where the actual proof reading algorithms run.
So for the plugin to work (and colored wavy line to appear), the plugin needs to send everything you type out of your computer.
It's basically a giant keylogger - BY DESIGN.
It's just that some attackers have found a way to tap into the traffic and benefit from the built-in key-loging too.
But it's the whole design of Grammarly which is flawed to begin with.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]