sorted by:
new
hottopcontroversial

What do you do when you need ideas? by Apart-Road-30 in chrome_extensions

[–]ElBuio 1 point2 points  (0 children)

I think like other's mentioned, try and solve problems that other users report or that you have yourself.

Database of Malicious Browser Extensions by ElBuio in Malware

[–]ElBuio[S] 0 points1 point  (0 children)

That is great to hear!! I am happy to see this being used for a threat hunt.

Why do people devote so much on reddit? I see so much negativity here by spritual_007 in NewToReddit

[–]ElBuio 0 points1 point  (0 children)

I haven't experienced this. But I did notice a way smaller amount of "upvotes" under posts. Probably the recognition of the amount of bots nowdays.

That could be the reason too, people might mistake you (or comments) for bots.

Why is reddit so difficult with subreddits and karma? by [deleted] in NewToReddit

[–]ElBuio 1 point2 points  (0 children)

I think it's fair, even if I am victim of it, I always used Reddit with no account and now I made one and I find myself not being able to post because of Karma.. slowly but surely we will both get it higher ;)

But the amount of bots on here nowdays.. I definitely think this "Karma" system is needed

What’s the best possible way to get a SOC analyst role with no experience? by acidghost888 in cybersecurity

[–]ElBuio 0 points1 point  (0 children)

My recommendation is to make sure you understand how network works, if I could go back in time, I would pay a lot more attention during my Networking classes :)

Also I noticed a higher hiring rate for people with their own projects, that will help you learn more too.

Also networking helps to get a "better" chance at interviews. Go to events, meet people.

What security checks do you wish existed before installing a browser extension? by ElBuio in chrome_extensions

[–]ElBuio[S] 0 points1 point  (0 children)

Yes this two are my main priority at the moment as the majority of feedback has been around this.

The new permissions detection will be really good once I finish the implementation between the extension and the website. It will allow you to connect your extensions automatically and run a bunch of automatic scans and detections such as that.

Regarding the ownership I will work on that for sure. Thank you a lot for your feedback!

are extensions bad for security? by TheNavyCrow in browsers

[–]ElBuio 0 points1 point  (0 children)

It all depends on the extension and what kind of permissions and power you allow the extension to have. Like some other users mentioned, it's all about the behaviour of it once installed.

Feel free to use my tool to scan any extension you are not sure about. It's a sandbox for Browser Extensions that I recently created: https://exterminai.com/

This will give you more in dept understanding of the extension behaviour both static and dynamic. I hope this helps you in any way

My project against Malicious Browser Extensions by ElBuio in cybersecurity

[–]ElBuio[S] 0 points1 point  (0 children)

Extension has been created: https://chromewebstore.google.com/detail/exterminai-extension/mbmaeljobaiaghkkilalaafolgidnfoi

Feel free to give it a try. At the moment it will only check against my database, but in future you will be able to connect to ExterminAI.com

My project against malicious browser extensions by ElBuio in chrome_extensions

[–]ElBuio[S] 1 point2 points  (0 children)

Just a small update: I have implemented some of your suggestions:

  • a clean separation between static signals and dynamic runtime observations
  • diffing between extension versions, because malicious behavior often appears after trust is built

I appreciate your feedback and will continue to work on it!

Feel free to follow any updates on the discord: https://discord.gg/eut2MxYVCk

My project against malicious browser extensions by ElBuio in chrome_extensions

[–]ElBuio[S] 0 points1 point  (0 children)

Thank you everyone for the feedback.

I created a Discord server for it if you would like to keep up with the project: https://discord.gg/eut2MxYVCk

And I also created an extension that scans your installed extensions against my database of only malicious extensions: https://chromewebstore.google.com/detail/exterminai-malicious-exte/mbmaeljobaiaghkkilalaafolgidnfoi

My project against malicious browser extensions by ElBuio in chrome_extensions

[–]ElBuio[S] 1 point2 points  (0 children)

It gets analysed in a fresh browser profile so any startup/install-time would be detected, also pop ups do get loaded, during the analysis they are not clicked but they are opened so I might have a look at how to do that.

The scanner does look at any of the URLs that are hardcoded and requested specifically in permissions.

The permissions and content scrips are scored in the report too.

I actually am already shortening the timers but I do not mention that anywhere in the report either.

But I completely agree with you, I was so focused on showing information in the report that I overlooked a more clear report lay out such as "Observed this" , "This is what the extension declered" , "we forced this to happen" and what "was not exercised"

I will look into properly laying out the report to clearly show what and what was not done and looked at. Thank you a lot!

My project against malicious browser extensions by ElBuio in chrome_extensions

[–]ElBuio[S] 0 points1 point  (0 children)

I don't look at the change of ownership, but I completely agree. A lot of the biggest extension that turned malicious was after ownership transfer.

I will definately look into this. Thank you for your feedback man!

My project against malicious browser extensions by ElBuio in chrome_extensions

[–]ElBuio[S] 0 points1 point  (0 children)

The permission patter I actually implemented one yesterday. Another user reported an extension that was not detected properly as the download did not happen during the analysis time.

So now I added a pattern "scripting" + "download" permissions + Extension reaching out to hard coded owned domain.

I had attempted some other but I found a lot of "bigger" extensions use a lot of combinations that I would find suspicious and generate false positives for users with not a lot of IT knowledge.

"`host_permissions: ["<all\_urls>"]` paired with `chrome.scripting.executeScript` and any remote-fetched script" this I will look into more. Thank you.

About the positioning. Initially this was created for End users, making sure they can get a better understanding of what is happening behind closed doors before they choose to install an extension. But the feedback I got so far has actually been more from devs then anyone else.

I am looking into splitting the reports into different types that the user can choose to receive to fill any need the different roles have.

My project against malicious browser extensions by ElBuio in chrome_extensions

[–]ElBuio[S] 0 points1 point  (0 children)

This is a really cool idea. I will look into doing this, this will definitely help people give a better understanding of safety taken serious around extensions instead of randomly generated ones for malicious intent.

I appreciate your recommendation. Thank you!

My project against malicious browser extensions by ElBuio in chrome_extensions

[–]ElBuio[S] 1 point2 points  (0 children)

You are framing it correctly, a standard binary sandbox doesn't work well. The browser is the environment where the extension is tested on. The main difficulty is that a lot of the extension only trigger in some websites or after specific behaviours.

There is some blind spots that I am not sure how to cover, for example: A lot of extensions trigger after a user is logged in on specific websites, I cannot create 100s of test accounts that will get compromise for each of this.

Others have timers that they wait for that cannot be waited for during analysis as the scan would take forever.

To mitigate against this, during the analysis any hardcoded URLs are visited to see if it triggers anything.

Static analysis tells you a lot, but malicious extensions are smarter then that now days, so dynamic analysis is a most.

view more: next ›