"Adware vendors buy Chrome Extensions to send ad and malware-filled updates"

S

snowhiker

0
Joined
Jul 5, 2007
Messages
1,668
"Adware vendors buy Chrome Extensions to send ad and malware-filled updates"

"Adware vendors buy Chrome Extensions to send ad and malware-filled updates."

ars technica article here.
 
I saw that article. It sucks!

At the moment it is just ad-ware but at some point it will inevitably become malware. Google will need change their policies to stop it before that point or risk class-action lawsuits.
 
Chrome REALLY doesn't have the rich Add-ons ecosystem that Firefox does, but the funny part about this to me is that it's going to impact the tiny percentage of Chrome users who are aware that they can install add-ons at all. It's not just that it's a new attack vector, it's an attack vector that's precisely shaped to get people who are probably savvy enough to not be subject to many other attacks.
 
Is the user not able to enable/disable each extension manually?
 
LunarMist said:
Is the user not able to enable/disable each extension manually?
Click to expand...

They are, but that is an additional level of knowledge that most users don't have. I've set up many Firefox installs with a few extensions that I thought they'd like (AdBlock, YouTube Downloader, etc). The user has no idea what extensions are.
 
Firefox doesn't auto-update extensions when a new version of the extension comes out. Only Chrome (probably Chromium too) does that. So, if a Adware/malware company buys Ad-block (as a fictional example) then the adware/malware company can update the extension with a new version that contains adware/malware and Chrome will automatically upload it and install it to the users machine (They already have to have ad-block installed). It is a way to get software installed inside a users machine bypassing all the normal security safeguards.

Again, now that Google knows that this can happen they effectively have to remove the capability before any harm occurs else they can be considered liable.
 
P5-133XL said:
Firefox doesn't auto-update extensions when a new version of the extension comes out. Only Chrome (probably Chromium too) does that. So, if a Adware/malware company buys Ad-block (as a fictional example) then the adware/malware company can update the extension with a new version that contains adware/malware and Chrome will automatically upload it and install it to the users machine (They already have to have ad-block installed). It is a way to get software installed inside a users machine bypassing all the normal security safeguards.

Again, now that Google knows that this can happen they effectively have to remove the capability before any harm occurs else they can be considered liable.
Click to expand...
The two main Firefox extensions I use do automatically update themselves (NoScript & Adblock Plus). I can turn that off (and just did on this PC), but the default is to automatically update them when new versions are available.
 
You must log in or register to reply here.
Back
Top