Why you need to be more careful with browser extensions.

[DronVR]

Why browser extensions need to be more careful.

Surely you know what browser extensions are - almost all of us use them every day. With them, your browser has a lot of useful features, but at the same time they threaten your security and privacy. Let's look at what could go wrong with browser extensions and how to minimize the risks of using them. But first, let's figure out what they are.

What are browser extensions and why are they needed?
The extension (browser extension) is an additional module that can be connected to the browser to add certain functions. Something like a plugin. Extensions can change the browser interface or add features to work on the Internet.

For example, with the help of extensions you can block ads, translate pages from foreign languages or add page addresses to special services for working with bookmarks like Evernote or Pocket. There are a lot of extensions - thousands and thousands of different programs for every taste: for more convenient and efficient work, for customizing the appearance of the browser, for online shopping, games and much more.

Extensions support almost all popular browsers: Chrome and Chromium, Firefox, Safari, Opera, Internet Explorer and Edge. Extensions are easy to download, they can be very useful, so many people use several extensions, and sometimes several tens. But, as we have said, danger lies behind this convenience.

What could go wrong?
Malicious extensions.
Firstly, extensions can be just malicious. This is mainly characteristic of extensions that they offer to install on third-party sites, but sometimes malware penetrates official sources like the Chrome Web Store extension store - just as it sometimes sneaks into Google Play.

For example, researchers recently found four malicious extensions on the Chrome Web Store. Plugins pretended to be ordinary note-taking applications, but actually brought their creators a profit by quietly clicking on sponsored links.

How does extension succeed? To do something, he needs permission. But of the popular browsers, only Google Chrome asks for this permission from the user. Other browsers by default allow plugins to do anything. They do not ask the user.

However, even in Chrome, permission management works only in theory - but in practice it doesn’t work out very well. Even the simplest extensions usually require that they be given the right to “read and modify all your data on the sites you visit”, which enables them to do almost anything. And if you do not give them this permission, you will not be able to install them.

Well, or another example: earlier, experts found another malicious extension with which scammers distributed hacker software to Facebook Messenger.

Purchase and hack extensions.
For criminals, extensions are a tidbit, because some of them are installed by many thousands of users, and they are updated automatically. This means that you can download a harmless extension, and then it will be updated and become malicious - and you will not notice anything.

A good developer will not do this, but attackers can crack his account to download a malicious update to the official store on his behalf.
For example, phishing scammers obtained data from developers of the popular Copyfish plugin. This extension, which initially recognized text from images, after the update began to show ads to users.

Another variant: sometimes companies offer extension developers a good amount for their products. Extensions are generally difficult to monetize, and developers often happily agree. After the transaction, the company may release a malicious update, which will automatically be installed on all users who downloaded the extension. This is exactly what happened with Particle, a popular extension for Chrome that you can use to customize YouTube. The developers abandoned it at some point, and the company that bought them the plug-in immediately turned it into adware.

Not malicious, but still dangerous.
Even those extensions that were created without the goal of harming anyone can also be dangerous. Almost all of them collect a lot of data about users (remember about permission to “read and edit all the data on all the sites you visit”?) To make ends meet, some developers sell user data in anonymous form to third parties. Usually they honestly warn about this in the user agreement, and in most cases this is not scary.

The problem is that sometimes the data is not sufficiently anonymous, which leads to a violation of confidentiality.
For example, the company that bought the data can find out the identity of the users of the plugin from them. This is exactly what happened with Web of Trust, a once-popular extension for Chrome, Firefox, Internet Explorer, Opera, Safari, and other browsers. It compiled a rating of sites based on user opinions - and collected a complete history of visits to all sites.

One German site said Web of Trust developers sold user data to third-party companies, not thoroughly depersonalizing them. The administration of the Mozilla extension store immediately stopped distributing the Web of Trust, and the authors themselves soon removed it from all the other stores. However, a month later it returned to the assortment - supposedly with a modified code. Web of Trust is by no means a malicious extension. But it can harm users by revealing their data to those who, probably, should not see the history of site visits and actions on them.

How to work with extensions as safely as possible.
Extensions can be dangerous, but some of them are very useful, so you are unlikely to want to completely abandon them. I still use several extensions, and I know for sure that two of them have the same permission to read and edit everything.

It would be safer to remove them, but they are very convenient. Therefore, we need a way to use extensions more or less safely.

You can protect yourself by observing the following rules.

• Do not install too many extensions. They not only reduce computer performance when working with a browser, but can also open a loophole for attacks. So leave only the necessary minimum.
• Install extensions only from official stores. There they are at least somehow checked, filtering out frankly malicious.
• Pay attention to what accesses the extension requests. If an already installed plugin asks for new permission, this should immediately alert you. Most likely, something went wrong. The extension was probably sold or hacked. Before installing the plugin, you should always look at the permissions requested by it and think about whether they correspond to its functions. If you cannot come up with a logical explanation for such requests, it is better to refuse to install the extension.
• Use a good protective solution.

Source: @departamentK