Revisiting the Chrome Extension Permissions Model Pranav Prakash, - PowerPoint PPT Presentation

Revisiting the Chrome Extension Permissions Model Pranav Prakash, Chester Leung 1

Courtesy of W3Counter 2

Courtesy of W3Counter 3

Chrome has ~190,000 Google Chrome extensions released 2010 2020 2008 2019 Chrome adds Chrome removes support for 500+ malicious extensions extensions 4

Chrome Extensions... 5

Chrome Extensions... ● Change UI 6

Chrome Extensions... ● Change UI ● Provide additional functionality 7

Chrome Extensions... ● Change UI ● Provide additional functionality ● Integrate with third party apps 8

Extension Ecosystem ● ~1.2B installs 9

Extension Ecosystem ● ~1.2B installs ● 2.6% of installed extensions are paid 10

Extension Ecosystem ● ~1.2B installs ● 2.6% of installed extensions are paid ● 87% have less than 1,000 installs 11

Extension Ecosystem ● ~1.2B installs ● 2.6% of installed extensions are paid ● 87% have less than 1,000 installs ● Only 13 have more than 10 million installs 12

Extension Ecosystem ● Most big extensions backed by a company 13

Extension Ecosystem ● Most big extensions backed by a company 14

Extension Ecosystem ● Most big extensions backed by a company 15

Extension Ecosystem ● Most big extensions backed by a company 16

17

It’s a business! 18

https://extensionmonitor.com/blog/breaking-down-the-chrome-web-store-part-2 19

https://extensionmonitor.com/blog/breaking-down-the-chrome-web-store-part-2 20

21

Extension developers were phished! 22

Extensions used for malvertising 23

24

25

Nigelify 26

Nigelify Link 27

Nigelify Extension Link 28

Nigelify Extension Link Credentials 29

Nigelify Extension Link Credentials 30

Nigelify Extension Link Resources Credentials 31

Nigelify ● Made $1000 in < 1 week 32

Nigelify ● Made $1000 in < 1 week ● Affected 100k+ users 33

Nigelify ● Made $1000 in < 1 week ● Affected 100k+ users ● Prevented users from removing extension 34

35

Added users to botnet 36

Part of malvertising campaign 37

Analyzing the threat surface of Chrome’s extension APIs 38

Chrome ● Designed with security in mind ● Isolation, separation of privilege 1 39 1 Barth, Adam, et al. "Protecting browsers from extension vulnerabilities." (2010).

Chrome Extension Architecture runtime.sendMessage 40

Manifests "background": { ● Structure of extension "persistent": false, explicitly declared "scripts": [ "js/background.js" ] }, "content_scripts": [ { ● Permissions enumerated "js": [ "js/content.js"] "matches": ["*://*.foo.com"], "run_at": "document_start" }], "permissions": ["bookmarks"] 41

Weaknesses of Permission Model ● While limited by sandboxing/isolation, malicious developers may not adhere to “principle of least privilege” 42

Analyzing the Chrome APIs ● Inspect the APIs in each permission group 43

Analyzing the Chrome APIs 44

Analyzing the Chrome APIs ● Primary objectives of malicious extension ○ Data exfiltration ○ Website tampering ○ Phishing 45

Analyzing the Chrome APIs ● CIA Triad: Confidentiality, Integrity, Availability 46

Analyzing the Chrome APIs ● CIA Triad: Confidentiality, Integrity, Availability ● Classify aligned to triad ○ Info disclosure ○ Phishing ○ State manipulation ○ Obfuscation 47

Analysis 48

Analysis ● Majority of APIs can be abused ● Different methods within same permission have different threat profiles 49

Reverse-engineering a malicious extension 50

Version History 51

Malicious buyout ● Rather than phish developer, outright buy an extension 52

Malicious buyout ● Rather than phish developer, outright buy an extension 53 https://portswigger.net/daily-swig/when-browser-extensions-go-rogue

Why so many users? ● Possibly ranked high in google search? ● Are all installs legitimate? 54

Permissions Nothing too abnormal... 55

Suspicious Obfuscation 56

A seemingly benign jpeg 57

Wait that’s not a jpeg... > file promo.jpg PNG image data, 1280 x 800, 8-bit/color RGBA, non-interlaced 58

What’s in the alpha channel? 59

Steganographic Obfuscation 60

Takeaways? ● Limitations of static/dynamic analysis 61

Takeaways? ● Limitations of static/dynamic analysis ● Permissions system has unnecessarily broad scope 62

Takeaways? ● Limitations of static/dynamic analysis ● Permissions system has unnecessarily broad scope 63

Mitigations to limit power of malicious extensions 64

Mitigation: Fine-grained permissions ● Scope on method, not permission category ● Should not be able to update tabs if only need to refresh them 65

Existing permissions "permissions": [ "tabs", "*://*.google.com/" ], 66

Existing permissions "permissions": [ "tabs", "*://*.google.com/" ], Update existing tabs? Spawn new tabs? 67

Wildcard Host Nothing too abnormal...? 68

Scope network access ● Tie network host permission to parent permission "permissions": [ "permissions": [ "tabs", "tabs.executeScript" : { "*://*.google.com/" "*://*.google.com/" ], } ], 69

Existing permissions "permissions": [ "tabs", "*://*.google.com/" ], Update existing tabs? Spawn new tabs? 70

Revised permissions "permissions": [ "permissions": [ "tabs.executeScript" : { "tabs", "*://*.google.com/" "*://*.google.com/" } ], ], Read and manipulate your data on all google.com sites 71

Backwards Compatibility ● Static analysis to transparently upgrade manifests ● Prevents obfuscated API calls 72

Mitigation: Runtime Permissions 73

Mitigation: Runtime Permissions ● Permission dialog every time an extension wants to run 74

Today: Chrome Optional Permissions Feature 75

Today: Chrome Optional Permissions Feature ● Requested additional permissions during runtime 76

Today: Chrome Optional Permissions Feature ● Request additional permissions during runtime ● Better security and information to users 77

Today: Chrome Optional Permissions Feature ● Requested additional permissions during runtime ● Better security and information to users 78

Runtime Permission Dialog 79

Runtime Permission Dialog Bookmarks Navigator requests 80

Runtime Permission Dialog Bookmarks Navigator requests Bookmarks access 81

Runtime Permission Dialog Bookmarks Navigator requests Bookmarks access Bookmarks enable easy access to your favorite sites 82

Runtime Permission Dialog Bookmarks Navigator requests Bookmarks access Bookmarks enable easy access to your favorite sites We’ll ask for permission every time you open a new tab 83

Runtime Permission Dialog Bookmarks Navigator requests Bookmarks access Bookmarks enable easy access to your favorite sites We’ll ask for permission every time you open a new tab Deny Grant 84

Impact ● On developer ● On user 85

Impact on Developer 86

Under the Hood 87

Permission Dialog Context ● Two ways to call a chrome.* API 88

Rule-Based Triggers 89

Logic Triggers 90

Config Example { “Logic_triggers” : { “message.js:L32” : “You’ve clicked the set timer button in our extension on your navigation bar”, // More triggers } } 91

Impact on User ● Usability / security tradeoff 92

Usability ● Windows Vista UAC disaster 93

Usability ● Windows Vista UAC disaster 94

Usability ● Windows Vista UAC disaster ● Users’ skimming / not reading dialogs 95

Usability Solutions 96

Usability Solutions 97

Usability Solutions ● Standardized dialog interface that conveys a sense of danger 98

Usability Solutions ● Standardized dialog interface that conveys a sense of danger ● Conditioned-safe ceremony 99

Evaluation: Mitigation Effectiveness ● User Agent Switcher: exfiltrates visited URLs and redirects users 100