this post was submitted on 19 Jun 2023
16 points (100.0% liked)

Cybersecurity

6230 readers
186 users here now

c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.

THE RULES

Instance Rules

Community Rules

If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.

Learn about hacking

Hack the Box

Try Hack Me

Pico Capture the flag

Other security-related communities [email protected] [email protected] [email protected] [email protected] [email protected]

Notable mention to [email protected]

founded 2 years ago
MODERATORS
[email protected]
[email protected]
16
Disabling automatic browser extension updates as a security measure? (vlemmy.net)
submitted 2 years ago by [email protected] to c/[email protected]
6 comments fedilink hide all child comments
 

It seems every now and again some popular Chrome or Firefox extension decides to "go evil" seemingly out of nowhere.

Stylish got caught logging browser history, The Great Suspender turned out to be spyware, and, in the case of "get cookies.txt", which was endorsed by youtube-dl, apparently the user is not the only one "getting" the cookies.

In most of these cases, it seems that trustworthy extensions get sold off to some shady third parties, or the developers just "turns evil". This got me wondering: would it be an effective security precaution to simply disable updates for browser extensions? i.e. to download the extension manually from the developer, instead of relying on chrome web store / firefox addon catalogue. It wouldn't help much if the extension you're using contains malware now, but it would prevent malware being installed in potential future updates.

So, what do you guys think?

top 6 comments
sorted by: hot top controversial new old
[–] [email protected] 5 points 2 years ago (1 children)

Personally, I removed any addon that's not open-source and thus subject to inspection by outside individuals, and even then, basically have limited it to a password manager and ublock origin.

I know 'you should read the code!' is very nonsense as a security measure, but if it's public the odds of SOMEONE reading it and finding out it's doing shady shit is substantially higher, and if shady shit happens, you just fork the code pre-shady and carry on.

Also, the workflow reliance on all these add-ons has always struck me as maybe not the best choice: it's just adding software to your browser that has access to data that's of value for black hats, marketers, and other unsavory types. Even if the dev doesn't sell you out, there's no guarantee that some otherwise perfectly innocuous behavior can't later be exploited due to some security issue.

[–] [email protected] 1 points 2 years ago (1 children)

but if it’s public the odds of SOMEONE reading it and finding out it’s doing shady shit is substantially higher

See, that's the banger: The Great Suspender is licensed under GPL and its source code is available on GitHub. The malware was injected specifically into the chrome web store version. So that's why I'm slightly paranoid of automatic updates.

[–] [email protected] 1 points 2 years ago

It looks like the problem here is you can "sell" the published version along with the code, and the new developer gets access to your already installed userbase.

That uh, probably shouldn't happen. I'll even go so far as to say that's completely insane and there should be NO WAY a purchaser of anything should get access to publish a new version of something under the same name and have it push out updates without manual user intervention.

For example, Apple/iOS does it sanely where if a new person is going to publish even the exact same app, they consider it a completely separate and new piece of software and it won't auto-update the previous incarnation of itself, and it's checked for suspicious nonsense as if it was brand new and never seen before.

[–] [email protected] 1 points 2 years ago (1 children)

Not really. They don't put their evil changes in the release notes.

So unless you're willing to read through the source code changes, you're just having an outdated version (with potential compatibility/security issues) for no real benefit.

[–] [email protected] 1 points 2 years ago (1 children)

My idea is that if I stay on the oldest supported version for as long as possible, that would help me avoid evil changes in new versions, since the news would have gone public before I update. You bring up a good point about security updates tho. How relevant is it to browser extensions? Has there been malware out there that specifically targets vulnerabilities in extensions? Just casually doing git log | grep -E 'vuln|crit|secur|bug' in two extensions that I use quite extensively (pun intended), I don't seem to find any security-related commits.

[–] [email protected] 1 points 2 years ago

Most security fixes come from updating dependencies, which probably wouldn't mention those in the commit messages, since they can be looked up in the release notes of those libraries.