Not Trustworthy: How Local Browser Add-Ons Put Your Data at Risk

Posted by Gerd Meissner

Nov 16, 2016

How Local Broser Add-ons Put Your Data at RiskSECURITY

If you’re looking for ways to protect yourself when accessing the web, plugins and add-ons for your local browser are not the way to go.

Many plugins will actually increase the risk of online attacks or privacy violations, as in the case of the popular browser add-on WoT, developed by WoT Services, which was marketed as a tool to safeguard user’s data based on website ratings. WoT stands for “Web of Trust.”  Nice marketing pitch.

Yet users who bought into it just learned that they got anything but, as Germany’s investigative TV magazine Panorama and the BBC reported last week. It turns out that the WoT makers sold attributable surfing histories, email addresses and phone numbers of WoT users to the company’s customers. This allowed third parties to assemble WoT user profiles with PII, sexual preferences, health status and other sensitive information.

A big surprise? Hardly for anyone who follows this blog. Regular browsers are inherently unsafe, as we’ve frequently pointed out before. Based on protocols that hark back to the early days of the web, they leak user data to the internet like a sieve.

Because they fetch and process code from the web locally, regular browsers open up the local computer and network for infiltration by malicious software. Many third-party add-ons, plugins or extensions - even those that supposedly provide extra protection against malware and data exfiltration - are susceptible to exploit and add additional attack vectors.

WoT serves as a stark reminder. Downloaded more than 140 million times worldwide, it’s been available for Mozilla’s Firefox, Google’s Chrome, Microsoft’s Internet Explorer and Opera. (Google, Mozilla and Opera have pulled WoT from their add-on catalogs in the meantime.)

The plugin, once marketed as a way to protect private data and safeguard the browser against shady or vulnerable websites, had to be pulled from web stores last week, following media reports how the company behind it peddled detailed personal identifiable data (PII) about its users to its customers.

A fox add-on to guard the data hen house

Users impacted by this scheme include prominent industry leaders, police officers, judges and journalists. Adding to the bad news: The Register dug a little deeper and reported that a WoT code analysis posted to GitHub shows WoT’s capability to execute arbitrary code even on privileged browser pages.

The obvious conclusion: WoT users were not only at risk of surveillance. The add-on they trusted with protecting them also put the security and integrity of their local computer and network at risk.

Is WoT a rare exception? Only insofar as it purported to make the web experience of its users more secure - but instead sold them out behind their back.

Too easily overlooked in the outrage about such shenanigans: Other browser extensions, honestly developed and marketed to serve all kinds of different, more benign purposes, wreak as much or even more havoc. The infamous Flash plugins come to mind, a favorite target for hackers because they are riddled with security holes.

This may leave you wondering why such extensions make it into browser add-on download libraries in the first place - to be downloaded by millions of users?

Data security whack-a-mole: Are you still using a regular browser and browser add-ons? (Authentic8 blog illustration)

I think it’s fair to say that uncounted other add-ons, plugins and extensions with similar serious vulnerabilities - including downright dangerous features, like in the WoT case - remain undetected. The makers of regular browsers tend to miss them.

One reason is that they are dealing with thousands of add-ons and plugins with potential vulnerabilities. Individually or combined, those flaws can compound the inherent weaknesses of the local browser itself.

Throw out all browser add-ons, plugins and extensions?

What can you do to protect your business and yourself against such threats? Dump all your browser add-ons, plugins, extensions?

Google Chrome has already stopped supporting plugins such as Java and Silverlight, and Mozilla is following suit, phasing out its support for Firefox plugins that are based on the Netscape Plugin Application Programming Interface (NPAPI).

Yes, many of us have one or two or three favorite browser add-ons or plugins that add functionality that your regular browser doesn’t include, like for rendering and editing PDF documents. You still will be able to do that and more with the straightforward solution I recommend:

If you care about data security and privacy, switch to a secure virtual browser like Silo now. Unlike the browser on your desktop, Silo doesn’t process any web code on the computer and doesn’t allow local add-ons.

Instead, Silo - which was developed by our company, Authentic8 - renders web pages remotely and safely in a secure container in the cloud. No malicious code can get anywhere near your computer or network, because all web content is delivered to your screen purely as visual information - pixels - via an encrypted connection.

To users, Silo feels just like a local browser. But the attack surface for browser-based exploits - including the risks resulting from non-secure or malicious add-ons and plugins - is eliminated.

For each session, the virtual browser instance is created from scratch - and destroyed afterward, rendering futile any efforts of untrustworthy websites, cloud services or add-on makers to compromise or cash in on your sensitive data.

“Web of Trust?” If it sounds too good to be true, chances are it isn’t. “The trust of the innocent is the liar's most useful tool,” said Stephen King. On the web, protect yourself with Silo - try it here for free:

https://go.authentic8.com/intro

###

About the author: Gerd Meissner writes, edits, reviews and manages content at Authentic8.

Topics: Security