Hacker News Reader

Comment by therealmarv | Hacker News Reader

I wanted to say: And Google did not removed it. But actually it is also gone in Google extension store. Google also seriously needs to think about security in their Chrome extension store. I've seen more than once ads injected by extensions by the auto update (no real security there). Maybe I've been also tracked in the past. Google needs to actively monitor all extensions for ad injection and tracking code (where are their AI experts on that?) and also it should react faster to reports. In the past, weeks and months go by before a report has consequences for a extension. So the discovery of WOT is only thanks to German reporters.... but it was longer known that WOT tracks you.

View on HN

I will take the opportunity to share what I have observed a few weeks ago regarding another extension in the Chrome Store: Popup Blocker (800,000+ users)[1] also leaks your browsing history.

For every site you visit, there is a POST to

    https://api2.poperblocker.com/view/update

which contains information about each visited page. Example of information sent in the POST (I randomly clicked on an entry in the front page of Hacker News):

    us=576
    ver=1.0
    sver=1
    nid=chrome
    h=e[...]6
    tid=1478271585985
    u=https%3A%2F%2Fthehftguy.wordpress.com%2F2016%2F11%2F01%2Fdocker-in-production-an-history-of-failure%2F&p=https%3A%2F%2Fnews.ycombinator.com%2F
    rd=https%3A%2F%2Fnews.ycombinator.com%2F
    ch=2

The information above is double-encoded using atob before being sent in a POST. The `h` value stays the same i each POSTs.

The privacy policy of the extension used to be complete nonsense, a copy-pasta of the text found on the front page of (probably unrelated) site `whatarecookies.com`.

Looks like they changed it though[2], it is now a large image of pure-text HTML[3], which appears to be borrowed a lot from (coincidence!) WOT's own Privacy Policy's page.[4] I will assume using an image may be to purposefully make it more difficult to find out the copy-pasta.

The review I had left a few weeks ago for the extension -- in which I informed of the above -- seems to be gone.

[1] https://chrome.google.com/webstore/detail/poper-blocker/bkkb...

[2] http://www.poperblocker.com/privacy.html

[3] http://www.poperblocker.com/privacy.png

[4] https://www.mywot.com/en/privacy/privacy_policy

There is nothing that can be done. Any moderation can be easily bypassed (for example, obfuscated code, code loaded from external servers etc.). You just should not install software that you don't trust.

For example I don't use any browser extensions because I don't have time to inspect their code after every update.

I wonder why both Google and Mozilla don't write this at the front page of their extension stores?

Serious question: do you audit code changes in browser updates?

EDIT: I realize there are (probably) fewer authors involved there.

Browsers are made by reputable organizations like Mozilla Foundation or (not so reputable) Google. And extensions are usually written by some anonymous person from Internet (or sold to anonymous person after gaining popularity).

Mozilla actually manually reviews the extensions and updates to the extensions, and would reject obfuscated code. See for example:

https://blog.mozilla.org/addons/2016/08/19/a-simpler-add-on-...

https://blog.mozilla.org/addons/2010/02/15/the-add-on-review...

> Google needs to actively monitor all extensions for ad injection and tracking code (where are their AI experts on that?)

All the AI experts in the world won't be able to solve the halting problem. What you're asking for is impossible.

All the AI experts in the world won't be able to solve the problem of people thinking a problem is equivalent to the halting problem.

You don't need perfect performance, you only need to stay ahead of most of the attempts. Fighting fraud is similar -- it's not possible to stop 100%, but you can get close, and try to make it easy to minimize/undo the damage done by the false negatives.

You are probably over optimistic about what AI is. AI is not a human-like mind that sits inside a computer and solves any problem you give.

I am aware :). But don't you think that a finer grained permissions model, combined with even a simple Bayesian classifier (or a NN classifier) that triggers manual review, could catch a lot of suspicious extensions? E.g. P(malware|reads url+calls third party) > P(malware)

There will be ways to bypass those checks. The easiest is to wait a week after installation before doing anything bad. Or extension could download and execute code from remote server that would serve one version of code for users from Mountain View and another version to everyone else. Or the code could check whether it is run on a real device.

This is where the classification heuristics and fine-grained permissions come in. Code that does anything conditioned on dates is higher risk. Code that uses location services is higher risk.

Also, many of these checks can be done by the browser in situ, so an extension that suddenly changes its behavior can be flagged for review. And pre-release malware scans can be run on banks of actual hardware that simulates different dates and locations.

Sure, there will be an arms race, but that's better than an anarchical free for all.

Reply on news.ycombinator.com