Browser extensions can be harmful ... Be careful

[linuxyogi]

Read this >>>https://krebsonsecurity.com/2021/03/...tnet-backdoor/
The only problem is the author of that article didn't mention which addons can be trusted & which cant be.

[Paddy Landau]

Thanks for the warning.

There's a lot of this going on. The best thing to do is stick with extensions from the official browser store (depending on which browser you use); always check reviews and star ratings; and when you install, check the permissions that it asks for before approving.

I hate these scammers and black-hat hackers. I wish that we had effective ways to combat them.

[linuxyogi]

@Paddy Landau
I use 2 browsers namely Firefox & Brave. I haven't added any addons under Brave coz I heard that its privacy respecting by default.
I am using the following addons under Firefox. (Please see attachment).

In case of Firefox even if a user sticks to the official browser store he will find 2 kinds of addons. Some are "recommended" while others say "not actively monitored". (Please see attachment)


untrusted.png


addonlist.png

[Paddy Landau]

In case of Firefox even if a user sticks to the official browser store he will find 2 kinds of addons. Some are "recommended" while others say "not actively monitored".

That's interesting. Chrome's store doesn't have that distinction. It would be nice if it did!

[Frogs Hair]

That's interesting. Chrome's store doesn't have that distinction. It would be nice if it did!

If Chrome extensions offer no website or privacy information beware. All my firefox addons are recommended by or are developed by mozilla. I use the same extensions on Chromium based browsers with the exception of the mozilla extensions which aren't available for Chrome .

[Paddy Landau]

If Chrome extensions offer no website or privacy information beware.

Oh, they do indicate such information. But they're not monitored to the same extent as you show that Firefox does.

[zebra2]

Just one more way that intrusions have found a backdoor to compromise a system. Proof or not I've deleted them all. This sounds way too real to suit me. It is resonate of other posts on this site indicating similar activity through other processes.

[Swan_DB]

[Noob Question] - What prevents my browser/browser extension from writing to my hard-drive, or gaining access to my wifi network? Specifically, hypothetically, ELI5, how would a malicious browser extension on my desktop that I am at right now, access my.... idk, my "smart doorbell security camera"?

My brain is saying they'd need the get into my OS from my browser, which seems like if I simply clicked a button on a website (or installed a malicious browser extension), it could happen via: That "button"/extension downloads a program that executes writing code that breaks my wifi network passwords or by-passes the passwords if that's possible?, then finds my "smart doorbell security camera" and starts sending that video data back through the wifi network, then back through my OS/desktop, then back to... the web and the malicious browser extension's author can download my "smart doorbell security camera" video data.

Any input/details on this would be great, thanks in advance.

[Paddy Landau]

… Specifically, hypothetically, ELI5…

I think that the best place to ask this is in the Security forum. I suggest that you create a new thread there, asking exactly what you've just asked. Be aware that not everyone will know what the abbreviation ELI5 means.

[ajgreeny]

As this is not a support thread asking for an answer the current Ubuntu, Linux and OS Chat is the right place.

Please do not create a duplicate thread, though if you wish to ask a specific question feel free to start again.