9 ms·

Chrome VPN Extension with 100k Installs Screenshots All Sites Users Visit

39 points by theapache64 1y ago

bix6 1y ago
How are people validating extensions these days? Obviously you can run none but if you want to use one is there an easy way to verify it?
- loa_in_ 1y ago
  The source is part of the package, at worst minified, obfuscated, pulling code from external sources. You can inspect it yourself by unpacking the extension installation package and browsing the JavaScript.
  - bix6 1y ago
    So what you read every line of JavaScript? Or you have some tool for that? I personally can’t imagine catching every potential issue, especially something sneaky, from source.
- rKarpinski 1y ago
  > is there an easy way to verify it? No, because they don't enforce their rules against obfuscation. Even if there was it wouldn't help you - extensions regularly get sold to scammers who can push whatever update they want. I documented an extension with a few hundred thousand install base, that got sold and turned into malware. Overnight went from tens of lines of code un obfuscated to 10k+ lines obfuscated. Then they flooded the extensions review pages with fake reviews to burry complaints. I got a ticket open thru a contact which to Google's credit they investigated but they decided it wasn't violating enough policies to take any action.
ElijahLynn 1y ago
This needs to be reported to Chromestore, en masse.
- rs186 1y ago
  And Google will do nothing about it.
- thrown-0825 1y ago
  just put it in the pile with the rest of the google app store malware.
azalemeth 1y ago
Behind! The online safety act makes netziens safer again!
selinkocalar 1y ago
This is why browser extension permissions are so important. Users see "VPN" and think privacy, but this extension was doing the exact opposite. 100k installs means this was happening at scale for months or years. Browser stores need better security screening for extensions, especially ones that claim to protect privacy. Always read extension permissions carefully. If a VPN needs access to all your browsing data, that's a red flag.

39 points by theapache64 1y ago

bix6 1y ago

How are people validating extensions these days? Obviously you can run none but if you want to use one is there an easy way to verify it?

loa_in_ 1y ago
The source is part of the package, at worst minified, obfuscated, pulling code from external sources. You can inspect it yourself by unpacking the extension installation package and browsing the JavaScript.
- bix6 1y ago
  So what you read every line of JavaScript? Or you have some tool for that? I personally can’t imagine catching every potential issue, especially something sneaky, from source.
rKarpinski 1y ago
> is there an easy way to verify it? No, because they don't enforce their rules against obfuscation. Even if there was it wouldn't help you - extensions regularly get sold to scammers who can push whatever update they want. I documented an extension with a few hundred thousand install base, that got sold and turned into malware. Overnight went from tens of lines of code un obfuscated to 10k+ lines obfuscated. Then they flooded the extensions review pages with fake reviews to burry complaints. I got a ticket open thru a contact which to Google's credit they investigated but they decided it wasn't violating enough policies to take any action.

ElijahLynn 1y ago

This needs to be reported to Chromestore, en masse.

rs186 1y ago
And Google will do nothing about it.
thrown-0825 1y ago
just put it in the pile with the rest of the google app store malware.

azalemeth 1y ago

Behind! The online safety act makes netziens safer again!

selinkocalar 1y ago

This is why browser extension permissions are so important. Users see "VPN" and think privacy, but this extension was doing the exact opposite. 100k installs means this was happening at scale for months or years. Browser stores need better security screening for extensions, especially ones that claim to protect privacy. Always read extension permissions carefully. If a VPN needs access to all your browsing data, that's a red flag.