'Looming menace'

[mikey]

'Looming menace' of evil browser extensions to be demo'd this week

Most browser add-ons are crap...spyware, adware, gimmicks. Ever since the BHO(Browser Helper Object) was first introduced, we've been aware of the downside to add-ons. Perhaps we could see a change in the level of socially engineered exploitation.

 

[Ink]

His PoC sounds scary. :-/ But good points pointed out at the end. Thanks for the news.

 

[DiabloBlack]

The "app store" approach would definitely help. You should only ever download from a reputable source. The man in the browser concept is scary business.

 

[Littlebits]

The best thing to happen recently, just about all browsers require approval of new add-ons. If a bundled software includes browser add-ons and installs them, most browser will disable them by default until they are approved.

Google Chrome doesn't allow installation of extension not available from the Chrome Web Store.

I disagree it shouldn't be the AV vendors job to defend against browser add-ons, it should be the browser's job.

Thanks.

 

[Prorootect]

Mike The security guru is the best.

Read my response on the original topic: 'Looming menace' of evil browser extensions: on the VOP website: http://forums.voiceofthepublic.com/smf2/index.php/topic,1261.0.html

' 'Malicious extensions can potentially pose as browser add-ons necessary to view Flash files, or use similar tricks.'

'Most browser add-ons are crap...spyware, adware, gimmicks.'

Yeah .. Proposals for download of malicious browser add-ons, flash files .. I've seen this several times, but of course never download stuff alike.

Firewalls, AV - useless? .. aaa, may be new for someone, not for me. He writes that 'defensive technologies are in the' Stone Age '- which is why I rely on my intuition, my safety-consciousness.

Well, I use IE, not Firefox Chrome etc.. I also unchecked the option in IE Options / Advanced 'Enable third-party browser extensions' and restart IE. 'It does not stop Flash player from working.'

'One of the best settings to keep a clients computer safe, besides telling them that using internet explorer is like walking around in prison with your pants pulled down, is to disable the default behavior of downloading files without prompting the user.
Go to IExplorer, tools->Security->custom level, then scroll down to the bottom and you will find a section titled downloads. You have to Enable automatic prompting. By default this is disabled and file download is enabled which means "Download anything and don't tell me about it". You may choose to disable File download, but that may be overkill and will lead to complaints.' - Larry, on response to superuser.com super read: Prevent installation of IE toolbars? : windows - Prevent installation of IE toolbars? - Super User: http://superuser.com/questions/9411/prevent-installation-of-ie-toolbars

- I did those 'Enable .. Disable ..' many times ago.' - Prorootect