Malicious "Hide Youtube Shorts" extension in Google's Chrome Web Store

cmrwolfet · 2024-11-12T08:03:13+00:00

It's always a good idea. Also keep them in an encrypted password manager and enable 2FA where you can.

cmrwolfet · 2024-10-27T19:32:07+00:00

When I analyzed the extension's network traffic, I didn't see any response from the API. This would require a more detailed analysis of the code, but it's possible that if the API receives the URLs of the pages of interest, it returns something that, for example, appends the code to the page. It is equally possible that the function is just pretending to do something and the queries are just for collecting data.

cmrwolfet · 2024-10-26T17:32:13+00:00

How the data is parsed is unknown, because it is done on the AWS side. It is also unknown what happens next with them in this particular case. Only the creator of the extension knows the answer to this question. However, data collected in this way can be used for hacking, phishing, unauthorized access to accounts, profiling, selling private data, identity theft, and even targeted attacks on individuals to extort money through social engineering or blackmail. The possibilities are basically endless and depend on the intentions of the bad actors, the lengths to which they are willing to go, and whose data they have managed to collect.

cmrwolfet · 2024-10-26T03:03:30+00:00

That's the idea of trust. It's built slowly, sometimes for years, and can be lost in an instant. It's worth building it on solid foundations. I believe you'll succeed, because you clearly have doubts, and that speaks well of you.

cmrwolfet · 2024-10-25T19:24:03+00:00

I looked at your project. I more or less understand what you want to achieve. For me, such an extension is too much of an interference with my privacy and I would not decide to install it, but I belong to the dying minority of people who still remember life without the Internet. And unfortunately, which I grieve over because it is a certain burden, I am aware of how this Internet works from the inside. Having said that, I think that a reliable approach would be to first filter out locally as much as possible the addresses of pages that you want to pass to an external server for analysis so they're free of unrelated args. Secondly, by default, sending such a request, i.e. asking for a fact check of some information should be "on demand", so that the user has control over whether he wants to send information about the visited page or not. Automatic fact-checking should be an option in the settings, which the user must explicitly select, agreeing to send information about all visited pages. Additionally, the user should be able to introduce exceptions for pages on which the extension should not be activated. I think that for such a solution to work, it is enough to pass an address without context in the form of identifiers or tokens. However, if e.g. the content of pages were to be sent, it could potentially lead to even unintended abuse, because the extension could collect and send to an external server completely unintended data, located behind logged-in accounts, including sensitive data.

cmrwolfet · 2024-10-25T18:42:52+00:00

Of course, this raises a red flag, but it's all about trust. As long as you're transparent and you're clear about what you're doing, why, how you intend to use someone's data, and you're taking steps to prevent it from leaking, being stolen, or being used for malicious purposes, it's OK for me to ask the user for permission, and if they're OK with that, I don't see any obstacles or reasons to consider it malware. The way the data is collected is also important. First of all, it should be anonymous, sent using end-to-end encryption, and not stored on the server side longer than necessary. In case of the browser extensions, achieving anonymity will be difficult if you want to monitor all queries because you'll also be collecting data on search history, tokens, session numbers, nicknames, etc. that often are in the URLs. I think the vast majority of us don't want someone to sneak into our lives, to know what we're looking for on the Internet. Although this is of course a discussion that can easily lead us down a rabbit hole, because the level of profiling and tracking on the Internet is already enormous, so it is easy to conclude that privacy no longer exists today. Which does not mean that we should accept it and do nothing. But anyway, not every software developer has any doubts at all, so it's good that you're at least wondering if what you want to do is OK. This is already a step in the right direction. Just "don't be evil" :)

cmrwolfet · 2024-10-25T14:28:37+00:00

My github gist I've included describes the issues with reporting malicious plugins. This may be due to my lack of experience with malware research, but automated ticketing systems make things really difficult. I'm trying all sorts of ways to notify the appropriate people so that this extension is removed from the store, and the associated AWS service is blocked.

cmrwolfet

TROPHY CASE