Browser Extension Security

Slide 1

Slide 1 text

Browser Extension Security Abhay Rana @capt_n3m0 IIT Roorkee

Slide 2

Slide 2 text

Extensions? Browser 3rd party code Trust Better User Experience

Slide 3

Slide 3 text

Browsers? Extension ✔ Addon ✖ Plugin ✖

Slide 4

Slide 4 text

Extension Security (Chrome) - Isolated Worlds - Privilege Separation - Permissions

Slide 5

Slide 5 text

Threats Malicious Extensions: An attacker could install a malicious extension in the browser that could, theoretically, cause a lot of damage. Extension Vulnerabilities: The extension could in itself be vulnerable. - Insecure Coding practices - Developer negligence or incompetence

Slide 6

Slide 6 text

Privilege Abuse

Slide 7

Slide 7 text

0 452 1 627 2 264 3 108 4 74 5 71 6 24 7 20 8 12 9 7 11 2 12 1 13 1 21 1 Number of extra privileges sought Number of extensions

Slide 8

Slide 8 text

Old statistics (April 2013)

Slide 9

Slide 9 text

Extension Checker Pre-checks the extension's API usage and reports it. http://nullcon.captnemo.in/

Slide 10

Slide 10 text

Examples of privilege abuse Lightning Speed Dial (2M users) Yandex Weather (38k users) Facebook Themes (182k users) Hola Better Internet (12k users)

Slide 11

Slide 11 text

Content Security Policy - Send HTTP Headers to save yourself from XSS. - Enabled by default in all Chrome Extensions - Disable Inline JS(script tags), eval (use JSON parsers instead), and href=”javascript:code”. Its not a magic bullet, but it does help in preventing a lot of attacks. see content-security-policy.com

Slide 12

Slide 12 text

How to stay safe? - Use our extension checker (nullcon.captnemo.in) - Trust. - Read the source. - Use CSP