Slashdot Mirror
How Web Apps Can Turn Browser Extensions Into Backdoors (threatpost.com)
"Threatpost has a link to some recent research about ways web pages can exploit browser extensions to steal information or write files," writes Slashdot reader jbmartin6. "Did we need another reason to be deeply suspicious of any browser extension? Not only do they spy on us for their makers, now other people can use them to spy on us as well. The academic paper is titled 'Empowering Web Applications with Browser Extensions' (PDF)." From the report: "An attacker [uses] a script that is present in a web application currently running in the user browser. The script either belongs to the web application or to a third party. The goal of the attacker is to interact with installed extensions, in order to access user sensitive information. It relies on extensions whose privileged capabilities can be exploited via an exchange of messages with scripts in the web application," researchers wrote. They added, "Even though content scripts, background pages and web applications run in separate execution contexts, they can establish communication channels to exchange messages with one another... APIs [are used] for sending and receiving (listening for) messages between the content scripts, background pages and web applications."
The researcher behind the paper focused on a specific class of web extension called "WebExtensions API," a cross-browser extensions system compatible with major browsers including Chrome, Firefox, Opera and Microsoft Edge. After analyzing 78,315 extensions that used the specific WebExtension API, it found 3,996 that were suspicious. While it seems voluminous, they noted that research found a small number of vulnerable extensions overall, and that concern should be measured. However, "browser vendors need to review extensions more rigorously, in particular take into consideration the use of message passing interfaces in extensions."
The researcher behind the paper focused on a specific class of web extension called "WebExtensions API," a cross-browser extensions system compatible with major browsers including Chrome, Firefox, Opera and Microsoft Edge. After analyzing 78,315 extensions that used the specific WebExtension API, it found 3,996 that were suspicious. While it seems voluminous, they noted that research found a small number of vulnerable extensions overall, and that concern should be measured. However, "browser vendors need to review extensions more rigorously, in particular take into consideration the use of message passing interfaces in extensions."
So basically the whole "we're dropping XUL for webextensions. Because...uh...security!" thing from mozilla which crippled all my favourite extensions was pointless.
Everything is supposed to run that way anyway, right? This shouldn't be an issue.
“He’s not deformed, he’s just drunk!”
open source projects never get hacked or bought by malware companies, so you're right. don't be suspicious at all, ever.
He said: "Trust but verify."
In the latter case, open source is above suspicion, and in any case, it's more trustworthy than closed source, where you cannot even tell without a massive effort.
QED. You're a moron and an asshole.
The anonymous post that included "Trust but verify." was right; only software freedom gives us the best known defense against malware. I don't agree with post moderation but if a discussion forum will have such censorious distractions, posts like that deserve far more than 0 points.
Your post, on the other hand, in which you claim that software freedom is "bullshit" ironically highlights how valuable software freedom is: separating functionality into components solves nothing if those components are implemented with non-free (user-subjugating, proprietary) software. Whatever value the separation purports to grant users is entirely lost by not respecting a user's software freedom. In fact we know that proprietary software is often malware.
Digital Citizen