Question

One of the more powerful features of modern day browsers is the ability for software developers to write browser extensions to enhance, modify and tweak the pages visited by the user. As more of our lives migrate onto the browser, aren t we potentially exposing ourselves to a massive privacy and security holes created by the installation of a browser extension that is malicious in nature?

I realize the source code of these extensions is extractable and readable if the author has not made attempts to obfuscate the behavior. But the effectiveness of this type of review is compromised by the browser encouraging users to keep their extensions up to date. While version 1.0 of an extension may be innocuous, a users browser may suggest an upgrade to version 1.1 which could contain malicious code which could be used to scrape information from the screen of the compromised browser.

As both a user and developer of browser extensions, is the developer s reputation the only thing in place to provide assurances to their users that their browsing activity will be secure? Are there any mechanisms in place to help protect users from a compromised browser extension?

Are there any best-practices to develop extensions in a manner that provides users with the assurance that the code they install and update is benign in nature?

Answer 1

Browser extensions can do almost anything user can do. They can send your bank passwords, read files on local disk, execute commands etc. Security of a browser depends not only on browser itself, but also on all installed extensions.

Answer 2

I ve written a few extensions for Chrome recently, and I had no idea how much harm extensions could really do before that.

Extensions ask for permissions, but these are very broad. Any non-trivial extension would most likely end up asking for "Full Permission", and most users would just bang the "YES" button. Even a tech savvy user may shrug this off as legitimate, I know I have.
Most extensions are free. It costs time and money to code them up, so how are developers getting their investment back? Some do it for fun, but chrome web store specifically asks if you are planning to inject adds - I can only deduce that this is a common practice for extension developers. Extensions could also act as tracking cookies, and sell usage stats to whomever.
It s near trivial to write an extension that would glob up your passwords and send them on to a third party. Even if these passwords are saved . One of my extensions had a legitimate use case to modify all input fields on all pages, and I found out that chrome would just happily paste-in stored passwords in plain text. Same goes for CC information.
Many extensions include analytics packages, to help developers identify who their users are, which parts of the app is used and so forth. I think that this is a legitimate use case, but you may not necessarily agree.
If you are a developer, be advised that Chrome extensions could significantly impact page load times. My own extension, which I tirelessly optimized to be as lightweight as possible, caused all pages to have an additional 50-200ms load time.

So after I ve seen what s possible, I ve disabled all extensions in Chrome except for my own. I really only miss AdBlock.

Answer 3

Internet Explorer Browser Helper Objects are extremely unsafe. They basically allow the browser to run native code, which could be anything. I m not sure if they re still as pervasive now as they were in years past, but they re one of the reasons why Internet Explorer is so much less secure than Firefox and other browsers.

Mozilla style plug-ins using XUL and Microsoft s Silverlight plug-ins are sandboxed to try and prevent malicious behavior. Ultimately it rests on the developer s reputation for any kind of software to be deemed trustworthy by its users, however. Even in cases where the developer is not trying to write malware, bugs in the program may expose security exploits.

友情链接