A Browsing Challenge

A Browsing Challenge

Analysts are challenging malicious extension risks

Google Chrome is largely considered one of the most security-conscious browsers, but recent headlines revealed some of its weaknesses. Reporting indicates that four of Chrome’s most popular extensions, which have amassed more than 500,000 downloads in total, are thought to be malicious.

The suspect extensions have since been banned from the Chrome Web Store, but the news highlights the inherent risk of browsers and third-party apps, which warrant deeper examination.

Ongoing Browser Extension Risks

Google has made significant efforts to enhance the security of its browser. In addition to more commonly-known measures, the company invests in bug bounties and other competitions to help root out some of the major problems that could be exploited by a high-skilled attacker, and takes a forward-thinking approach when it comes to user privacy. These measures do make it harder for hackers, but with so much market share and interest from the security community, vulnerabilities will continue to be discovered. Additionally, because extensions are generally created by third-party vendors, it’s a great source of unknown.

When it comes to extensions, Chrome requires downloads directly from the Chrome Web Store for major OSes (Windows/ OS X). However, it doesn’t seem as though there are any security checks conducted on these extensions before they’re published. This means it would take a critical mass of security-related complaints before Chrome would be made aware of any problem. That’s not to blame Google—even if its extensions were subject to the same scrutiny used for Android apps in the Google Play Store, no checks are perfect. We still see news about malicious apps making their way into the public arena in the Google Play Store several times a year.

With communications allowed between extensions, it’s also theoretically possible for an adversary with two or more extensions installed on a user’s browser to covertly pass information or perform different parts of an attack on the system. Then, there’s the problem of very carefully-hidden Trojan extensions and the ability to hijack and implant code into a trusted developer’s development system. These are all potential ways in for persistent and sophisticated attackers.

This is not to pick on Chrome—other browsers absolutely hold malicious extensions. Firefox still allows add-ons (their extensions) to be hosted external to their store, which eliminates a central point for management. Its publishing process is also less than rigorous, and seems to focus only on code correctness. And while Safari does review extensions before including them in the App Store, we still hear of malicious apps appearing there from time to time.

Identifying Malicious Extensions

For security analysts, identifying malicious extensions is no easy task. They aren’t going to show up in places analysts typically monitor such as CMDBs or logs. The only way to find them is on the network. If analysts are looking for something that the extension happens to do—such as leaking passwords in an obvious way or matching a network signature or indicator of compromise for malicious activity—it’s possible that their security tools will generate alerts pointing them to the related traffic that occurs after the fact.

If the tool an analyst is using has the ability to parse HTTP headers in a meaningful way, they may also be able to find malicious extensions by identifying these behaviors while looking for the Chrome-Extension value within the header. With more flexible query language offered by cutting-edge tools, it’s easy to become more or less specific with respect to what you’re looking for within HTTP, whether it be the headers or some other location.

In short, the original discovery of the malicious extension information and ways it is stored would likely be by chance or by deep investigation. However, if a tool the analyst uses has the ability to spot malicious activity, then the hard work of identifying the bad extension can be done by one researcher and reused by many.

The Challenge in Responding to Malicious Extensions

While finding a malicious extension is a major challenge, it’s still only the first step. The ability to contextualize the behavior associated with the session with respect to the device and its peers is where the baggage of current-version technologies slows analysts down.

Once a malicious extension is detected, analysts will quickly want to know what to do to stop the bleeding. Are any external communications related to this? Is any information being exfiltrated? What kinds of attacks are occurring internally? Is any pivoting/ lateral movement behavior happening with stolen credentials, possibly accessing more sensitive data? They’ll also quickly want to know who else is affected—spanning both devices, and users—when they were infected, which browsers and versions are impacted, whether the decision to install the extension was completely voluntary and more.

Each of the above steps can take tens of minutes to hours— and in some cases, they are impossible given time constraints and resources. The overall security maturity of the organization, and whether or not the security development team has created homegrown solutions to unify typically disparate pieces of information and infrastructure, will determine how effectively this workflow can be handled.

Today, overburdened analysts will typically only do this type of thorough investigation if there’s enough certainty that this is a truly serious incident—there are simply not enough human resources, nor the right incentives in the SOC, to do this deep level of work for naught. Moreover, the problem is exacerbated since existing security technologies provide little to no context—leaving it to the analyst to figure things out.

At Awake Security, we call this problem the Investigation Gap. After prevention methods fail, potential threats are detected and security alerts are generated, the time-consuming and manual heavy-lifting of an investigation falls to the analysts before any remediation steps can be taken. If an organization’s security tools miss a potential threat and no alert is generated, it falls on the analysts to find time to threat hunt and identify malicious activity on their own—a task that’s nearly impossible in most SOCs given their existing alert investigation workload.

The recent Chrome news put a spotlight on malicious browser extensions that underscores the risk incurred when trust is given to third parties. Often that trust is not well understood when given, and quickly forgotten. However, it also points to a deeper underlying issue for analysts working to identify malicious extensions and mitigate their harmful effects.

It’s critical that we find new ways to give analysts deep visibility into the network and streamline their time spent getting from questions to answers during their investigations. Only then will we start gaining ground on this type of challenge.

This article originally appeared in the September 2018 issue of Security Today.

Featured

  • Security Today Announces The Govies Government Security Award Winners for 2025

    Security Today is pleased to announce the 2025 winners in The Govies Government Security Awards. The awards honor outstanding government security products in a variety of categories. Read Now

  • Survey: 60 Percent of Organizations Using AI in IT Infrastructure

    Netwrix, a cybersecurity provider focused on data and identity threats, today announced the release of its annual global 2025 Cybersecurity Trends Report based on a global survey of 2,150 IT and security professionals from 121 countries. It reveals that 60% of organizations are already using artificial intelligence (AI) in their IT infrastructure and 30% are considering implementing AI. Read Now

  • New Research Reveals Global Video Surveillance Industry Perspectives on AI

    Axis Communications, the global industry leader in video surveillance, has released its latest research report, ‘The State of AI in Video Surveillance,’ which explores global industry perspectives on the use of AI in the security industry and beyond. The report reveals current attitudes on AI technologies thanks to in-depth interviews with AI experts from Axis’ global network and a comprehensive survey of more than 5,800 respondents, including distributors, channel partners, and end customers across 68 countries. The resulting insights cover AI integration and the opportunities and challenges that exist with regard to security, safety, business intelligence, and operational efficiency. Read Now

  • SIA Urges Tariff Relief for Security Industry Products

    Today, the Security Industry Association has sent a letter to U.S. Trade Representative Jamieson Greer and U.S. Secretary of Commerce Howard Lutnick requesting relief from tariffs for security industry products and asking that the Trump administration formulate a process that allows companies to apply for product-specific exemptions. The security industry is an important segment of the U.S. economy, contributing over $430 billion in total economic impact and supporting over 2.1 million jobs. Read Now

  • Report Shows Cybercriminals Continue Pivot to Stealthier Tactics

    IBM recently released the 2025 X-Force Threat Intelligence Index highlighting that cybercriminals continued to pivot to stealthier tactics, with lower-profile credential theft spiking, while ransomware attacks on enterprises declined. IBM X-Force observed an 84% increase in emails delivering infostealers in 2024 compared to the prior year, a method threat actors relied heavily on to scale identity attacks. Read Now

New Products

  • Automatic Systems V07

    Automatic Systems V07

    Automatic Systems, an industry-leading manufacturer of pedestrian and vehicle secure entrance control access systems, is pleased to announce the release of its groundbreaking V07 software. The V07 software update is designed specifically to address cybersecurity concerns and will ensure the integrity and confidentiality of Automatic Systems applications. With the new V07 software, updates will be delivered by means of an encrypted file.

  • PE80 Series

    PE80 Series by SARGENT / ED4000/PED5000 Series by Corbin Russwin

    ASSA ABLOY, a global leader in access solutions, has announced the launch of two next generation exit devices from long-standing leaders in the premium exit device market: the PE80 Series by SARGENT and the PED4000/PED5000 Series by Corbin Russwin. These new exit devices boast industry-first features that are specifically designed to provide enhanced safety, security and convenience, setting new standards for exit solutions. The SARGENT PE80 and Corbin Russwin PED4000/PED5000 Series exit devices are engineered to meet the ever-evolving needs of modern buildings. Featuring the high strength, security and durability that ASSA ABLOY is known for, the new exit devices deliver several innovative, industry-first features in addition to elegant design finishes for every opening.

  • Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

    Connect ONE®

    Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.