"Adware vendors buy Chrome Extensions to send ad and malware-filled updates"

[snowhiker]

"Adware vendors buy Chrome Extensions to send ad and malware-filled updates"

"Adware vendors buy Chrome Extensions to send ad and malware-filled updates."

ars technica article here.

 

[P5-133XL]

I saw that article. It sucks!

At the moment it is just ad-ware but at some point it will inevitably become malware. Google will need change their policies to stop it before that point or risk class-action lawsuits.

 

[ddrueding]

Any word of this happening with Firefox? With such a capable alternative, this is enough for me to advise my users against Chrome.

 

[Mercutio]

Chrome REALLY doesn't have the rich Add-ons ecosystem that Firefox does, but the funny part about this to me is that it's going to impact the tiny percentage of Chrome users who are aware that they can install add-ons at all. It's not just that it's a new attack vector, it's an attack vector that's precisely shaped to get people who are probably savvy enough to not be subject to many other attacks.

 

[LunarMist]

Is the user not able to enable/disable each extension manually?

 

[ddrueding]

Is the user not able to enable/disable each extension manually?

They are, but that is an additional level of knowledge that most users don't have. I've set up many Firefox installs with a few extensions that I thought they'd like (AdBlock, YouTube Downloader, etc). The user has no idea what extensions are.

 

[Stereodude]

What's to stop this from happening on Firefox also?

 

[P5-133XL]

Firefox doesn't auto-update extensions when a new version of the extension comes out. Only Chrome (probably Chromium too) does that. So, if a Adware/malware company buys Ad-block (as a fictional example) then the adware/malware company can update the extension with a new version that contains adware/malware and Chrome will automatically upload it and install it to the users machine (They already have to have ad-block installed). It is a way to get software installed inside a users machine bypassing all the normal security safeguards.

Again, now that Google knows that this can happen they effectively have to remove the capability before any harm occurs else they can be considered liable.

 

[Stereodude]

Firefox doesn't auto-update extensions when a new version of the extension comes out. Only Chrome (probably Chromium too) does that. So, if a Adware/malware company buys Ad-block (as a fictional example) then the adware/malware company can update the extension with a new version that contains adware/malware and Chrome will automatically upload it and install it to the users machine (They already have to have ad-block installed). It is a way to get software installed inside a users machine bypassing all the normal security safeguards.

Again, now that Google knows that this can happen they effectively have to remove the capability before any harm occurs else they can be considered liable.

The two main Firefox extensions I use do automatically update themselves (NoScript & Adblock Plus). I can turn that off (and just did on this PC), but the default is to automatically update them when new versions are available.

 

[P5-133XL]

Are you sure that it isn't the data that is being updated rather than the programs themselves?

 

[Mercutio]

Firefox asks permission to install Addon updates when it starts. They're not mandatory.

 

[Bozo]

Google removed some extensions