Craig Young, Cybersecurity Researcher for Tripwire have the following comments on Browser Extensions are Prime Targets.
Craig Young, Cybersecurity Researcher for Tripwire
“With so many critical business and financial activities occurring within the web browser, malicious extensions and add-ons must be considered a prime target for infection.
As with browser interstitials warning of invalid SSL certificates, many users likely gloss over the permissions declaration when installing extensions or do not recognize the risk of allowing an extension to have access to read data from web sites. The reality though is that extensions are allowed to run in a very privileged browser context giving access to authentication tokens as well as the ability to scan local networks. Normally sites loaded within the browser are restricted from reading content from other sites via the same-origin policy. This is what keeps an advertisement on a news site from transferring money out of the banking site open in another tab.
Recently a number of gamers on the Steam platform learned this lesson the hard way as a number of malicious browser extensions were found to be stealing in-game items with real-world value.
Security organizations should educate employees on the risks of running browser extensions as well as auditing workstations for unapproved use.”
[su_box title=”About Tripwire” style=”noise” box_color=”#336588″]
Tripwire is a leading provider of advanced threat, security and compliance solutions that enable enterprises, service providers and government agencies to confidently detect, prevent and respond to cybersecurity threats. Tripwire solutions are based on high-fidelity asset visibility and deep endpoint intelligence combined with business-context and enable security automation through enterprise integration. Tripwire’s portfolio of enterprise-class security solutions includes configuration and policy management, file integrity monitoring, vulnerability management and log intelligence.[/su_box]
About the Author
The opinions expressed in this post belongs to the individual contributors and do not necessarily reflect the views of Information Security Buzz.
