#10 extensions

http://www.everythingliveon.com/chrome-web-store-gives-bad-extensions-the-boot/

Chrome Web Store Gives Bad Extensions the Boot

Google recently purged some 200 extensions from its Chrome Store inventory. Extensions and add-ons let users add functions and features to the Chrome Web browser, but bad extensions can expose users to a greater risk of spyware and malware. A major problem with many browser add-ons is ad injectors.

The clean-up resulted from an extensive search for embedded code that violates Google’s policies, triggered by increasing user complaints.

Google has been studying add-on security risks with a team at the University of California, Berkeley, and will release a full report of its findings on May 1.

“It is not so much the security of the Chrome browser as the security in having an open store for downloading extensions,” noted Martin Zetterlund, founder of ScrapeSentry.

“I am sure Google automatically screens any extension uploaded — but the bad guys will, of course, do their best to trick automatic screening,” he told LinuxInsider.

Tip of the Iceberg

ScrapeSentry this week revealed its discovery of problems with the Chrome extension Webpage Screenshot: The extension could send any information visible on a browser tab back to an IP address located in the U.S., such as page title.

“Obviously, they need to put more work into screening of uploads to the Chrome Store if it should be considered a trusted source, as opposed to downloading from random sites on the Internet,” Zetterlund said.

Distributing malware is against the Chrome Web Store’s Content Policies, said Google spokesperson Veronica Navarrete.

“When we detect items containing malware or learn of them through reports, we remove them from the Chrome Web Store and from active Chrome instances,” she told LinuxInsider.

However, Navarrete declined to answer specific questions about the program purge process, ad injection programs or the Webpage Screenshot extension.

Google removed Webpage Screenshot on Tuesday, Zetterlund said.

A Growing Problem

Ad injectors are code within an extension or add-on that inserts new ads or replaces existing ads on pages the Web browser visits. Google has received more than 100,000 complaints from Chrome users about ad injection in the last three months, according to Google Software Engineer Nav Jagpal.

Injectors are related to unwanted programs. Both are deceptive, hard to remove, and often secretly bundled with other downloads.

It is unclear if ad injectors are able to work within the more rigid architecture of Linux as a function protected by the Web browser’s integration with the operating system. The study refers to browsers tested only on Mac and Windows operating systems.

Google does not ban all uses of ad injectors. People can choose to install injectors that clearly disclose what they do, noted Jagpal.

However, injectors that sneak ads into a browser violate Google’s policies. Google alerts Chrome browser users with red warnings when users attempt to download software that is deceptive or does not use the right API (application program interface) to interact with the browser.

Ad Injector Study

The problem with Web browser extensions and add-ons is not restricted to the Chrome browser. The UC Berkeley team studied more than 100 million page views of Google sites across Chrome, Firefox and Internet Explorer.

The results were anything but pretty, noted Jagpal. The researchers found ad injectors on browsers running on the Mac and Windows operating systems, but it is unclear if they found them on the Linux OS.

The researchers detected ad injectors in the Chrome, Firefox and IE Web browsers. The study results include these findings:

More than 5 percent of browsers visiting Google sites have at least one ad injector installed. Half of those browser visits showed at least two injectors installed. Nearly one-third have at least four installed.

Thirty-four percent of Chrome extensions injecting ads were classified as outright malware.

There were 192 deceptive Chrome extensions that affected 14 million users.

Action Taken

Google has removed or disabled those deceptive extensions. Google now incorporates the techniques researchers used to catch them to scan all new and updated extensions, noted Jagpal.

Google has several policies in play to limit or entirely prohibit ad injectors. Those policies affect both the Chrome browser and AdWords advertisers with software downloads hosted on their site or linked to from their site.

For example, all Chrome extensions hosted in the Chrome Web Store must comply with the Developer Program Policies. This means that extensions must have a specific understandable purpose.

http://www.everythingliveon.com/google-kills-200-ad-injecting-chrome-extensions-says-many-are-malware/

Google kills 200 ad-injecting Chrome extensions, says many are malware

Google is cracking down on ad-injecting extensions for its Chrome browser after finding that almost 200 of them exposed millions of users to deceptive practices or malicious software.

More than a third of Chrome extensions that inject ads were recently classified as malware in a study that Google researchers carried out with colleagues from the University of California at Berkeley. The Researchers uncovered 192 deceptive Chrome extensions that affected 14 million users. Google officials have since killed those extensions and incorporated new techniques to catch any new or updated extensions that carry out similar abuses.

The study also found widespread use of ad injectors for multiple browsers on both Windows and OS X computers. More than five percent of people visiting Google sites have at least one ad injector installed. Within that group, half have at least two injectors installed, and nearly one-third have at least four installed. Google officials don’t bar such ad injectors outright, but they do place restrictions on them. Terms of service for Chrome extensions, for instance, require that the ad-injecting behavior be clearly disclosed. Customers of DoubleClick and other Google-operated ads services must also comply with policies barring unwanted software.

The crackdown comes less than two months after the discovery that Lenovo sold computers that came preinstalled with adware from a company called Superfish. Not only did the software inject ads into search results; it also hijacked encrypted Web sessions and made users vulnerable to man-in-the-middle attacks that could completely bypass HTTPS protections.