Hacker News Reader

Comment by captn3m0 | Hacker News Reader

I'd presented a short talk on bypassing the prompts in both Chrome and Firefox a few years ago (2013), and it was possible by just recreating the appropriate registry entries for Windows and few changes in preferences.json.

Was slightly easier for Firefox (few entries in SQLite, iirc). However both browsers lock the data stored, so you had to force a restart as well.

View on HN

How could a browser protect itself from being "infected" from the underlying OS layer? Given that the malicious installer has administrative access, it's a hole new set of challenges if they can't trust their own filesystem.

It really can't, at the end of the day, which was the major point raised during the QA. Also, you don't need Admin rights, seeing as Chrome installation works without admin rights, and all user data is maintained on a user-directory structure.

Which is why chrome is moving toward a policy of only allowing web store extensions, end of story.

It sucks, and nobody is happy with it, but at the end of the day it's the only thing that seems to be working.

I expect to see these same companies try ever more fragile and bad methods to bypass these restrictions. If chrome refuses to load extensions from disk, they'll inject themselves into the process address space somewhere, which as a bonus will likely introduce sandbox escape vulnerabilities. This is what the AV vendors are doing these days.

They already try to do that. Hell some have even gone as far as to remove chrome, and install their own "infected" chromium compiled with their extension whitelisted and updates disabled.

It's terrifying. And while you could make a case for this "not being chrome's problem", the fact is that it's really hurting their user base, so they can't not do something about it.

AIUI, many of the top crashes of Chrome are from code injected into the address space (or rewriting the binary on disk). So yeah, it is hurting their user base and as a result it is hurting them.

Reply on news.ycombinator.com