Krebs: The Case for Limiting Your Browser Extensions

Topic

New Reply

Last week, KrebsOnSecurity reported to health insurance provider Blue Shield of California that its Web site was flagged by multiple security products as serving malicious content. Blue Shield quickly removed the unauthorized code. An investigation determined it was injected by a browser extension installed on the computer of a Blue Shield employee who’d edited the Web site in the past month.

The incident is a reminder that browser extensions — however useful or fun they may seem when you install them — typically have a great deal of power and can effectively read and/or write all data in your browsing sessions. And as we’ll see, it’s not uncommon for extension makers to sell or lease their user base to shady advertising firms, or in some cases abandon them to outright cybercriminals.

6 users thanked author for this post.

Elly, woody, Morty, AlphaCharlie, Kirsty, Lars220

Reply | Quote

Replies

Thank you  satrow  recently there has been a lot of information about privacy and security concerning web browsers.  It is good that you remind us about browser extensions also.  Chris Hoffman  of  How-To Geek  website has an older 2017 article that is still worthwhile reading:

Browser Extensions Are a Privacy Nightmare:
Stop Using So Many of Them
By Chris Hoffman August 14, 2017
Browser extensions are much more dangerous than most people realize.
https://www.howtogeek.com/188346/why-browser-extensions-can-be-dangerous-and-how-to-protect-yourself/

Also, Firefox Support has some “Tips for assessing the safety of an extension” that offers some good advice:
https://support.mozilla.org/en-US/kb/tips-assessing-safety-extension

5 users thanked author for this post.

Elly, SueW, Morty, Cybertooth, AlphaCharlie

Reply | Quote

True all. Personally, if I’m unsure of the extension author, I’ll download the extension and look through the source code. I never allow auto updates and I always read release notes before updating (except for one because I’m on the dev channel).

If there’s a permissions change requested during an update, I’ll cancel it and some do some research to make sure the author has documented the reason why. If not, then that may be a clue of a change of ownership and trouble ahead.

Look for reviews of extensions on the intertubes and any comments. A good source is gHacks (Martin Brinkmann). If an extension is new, check other extensions written by the author. Has he written others that are well known? Reputation can help you make an informed decision. A reputable, well-known author will usually disclose the purpose of any remote connections and what data is exchanged.

Since Mozilla now uses an automated system for extension checks before publishing, you have to be on your toes. Baddies do slip by. Ownership could change hands to bad actors.

It goes without saying, be wary of any frivolous extensions (e.g. coupons), those that have names similar to well-known ones, or ones that claim to add “features” to well established ones.

1 user thanked author for this post.

Morty

Reply | Quote

Well worth reading the entire Krebs post.

Scary!

2 users thanked author for this post.

Elly, satrow

Reply | Quote

A large number of extension authors make their source code available on GitHub. But, is that the code you’re actually getting when you click the “Add to Firefox” button?

If you right-click the “Add to Firefox” button, you can save the installation package locally. It will have the file extension “xpi” (e.g. myextension.xpi). An xpi file can be installed off-line. It’s actually an archive.

Use 7-Zip to unpack the xpi file. Now you have the source code of the extension (css, javascript, json). You can open individual files with a simple text editor (e.g. notepad, notepad++). You do not have to be a programmer to do basic checks.

For example, the file “manifest.json” will provide useful information such as where the extension gets its updates. Example:

“update_url”: “https://clients2.google.com/service/update2/abc”

If any of the files are obfuscated (unreadable), then this against Mozilla guidelines for extensions. The rule to remember is “If you can’t read it, don’t install it.”

Look for URLs, IP addresses, and filenames in the source files. If something looks strange, use the rule “If in doubt, throw it out”.

4 users thanked author for this post.

JC Zorkoff, cesmart4125, SueW, Lars220

Reply | Quote