Revisiting the Chrome Extension Permissions Model Pranav Prakash, - - PowerPoint PPT Presentation

▶
revisiting the chrome extension permissions model
SMART_READER_LITE
LIVE PREVIEW

Revisiting the Chrome Extension Permissions Model Pranav Prakash, - - PowerPoint PPT Presentation

Oct 29, 2023 17 likes •1.07k views

Revisiting the Chrome Extension Permissions Model Pranav Prakash, Chester Leung 1 Courtesy of W3Counter 2 Courtesy of W3Counter 3 Chrome has ~190,000 Google Chrome extensions released 2010 2020 2008 2019 Chrome adds Chrome removes

slide-1
SLIDE 1

Revisiting the Chrome Extension Permissions Model

Pranav Prakash, Chester Leung

1

slide-2
SLIDE 2

2

Courtesy of W3Counter

slide-3
SLIDE 3

3

Courtesy of W3Counter

slide-4
SLIDE 4

4

2019 Chrome has ~190,000 extensions 2020 Chrome removes 500+ malicious extensions 2008 Google Chrome released 2010 Chrome adds support for extensions

slide-5
SLIDE 5

Chrome Extensions...

5

slide-6
SLIDE 6

Chrome Extensions...

  • Change UI

6

slide-7
SLIDE 7

Chrome Extensions...

  • Change UI
  • Provide additional functionality

7

slide-8
SLIDE 8

Chrome Extensions...

  • Change UI
  • Provide additional functionality
  • Integrate with third party apps

8

slide-9
SLIDE 9

Extension Ecosystem

  • ~1.2B installs

9

slide-10
SLIDE 10

Extension Ecosystem

  • ~1.2B installs
  • 2.6% of installed extensions are paid

10

slide-11
SLIDE 11

Extension Ecosystem

  • ~1.2B installs
  • 2.6% of installed extensions are paid
  • 87% have less than 1,000 installs

11

slide-12
SLIDE 12

Extension Ecosystem

  • ~1.2B installs
  • 2.6% of installed extensions are paid
  • 87% have less than 1,000 installs
  • Only 13 have more than 10 million installs

12

slide-13
SLIDE 13

Extension Ecosystem

  • Most big extensions backed by a company

13

slide-14
SLIDE 14

Extension Ecosystem

  • Most big extensions backed by a company

14

slide-15
SLIDE 15

Extension Ecosystem

  • Most big extensions backed by a company

15

slide-16
SLIDE 16

Extension Ecosystem

  • Most big extensions backed by a company

16

slide-17
SLIDE 17

17

slide-18
SLIDE 18

18

It’s a business!

slide-19
SLIDE 19

19

https://extensionmonitor.com/blog/breaking-down-the-chrome-web-store-part-2

slide-20
SLIDE 20

20

https://extensionmonitor.com/blog/breaking-down-the-chrome-web-store-part-2

slide-21
SLIDE 21

21

slide-22
SLIDE 22

22

Extension developers were phished!

slide-23
SLIDE 23

23

Extensions used for malvertising

slide-24
SLIDE 24

24

slide-25
SLIDE 25

25

slide-26
SLIDE 26

26

Nigelify

slide-27
SLIDE 27

27

Nigelify

Link

slide-28
SLIDE 28

28

Nigelify

Link Extension

slide-29
SLIDE 29

29

Nigelify

Link Extension Credentials

slide-30
SLIDE 30

30

Nigelify

Link Extension Credentials

slide-31
SLIDE 31

31

Nigelify

Link Extension Credentials Resources

slide-32
SLIDE 32

Nigelify

  • Made $1000 in < 1 week

32

slide-33
SLIDE 33

Nigelify

  • Made $1000 in < 1 week
  • Affected 100k+ users

33

slide-34
SLIDE 34

Nigelify

  • Made $1000 in < 1 week
  • Affected 100k+ users
  • Prevented users from removing extension

34

slide-35
SLIDE 35

35

slide-36
SLIDE 36

36

Added users to botnet

slide-37
SLIDE 37

37

Part of malvertising campaign

slide-38
SLIDE 38

Analyzing the threat surface of Chrome’s extension APIs

38

slide-39
SLIDE 39

Chrome

  • Designed with security in

mind

39

  • Isolation, separation of

privilege 1

1 Barth, Adam, et al. "Protecting browsers from extension vulnerabilities." (2010).

slide-40
SLIDE 40

Chrome Extension Architecture

40 runtime.sendMessage

slide-41
SLIDE 41

Manifests

"background": { "persistent": false, "scripts": [ "js/background.js" ] }, "content_scripts": [ { "js": [ "js/content.js"] "matches": ["*://*.foo.com"], "run_at": "document_start" }], "permissions": ["bookmarks"]

  • Structure of extension

explicitly declared

41

  • Permissions enumerated
slide-42
SLIDE 42

Weaknesses of Permission Model

  • While limited by sandboxing/isolation, malicious

developers may not adhere to “principle of least privilege”

42

slide-43
SLIDE 43

Analyzing the Chrome APIs

  • Inspect the APIs in each permission group

43

slide-44
SLIDE 44

Analyzing the Chrome APIs

44

slide-45
SLIDE 45

Analyzing the Chrome APIs

  • Primary objectives of malicious extension

○ Data exfiltration ○ Website tampering ○ Phishing

45

slide-46
SLIDE 46

Analyzing the Chrome APIs

46

  • CIA Triad: Confidentiality, Integrity, Availability
slide-47
SLIDE 47

Analyzing the Chrome APIs

  • Classify aligned to triad

○ Info disclosure ○ Phishing ○ State manipulation ○ Obfuscation

47

  • CIA Triad: Confidentiality, Integrity, Availability
slide-48
SLIDE 48

Analysis

48

slide-49
SLIDE 49

Analysis

  • Majority of APIs can be abused

49

  • Different methods within same permission have

different threat profiles

slide-50
SLIDE 50

Reverse-engineering a malicious extension

50

slide-51
SLIDE 51

Version History

51

slide-52
SLIDE 52

Malicious buyout

  • Rather than phish developer, outright buy an extension

52

slide-53
SLIDE 53

Malicious buyout

  • Rather than phish developer, outright buy an extension

53

https://portswigger.net/daily-swig/when-browser-extensions-go-rogue

slide-54
SLIDE 54

Why so many users?

  • Possibly ranked high in google search?
  • Are all installs legitimate?

54

slide-55
SLIDE 55

Permissions

Nothing too abnormal...

55

slide-56
SLIDE 56

Suspicious Obfuscation

56

slide-57
SLIDE 57

A seemingly benign jpeg

57

slide-58
SLIDE 58

Wait that’s not a jpeg...

> file promo.jpg PNG image data, 1280 x 800, 8-bit/color RGBA, non-interlaced

58

slide-59
SLIDE 59

What’s in the alpha channel?

59

slide-60
SLIDE 60

Steganographic Obfuscation

60

slide-61
SLIDE 61

Takeaways?

  • Limitations of static/dynamic analysis

61

slide-62
SLIDE 62

Takeaways?

  • Limitations of static/dynamic analysis

62

  • Permissions system has unnecessarily broad scope
slide-63
SLIDE 63

Takeaways?

  • Limitations of static/dynamic analysis

63

  • Permissions system has unnecessarily broad scope
slide-64
SLIDE 64

Mitigations to limit power of malicious extensions

64

slide-65
SLIDE 65

Mitigation: Fine-grained permissions

  • Scope on method, not permission category

65

  • Should not be able to update tabs if only need to

refresh them

slide-66
SLIDE 66

Existing permissions

66

"permissions": [ "tabs", "*://*.google.com/" ],

slide-67
SLIDE 67

Existing permissions

67

"permissions": [ "tabs", "*://*.google.com/" ],

Update existing tabs? Spawn new tabs?

slide-68
SLIDE 68

Wildcard Host

Nothing too abnormal...?

68

slide-69
SLIDE 69

Scope network access

  • Tie network host permission to parent permission

69

"permissions": [ "tabs", "*://*.google.com/" ], "permissions": [ "tabs.executeScript" : { "*://*.google.com/" } ],

slide-70
SLIDE 70

Existing permissions

70

"permissions": [ "tabs", "*://*.google.com/" ],

Update existing tabs? Spawn new tabs?

slide-71
SLIDE 71

Revised permissions

71

"permissions": [ "tabs.executeScript" : { "*://*.google.com/" } ],

Read and manipulate your data on all google.com sites

"permissions": [ "tabs", "*://*.google.com/" ],

slide-72
SLIDE 72

Backwards Compatibility

  • Static analysis to transparently upgrade manifests
  • Prevents obfuscated API calls

72

slide-73
SLIDE 73

Mitigation: Runtime Permissions

73

slide-74
SLIDE 74

Mitigation: Runtime Permissions

  • Permission dialog every time an extension wants to run

74

slide-75
SLIDE 75

Today: Chrome Optional Permissions Feature

75

slide-76
SLIDE 76

Today: Chrome Optional Permissions Feature

  • Requested additional permissions during runtime

76

slide-77
SLIDE 77

Today: Chrome Optional Permissions Feature

  • Request additional permissions during runtime
  • Better security and information to users

77

slide-78
SLIDE 78

Today: Chrome Optional Permissions Feature

  • Requested additional permissions during runtime
  • Better security and information to users

78

slide-79
SLIDE 79

Runtime Permission Dialog

79

slide-80
SLIDE 80

Runtime Permission Dialog

80

Bookmarks Navigator requests

slide-81
SLIDE 81

Runtime Permission Dialog

81

Bookmarks access

Bookmarks Navigator requests

slide-82
SLIDE 82

Runtime Permission Dialog

82

Bookmarks access

Bookmarks enable easy access to your favorite sites

Bookmarks Navigator requests

slide-83
SLIDE 83

Runtime Permission Dialog

83

Bookmarks access

Bookmarks enable easy access to your favorite sites We’ll ask for permission every time you open a new tab

Bookmarks Navigator requests

slide-84
SLIDE 84

Runtime Permission Dialog

84

Bookmarks access

Bookmarks enable easy access to your favorite sites We’ll ask for permission every time you open a new tab

Deny Grant

Bookmarks Navigator requests

slide-85
SLIDE 85

Impact

  • On developer
  • On user

85

slide-86
SLIDE 86

Impact on Developer

86

slide-87
SLIDE 87

Under the Hood

87

slide-88
SLIDE 88

Permission Dialog Context

  • Two ways to call a chrome.* API

88

slide-89
SLIDE 89

Rule-Based Triggers

89

slide-90
SLIDE 90

Logic Triggers

90

slide-91
SLIDE 91

Config Example

91

{ “Logic_triggers” : { “message.js:L32” : “You’ve clicked the set timer button in our extension

  • n your navigation bar”,

// More triggers } }

slide-92
SLIDE 92

Impact on User

  • Usability / security tradeoff

92

slide-93
SLIDE 93

Usability

  • Windows Vista UAC disaster

93

slide-94
SLIDE 94

Usability

  • Windows Vista UAC disaster

94

slide-95
SLIDE 95

Usability

  • Windows Vista UAC disaster
  • Users’ skimming / not reading dialogs

95

slide-96
SLIDE 96

Usability Solutions

96

slide-97
SLIDE 97

Usability Solutions

97

slide-98
SLIDE 98

Usability Solutions

  • Standardized dialog interface that conveys a sense of

danger

98

slide-99
SLIDE 99

Usability Solutions

  • Standardized dialog interface that conveys a sense of

danger

  • Conditioned-safe ceremony

99

slide-100
SLIDE 100

Evaluation: Mitigation Effectiveness

  • User Agent Switcher: exfiltrates visited URLs and redirects

users

100

slide-101
SLIDE 101

UA Switcher: Still Dangerous?

  • Typical user will not switch user-agent often

101

slide-102
SLIDE 102

UA Switcher: Still Dangerous?

  • Typical user will not switch user-agent often
  • Extension may attempt to run at unexpected times

102

slide-103
SLIDE 103

Future Work

  • Prototype

103

slide-104
SLIDE 104

Future Work

  • Prototype
  • User study

104

slide-105
SLIDE 105

Thank you!

105