The evil friend in your browser
summary
A crawler and instrumented runtime inspect ~60,000 Chrome extensions and find concrete abuses: 60% request all-URLs/webRequest rights, a small tail of extensions has most users, the corpus is 3 terabytes, and 16 Monero-mining updates appear after one press story. Dynamic Selenium-style tests expose invisible analytics leaks (about 250k affected users) and affiliate hijacks. Proof-of-concept payloads for cookie theft are tiny and live updates let hijacked extensions push malicious code before removal.
AI-written summary · about
chapters (11)
- 0:00Start
- 0:21Browsers are the new operating systems
- 1:54Protecting Web Users
- 2:22Security of web browsers
- 7:39Malicious extensions are a real threat (1/2)
- 11:56The architecture of browser extensions
- 15:43Our 'Big Data extension archive
- 19:48Extensions can be big
- 21:10Observe our browsing behaviour
- 33:43Dynamic Analysis for Detecting Privacy Violations
- 38:24Outlook: On the short term (1/2)
related talks
29mUnraveling the Threat of Chrome Based Malware
25mExtension Breakdown...
31mBuilding your first malicious chrome extension 😈
31mShadow IT Battlefield: The CyberHaven Breach and...
38mDoubleX: Statically Detecting Vulnerable Data Flows in Browser ...
42mPrivacy Toolkit: Privacy Awareness In The Digital Age
35mServer-Side Browsers: Exploring the Web’s Hidden Attack Surface
57mAutomated Detection of Firefox Extension-Reuse Vulnerabilities