Today in the growing era of communication everyone wants to update with the new functionality so that they would survive with the best. Since the only way to access Internet is the browser, so it is vital to configure them securely. With the growing demands to ease the work in one click many engine tools, supportive plug-ins have been developed for web-browser. And the users also without knowing its causes quickly installed such extensible plug-ins in their browsers which gives the chances to intruders to get control their computer without their knowledge. Such plug-ins becomes victim for the vulnerabilities of the computer which are due to the manufacturer coding fault.
Table of Contents
1. Introduction
2. Deep Understanding
3. Case Study with Chrome Extensions
4. Secure over malicious Add-ons
5. Concluding Remarks
6. References
Research Objective and Core Topics
This work examines the security risks posed by malicious browser extensions (add-ons) that exploit browser functionality to compromise user privacy and system integrity, while providing actionable countermeasures to mitigate these threats.
- Mechanisms of browser extension vulnerabilities.
- Methods for password sniffing and email spam via malicious add-ons.
- Exploitation of browser privileges and DOM access.
- Security best practices for browser configuration.
- Countermeasures against web-based malware injection.
Excerpt from the Book
Case Study2: Bang for Password Sniffing
Nowadays, online shopping is becoming very popular due to which sensitive information such as bank account and password is often saved by the web browser, temporarily or permanently, which makes web browsers a major target of spyware. When the victim web page is loaded, Bang! injects content script into the web page, which can access all DOM (Document Object Model) elements including the form with the user name and password. Such information can then be sent to the designated email address. In order to access sensitive information in the Chrome browser, our extension needs to access the DOM tree of a web page. Therefore it needs the cross-site permission to insert the content script when a web page is rendered.
Summary of Chapters
1. Introduction: Discusses the vital need for secure browser configuration due to the prevalence of user-installed plug-ins that can lead to unauthorized system control.
2. Deep Understanding: Explains how browser extensions function and how malicious actors can exploit legitimate-looking add-ons to extract user information.
3. Case Study with Chrome Extensions: Provides practical examples of how extensions are used for email spamming and password sniffing through browser vulnerabilities.
4. Secure over malicious Add-ons: Lists recommended security measures to protect browsers against evolving threats from malicious extensions.
5. Concluding Remarks: Summarizes the need for stricter privilege management for extension components and more robust policy enforcement in browsers.
6. References: Lists the academic and technical sources used for the study.
Keywords
Browser Security, Malicious Add-ons, Chrome Extensions, Malware, Password Sniffing, Email Spam, Botnet, DOM Access, Web Browsers, Cyber Security, Content Scripts, Phishing, Privacy Protection, Privilege Management, API Exploitation.
Frequently Asked Questions
What is the primary focus of this research paper?
The paper focuses on the security threats introduced by malicious browser add-ons and how they exploit browser functionalities to compromise sensitive user data.
Which specific browser components are discussed as potential security risks?
The work highlights risks associated with browser extensions (add-ons), the use of APIs, access to the DOM (Document Object Model), and browser configuration settings.
What is the main objective of the author?
The objective is to analyze how malicious extensions operate and to suggest defensive strategies for users and browser vendors to improve security.
What research methodology is applied?
The paper utilizes a threat analysis approach, incorporating case studies of specific malicious extensions to demonstrate vulnerabilities in practical scenarios.
What does the main part of the document cover?
It covers the anatomy of malicious extensions, provides concrete case studies involving password sniffing and spamming, and outlines a list of preventative security measures.
What are the key terms associated with this study?
The study is characterized by terms such as malware, browser extensions, cyber security, DOM, and botnets.
How does the "Bang!" extension facilitate email spam?
The "Bang!" extension monitors browser tabs and sends HTTP requests to mail servers on behalf of the user, triggering spam emails without requiring manual input.
How does password sniffing occur through extensions?
Malicious extensions inject content scripts into web pages that read the DOM elements, specifically targeting username and password fields during user input.
What measures does the author suggest to improve security?
The author recommends blocking third-party cookies, being cautious with autocomplete features, enabling content filters, using popup blockers, and restricting the installation of unknown add-ons.
- Arbeit zitieren
- Hemant Kumar Saini (Autor:in), 2014, Backdoor Add-ons. A new way to harbor the data, München, GRIN Verlag, https://www.hausarbeiten.de/document/283433
