News, tips, advice, support for Windows, Office, PCs & more. Tech help. No bull. We're community supported by donations from our Plus Members, and proud of it
Home icon Home icon Home icon Email icon RSS icon
  • Krebs: The Case for Limiting Your Browser Extensions

    Home Forums AskWoody support Questions: Browsers and desktop software Updates for browsers, apps and add-ins Krebs: The Case for Limiting Your Browser Extensions

    Viewing 4 reply threads
    • Author
      Posts
      • #2175810 Reply
        satrow
        AskWoody MVP

        Last week, KrebsOnSecurity reported to health insurance provider Blue Shield of California that its Web site was flagged by multiple security products as serving malicious content. Blue Shield quickly removed the unauthorized code. An investigation determined it was injected by a browser extension installed on the computer of a Blue Shield employee who’d edited the Web site in the past month.

        The incident is a reminder that browser extensions — however useful or fun they may seem when you install them — typically have a great deal of power and can effectively read and/or write all data in your browsing sessions. And as we’ll see, it’s not uncommon for extension makers to sell or lease their user base to shady advertising firms, or in some cases abandon them to outright cybercriminals.

        6 users thanked author for this post.
      • #2176042 Reply
        Lars220
        AskWoody Lounger

        Thank you  satrow  recently there has been a lot of information about privacy and security concerning web browsers.  It is good that you remind us about browser extensions also.  Chris Hoffman  of  How-To Geek  website has an older 2017 article that is still worthwhile reading:

        Browser Extensions Are a Privacy Nightmare:
        Stop Using So Many of Them
        By Chris Hoffman August 14, 2017
        Browser extensions are much more dangerous than most people realize.
        https://www.howtogeek.com/188346/why-browser-extensions-can-be-dangerous-and-how-to-protect-yourself/

        Also, Firefox Support has some “Tips for assessing the safety of an extension” that offers some good advice:
        https://support.mozilla.org/en-US/kb/tips-assessing-safety-extension

        5 users thanked author for this post.
      • #2176072 Reply
        Carl
        AskWoody Plus

        True all. Personally, if I’m unsure of the extension author, I’ll download the extension and look through the source code. I never allow auto updates and I always read release notes before updating (except for one because I’m on the dev channel).

        If there’s a permissions change requested during an update, I’ll cancel it and some do some research to make sure the author has documented the reason why. If not, then that may be a clue of a change of ownership and trouble ahead.

        Look for reviews of extensions on the intertubes and any comments. A good source is gHacks (Martin Brinkmann). If an extension is new, check other extensions written by the author. Has he written others that are well known? Reputation can help you make an informed decision. A reputable, well-known author will usually disclose the purpose of any remote connections and what data is exchanged.

        Since Mozilla now uses an automated system for extension checks before publishing, you have to be on your toes. Baddies do slip by. Ownership could change hands to bad actors.

        It goes without saying, be wary of any frivolous extensions (e.g. coupons), those that have names similar to well-known ones, or ones that claim to add “features” to well established ones.

        1 user thanked author for this post.
      • #2176434 Reply
        woody
        Da Boss

        Well worth reading the entire Krebs post.

        Scary!

        2 users thanked author for this post.
      • #2176518 Reply
        Carl
        AskWoody Plus

        A large number of extension authors make their source code available on GitHub. But, is that the code you’re actually getting when you click the “Add to Firefox” button?

        If you right-click the “Add to Firefox” button, you can save the installation package locally. It will have the file extension “xpi” (e.g. myextension.xpi). An xpi file can be installed off-line. It’s actually an archive.

        Use 7-Zip to unpack the xpi file. Now you have the source code of the extension (css, javascript, json). You can open individual files with a simple text editor (e.g. notepad, notepad++). You do not have to be a programmer to do basic checks.

        For example, the file “manifest.json” will provide useful information such as where the extension gets its updates. Example:

        “update_url”: “https://clients2.google.com/service/update2/abc”

        If any of the files are obfuscated (unreadable), then this against Mozilla guidelines for extensions. The rule to remember is “If you can’t read it, don’t install it.”

        Look for URLs, IP addresses, and filenames in the source files. If something looks strange, use the rule “If in doubt, throw it out”.

        4 users thanked author for this post.
    Viewing 4 reply threads

    Please follow the -Lounge Rules- no personal attacks, no swearing, and politics/religion are relegated to the Rants forum.

    Reply To: Krebs: The Case for Limiting Your Browser Extensions

    You can use BBCodes to format your content.
    Your account can't use Advanced BBCodes, they will be stripped before saving.