- Apr 13, 2013
- 3,147
(I've become more and more leery of extensions in the past few years. The assumption is always that an extension showing up on either a Chrome or Firefox site will be legitimate, with no basis for that assumption. Add to that the disclosure of this article that formerly trusted extensions can have malicious updates really show make one consider if these extensions are indeed worth it.)
Google has removed two extensions for its Chrome Web browser after they began delivering malware to their users. The malicious ads began displaying after the extensions were purchased from their original developers. Users of Google Chrome can modify their experience with so-called extensions, which are essentially apps for the Web browser.
The extensions that were recently banned, Add to Feedly and Tweet This Page, had modest followings of several thousand users, but they were recently purchased. The new owners took advantage of a Chrome feature that allows developers to update their extensions without notifying users -- the updates added malware ads to the extensions.
"These aren’t regular banner ads that you see on web pages, these are invisible ads that work the background and replace links on every website that you visit into affiliate links," said Amit Agarwal, Add to Feedly's original developer, in a blog. "In simple English, if the extension is activated in Chrome, it will inject adware into all web pages."
Agarwal said he decided to sell his software after being offered a four-figure sum. About a month after selling it, he said Add to Feedly began delivering the malware. "It was probably a bad idea to sell the Chrome add-on and am sorry if you were an existing user," he said.
Add to Feedly and Tweet This Page are likely not the only Chrome extensions that have been purchased from their original owners so that they can be used to deliver malware. The developers of Honey, another Chrome extension, said they have been approached for similar reasons.
"Over the past year we've been approached by malware companies that have tried to buy the extension, data collection companies that have tried to buy user data, and adware companies that have tried to partner with us," the developers said.
Google's removal of the two extensions comes after the company updated its Chrome Web Store policies in December. The recent bans suggests the tech giant plans to take a harder stance against those who take advantage of their users.
Google has removed two extensions for its Chrome Web browser after they began delivering malware to their users. The malicious ads began displaying after the extensions were purchased from their original developers. Users of Google Chrome can modify their experience with so-called extensions, which are essentially apps for the Web browser.
The extensions that were recently banned, Add to Feedly and Tweet This Page, had modest followings of several thousand users, but they were recently purchased. The new owners took advantage of a Chrome feature that allows developers to update their extensions without notifying users -- the updates added malware ads to the extensions.
"These aren’t regular banner ads that you see on web pages, these are invisible ads that work the background and replace links on every website that you visit into affiliate links," said Amit Agarwal, Add to Feedly's original developer, in a blog. "In simple English, if the extension is activated in Chrome, it will inject adware into all web pages."
Agarwal said he decided to sell his software after being offered a four-figure sum. About a month after selling it, he said Add to Feedly began delivering the malware. "It was probably a bad idea to sell the Chrome add-on and am sorry if you were an existing user," he said.
Add to Feedly and Tweet This Page are likely not the only Chrome extensions that have been purchased from their original owners so that they can be used to deliver malware. The developers of Honey, another Chrome extension, said they have been approached for similar reasons.
"Over the past year we've been approached by malware companies that have tried to buy the extension, data collection companies that have tried to buy user data, and adware companies that have tried to partner with us," the developers said.
Google's removal of the two extensions comes after the company updated its Chrome Web Store policies in December. The recent bans suggests the tech giant plans to take a harder stance against those who take advantage of their users.
