Discovering Browser Extensions via Web Accessible Resources Alexander Sjösten Steven Van Acker Andrei Sabelfeld Chalmers University of Chalmers University of Chalmers University of Technology Technology Technology Gothenburg, Sweden Gothenburg, Sweden Gothenburg, Sweden [email protected] [email protected] [email protected] ABSTRACT The first and second scenarios present an exclusive point Browser extensions provide a powerful platform to enrich of view of websites, concerned with malicious extensions. browsing experience. At the same time, they raise impor- The third scenario presents an exclusive view of extensions, tant security questions. From the point of view of a website, concerned with malicious websites. The fourth scenario illus- some browser extensions are invasive, removing intended fea- trates legitimate synergies between websites and extensions. tures and adding unintended ones, e.g. extensions that hi- Finally, the fifth scenario illustrates the security goals of jack Facebook likes. Conversely, from the point of view of websites and extensions at outright clash. extensions, some websites are invasive, e.g. websites that by- Bank scenario Bank webpages manipulate sensitive in- pass ad blockers. Motivated by security goals at clash, this formation whose unauthorized access may lead to financial paper explores browser extension discovery, through a non- losses. It is desirable to detect potentially insecure and vul- behavioral technique, based on detecting extensions' web ac- nerable extensions and prevent extensions from injecting cessible resources. We report on an empirical study with third-party scripts into the bank's webpages. The latter tech- free Chrome and Firefox extensions, being able to detect nique is in fact a common practice for many extensions [28, over 50% of the top 1,000 free Chrome extensions, including 31]. This scenario motivates the goal of discovering browser popular security- and privacy-critical extensions such as Ad- extensions, as the knowledge of what extensions run on the Block, LastPass, Avast Online Security, and Ghostery. We webpage can be used for tuning the defense. Facebook scenario With over a billion daily users [15], also conduct an empirical study of non-behavioral extension Facebook is a popular target for attacks. Since the Facebook detection on the Alexa top 100,000 websites. We present the application itself is relatively well protected from attacks like dual measures of making extension detection easier in the cross-site scripting, attackers look for attacks elsewhere. A interest of websites and making extension detection more prevalent threat to user integrity and confidentiality is the difficult in the interest of extensions. Finally, we discuss a use of browser extensions to inject scripts into the Facebook browser architecture that allows a user to take control in application to gain full access to the user's account [12]. arbitrating the conflicting security goals. Jagpal et al. [31] identify Facebook as the number one target for malicious extensions, reporting on the proliferation of Keywords attacks such as fake content (ad or otherwise) injection and Web security; Browser extensions; Large-scale study information stealing. This scenario motivates the need for recognizing browser 1. INTRODUCTION extensions by webpages. Having an extension detection tech- Browser extensions provide a powerful platform to enrich nique available, the webpage can adapt its behavior to the browsing experience. The Chrome web store currently con- extensions installed. Research by Facebook's anti-abuse team tains around 43,000 free extensions, with many of these ex- confirms that this is a realistic scenario [12]. tensions, such as AdBlock, Adobe Acrobat, and Skype, hav- LastPass scenario LastPass [34] is a password manager ing more than 10,000,000 users. that permits users to only remember one master password From the security point of view, browser extensions are while automatically generating, storing, and filling in pass- deployed as a \man in the browser" [27], implying that ex- words for the individual services. The LastPass Chrome ex- tensions have privileges to arbitrarily alter the behavior of tension has currently over 4,000,000 users. Being a sensitive webpages. Naturally, the power of browser extensions cre- extension, LastPass has been subject to attacks. For exam- ates tension between the security goals of the webpages and ple, LostPass [35] is a \pixel-perfect phishing" attack that those of the extensions themselves. Let us consider some rep- exploits the fact that LastPass displays its notification in resentative scenarios to illustrate the challenges in balancing the browser viewport. LostPass fakes a message of an ex- these goals. pired session and redirects users to a fake login page where it harvests the master password. (LastPass subsequently re- sponded by interface measures and asking for email confir- Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed mation for all logins from new IPs [33].) for profit or commercial advantage and that copies bear this notice and the full citation This scenario motivates the need to protect sensitive ex- on the first page. Copyrights for components of this work owned by others than ACM tensions. Being able to detect LastPass is a trigger for phish- must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a ing attacks via a malicious webpage, as in the case of Lost- fee. Request permissions from [email protected]. Pass. It is in the interest of LastPass to stay undetected. CODASPY’17, March 22-24, 2017, Scottsdale, AZ, USA Similar scenarios arise with extensions such as Avast Online c 2017 ACM. ISBN 978-1-4503-4523-1/17/03. $15.00 Security and Ghostery, popular security- and privacy-critical DOI: http://dx.doi.org/10.1145/3029806.3029820 extensions that can be targeted by malicious websites. Google Cast scenario Google Cast [26] is a popular ex- tension ids, implying that we never report an extension that tension to play content on a Chromecast device from Chrome. is not present. Upon detecting the Google Cast extension, websites like Contributions To the best of our knowledge, this work Twitch.tv adjust their functionality and offer richer features. is the first comprehensive effort on non-behavioral exten- This scenario highlights the benefit of browser extension sion detection, putting the spotlight on a largely unexplored detection, as motivated by enriching functionality rather area and systematically studying the technique and its ap- than by security considerations. plicability at large scale. To this end, the paper offers the AdBlock scenario With over 40,000,000 users, AdBlock following contributions: is currently the most popular Chrome extension [10]. It is in Precise non-behavioral extension discovery We inves- the very nature of ad blocking to modify webpages, looking tigate a non-behavioral extension detection technique, for ads and blocking them. These goals are clearly at odds based on web accessible resources (Section 3). Based with the webpages' goals. Consequently, some webpages try on unique extension ids, our detection is precise, in to detect ad blockers. the sense of no false positives, and robust, as long as This scenario motivates both the need for extension de- extensions require web accessible resources. tection from the point of view of webpages and the need for Empirical studies of Chrome and Firefox extensions evading discovery from the ad blockers' point of view. As we We report on a empirical study with Chrome's free ex- detail in Section 2, the state of the art for this scenario is tensions where we detect over 50% of the top 1,000 much of a cat-and-mouse game. free Chrome extensions, including popular security- Security goals at clash The above scenarios demonstrate and privacy-critical extensions such as AdBlock, Last- that the different stakeholders (websites vs. browser exten- Pass, Avast Online Security, and Ghostery, and 28% of sions) have different interests, resulting in the clash of the the Chrome extensions in the study overall (Section 4). respective security goals. Motivated by these security goals, We report on a similar study with Firefox's free ex- this paper focuses on discovering browser extensions and tensions (Section 4). Due to Firefox's lax architecture, pursues the following research questions: (i) How to dis- extensions are not prevented from direct modifications cover browser extensions from within a webpage, i.e, without to the UI of the browser. This explains the lesser need modifying the browser? and (ii) How can extensions evade for web accessible resources in Firefox extensions and, detection? therefore, lower discovery rates. We emphasize that this paper does not assume the inter- Demo webpage for Chrome and Firefox We provide a est of webpages over the interest of extensions or vice versa. demo webpage [55] to demonstrate discovery of Chrome Instead, we recognize that these different interests are legiti- and Firefox extensions in practice. This proof-of-concept mate, even if conflicting. We seek to better understand these webpage lists detected extensions once a user visits the interests, conceptually and empirically, and suggest steps to page with Chrome or Firefox. This page serves as a improve the state of the art on both sides. starting point, providing a core that can be further Non-behavioral extension discovery We refer as behav- developed either as a standalone service or a library ioral to extension discovery techniques that require analyz- for inclusion into other webpages. In fact, our code is ing the behavior of browser extensions. Behavioral detection already used by INRIA's Browser Extension Experi- is sometimes desirable, when a particular behavior needs ment [30]. to be detected, regardless of what extension triggers it. On Empirical studies of the Alexa top 100,000 websites the other hand, non-behavioral discovery detects extensions We conduct an empirical study of non-behavioral ex- without having to analyze their behavior.