How Web Apps Can Turn Browser Extensions Into Backdoors (threatpost.com) 34
"Threatpost has a link to some recent research about ways web pages can exploit browser extensions to steal information or write files," writes Slashdot reader jbmartin6. "Did we need another reason to be deeply suspicious of any browser extension? Not only do they spy on us for their makers, now other people can use them to spy on us as well. The academic paper is titled 'Empowering Web Applications with Browser Extensions' (PDF)." From the report: "An attacker [uses] a script that is present in a web application currently running in the user browser. The script either belongs to the web application or to a third party. The goal of the attacker is to interact with installed extensions, in order to access user sensitive information. It relies on extensions whose privileged capabilities can be exploited via an exchange of messages with scripts in the web application," researchers wrote. They added, "Even though content scripts, background pages and web applications run in separate execution contexts, they can establish communication channels to exchange messages with one another... APIs [are used] for sending and receiving (listening for) messages between the content scripts, background pages and web applications."
The researcher behind the paper focused on a specific class of web extension called "WebExtensions API," a cross-browser extensions system compatible with major browsers including Chrome, Firefox, Opera and Microsoft Edge. After analyzing 78,315 extensions that used the specific WebExtension API, it found 3,996 that were suspicious. While it seems voluminous, they noted that research found a small number of vulnerable extensions overall, and that concern should be measured. However, "browser vendors need to review extensions more rigorously, in particular take into consideration the use of message passing interfaces in extensions."
The researcher behind the paper focused on a specific class of web extension called "WebExtensions API," a cross-browser extensions system compatible with major browsers including Chrome, Firefox, Opera and Microsoft Edge. After analyzing 78,315 extensions that used the specific WebExtension API, it found 3,996 that were suspicious. While it seems voluminous, they noted that research found a small number of vulnerable extensions overall, and that concern should be measured. However, "browser vendors need to review extensions more rigorously, in particular take into consideration the use of message passing interfaces in extensions."
So (Score:1)
So basically the whole "we're dropping XUL for webextensions. Because...uh...security!" thing from mozilla which crippled all my favourite extensions was pointless.
Re:So (Score:5, Insightful)
Yep. Anyone with a drop of decent cynicism knows that the goal is to cripple ad blocking and privacy protection and that "security" is just the excuse.
Re: (Score:2)
And mine. The timing of this story seems awfully coincidental after Google's bad PR yesterday with the proposed Chromium changes.
Re: (Score:2)
The goal for us is to cripple the cripplers. Having a browser-independent updated HTTPS-ready version of Proxomitron would really help.
Re: (Score:2)
Re: (Score:2)
Strawman. He never said that. (Score:1)
He said: "Trust but verify."
In the latter case, open source is above suspicion, and in any case, it's more trustworthy than closed source, where you cannot even tell without a massive effort.
QED. You're a moron and an asshole.
Re: (Score:2)
OK. Case study students.
First example, Microsoft Windows 10. Everybody knows it is snooping on users in ways that many do not approve of. It has been doing so since it's release and very little has changed. No one has come up with a reliable fix.
Second example. Cisco routers have been found to have hard coded back door accounts built into them. This has happened several times. Pretty much any one with even a modest understanding of system security knows this to be poor practice. No one outside of
Software freedom is best defense against malware (Score:2)
The anonymous post that included "Trust but verify." was right; only software freedom gives us the best known defense against malware. I don't agree with post moderation but if a discussion forum will have such censorious distractions, posts like that deserve far more than 0 points.
Your post, on the other hand, in which you claim that software freedom is "bullshit" ironically highlights how valuable software freedom is: separating functionality into components solves nothing if those components are implemen
Re: (Score:2)
Yep. Anyone with a drop of decent cynicism knows that the goal is to cripple ad blocking and privacy protection and that "security" is just the excuse.
But think of the children!
Re: (Score:2)
isn't it quite obvious that a web page can communicate with a browser extension though? like really fucking obvious? further than that you could just make the extension exploit the computer directly as long as you're coding it...
What's up with sandboxing? (Score:1)
Everything is supposed to run that way anyway, right? This shouldn't be an issue.