Adware vendors buy Chrome Extensions to send ad- and malware-filled updates

https://arstechnica.com/information-technology/2014/01/malware-vendors-buy-chrome-extensions-to-send-adware-filled-updates/

by hollerith • 8 years ago

99 43 8 years ago

arstechnica.com

jackvalentine• 8 years ago

From the article:

"Update: Google got back to us, and stated that Chrome's extension policy is due to change in June 2014. The new policy will require extensions to serve a single purpose."

voltagex_• 8 years ago

(2014)

codedokode4• 8 years ago

That is why I never install browser extensions.

abecedarius• 8 years ago

Do you live without adblock?

astebbin• 8 years ago

Not OP, but I live without adblock. In Chrome, I disable Javascript on all sites by default. Rarely do I need to unblock a new site. I have a paid subscription to the Washington Post (which grants access to articles, but doesn't actually hide the ads...), and the ads on other sites I visit aren't too oppressive.

More than anything else, over nearly twenty years on the Internet I've developed the mental reflex to "tune out" and automatically ignore any Internet ad, anywhere, unless it's literally shoved in my face to the exclusion of all other content.

I've previously used adblock extensions, but my reasons for going without mirror the link author's. I simply can't trust Google/Chrome not to autoinstall a new, broken, malware-infested version of my favorite extension. I don't feel I should have to mess with directory permissions or application sandboxing in order to achieve some half-measure of extension security, so instead I eschew them completely.

yareally2• 8 years ago

Host blocking at the OS level. No need for extensions.

hackinthebochs2• 8 years ago

I adblock then disable extension updates. The only extension I add.

DyslexicAtheist• 8 years ago

you can do it quite effectively outside the browser using a host block[1] list or pi-hole. my uBlock now only fires sporadically for cases I don't catch with the /etc/hosts approach (e.g. disallowing e.g. remote fonts)

[1] https://github.com/StevenBlack/hosts

jmiserez• 8 years ago

Install the version from Github instead of the store, and you can avoid the problem. Instructions for Chrome/Firefox here: https://github.com/gorhill/uBlock/blob/master/dist/README.md

Other browsers see the overview here: https://github.com/gorhill/uBlock/blob/master/README.md#chro...

codedokode4• 8 years ago

Yes, but I have JS disabled on most sites. Regarding adblock, there were posts that it slows the browser down, injects huge CSS rules into every iframe etc.

tdb7893• 8 years ago

It's pretty easy going without adblock. There are a lot of websites without obtrusive ads and it's pretty easy to start to recognize which sites I just don't want to go to anymore.

drdaeman• 8 years ago

I'm not sure about Chrome but on Firefox for a time being one still can install extensions the classic "old school" software installation way - by placing the files on disk.

youseecomrade2• 8 years ago

Not even Firefox manually review extensions anymore. Sad, happened twice for me (one was a cryptominer) so now I have like 2 extensions installed.

dblohm7• 8 years ago

Not true. Extensions are still subject to manual review, however they are permitted to be posted publically as soon as they pass a suite of automated checks.

youseecomrade2• 8 years ago

You know what I mean. It's like checking for poison after you eat the entire pie.

bradknowles• 8 years ago

It’s a good point to be aware of and to raise from.time to time, but the subject line should be amended to indicate that this article was written in 2014.

oceanstone• 8 years ago

Yeah, I have a Firefox extension with around 50k installs, and get emails every so often from people offering to monetize it.

Here's an excerpt from a recent one, from Nick at NJB Brands Sales:

We offer .50 CTR (per 1,000) traffic and can use each unique IP up to 10 times a day. There is no limitation to what we will purchase other than the cap per unique IP. We offer flexible payment options via PayPal, Bitcoin, WesternUnion or Check. Payment can be done every 1 day, 7 days or 30 days.

erikrothoff• 8 years ago

Ha! We got the exact same message. Really weird getting a glimpse of that part of the internet.

tux• 8 years ago

Use uBlock Origin [1] and uMatrix [2] instead. Also using Inox [2] browser helps too.

[1] https://github.com/gorhill/uBlock/ [2] https://github.com/gorhill/uMatrix [3] https://github.com/gcarq/inox-patchset/releases

jwilk• 8 years ago

Instead of what?

posnet2• 8 years ago

I have a relatively popular novelty extension and I get approached by ad companies to buy/monetize it regularly. I refuse, because I despise advertising and I don't need the money. But I suspect I am in the minority and that many extension owners probably just decide it is easier to sell it and not think about it.

rogem0022• 8 years ago

I switched my chrome extension to a paid model (one off payments). Most the offers from these shady people, work out as approximately 1 year worth of sales.

dawnerd• 8 years ago

Who pays for extensions? Like, honest question.

tobyhinloopen• 8 years ago

How much did they offer?

oneeyedpigeon• 8 years ago

And for what reach?

posnet2• 8 years ago

Anywhere from $2-25k. But most don't give a price upfront and I just send it to my spam folder.

blendergeek• 8 years ago

This is why RMS calls auto-updates "universal backdoors".

cpach• 8 years ago

Most people would be screwed without auto-updates.

krsdcbl• 8 years ago

It appears to be an easy way to at least weaken this practice:

Why doesn't chrome prompt it's user / demands a confirmation of permissions when an extention changes ownership, before updating it again?

It could at least impact the rentability of this buying up of extentions, but definitely help alert users of such things

RobLach• 8 years ago

How would they know it changed ownership?

a012• 8 years ago

But it couldn't/won't guarantee anything, say Chrome could notify user the change ownership of an extension then the new owner state that they won't be evil, blah blah blah, but 1 or 3 months later they changed their minds and send ads to users. What next?

rasz3• 8 years ago

before that - why doesnt Chrome let you DISABLE updates?

TazeTSchnitzel• 8 years ago

(2014)

dotmanish• 8 years ago

Still a large risk, even though this was authored in 2014.

I would be surprised if extensions that "read and change content on all websites you visit" haven't yet been used in some wide-scale account/identity compromise without making much noise.

Adware vendors buy Chrome Extensions to send ad- and malware-filled updates

Related Stories