11
4.3M Browsers Infected: Inside ShadyPanda's 7-Year Malware Campaign (www.koi.ai)
submitted 11 months ago by [B] to c/hackernews@lemmy.bestiver.se
2 comments fedilink hide all child comments
 

Comments

all 2 comments

sorted by: hot top controversial new old
[–] 4 points 11 months ago (1 child)

The answer is to never install bullshit add-ons.

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
    • 10 comments in c/technology@lemmy.world view that post
    [–] 34 points 11 months ago* (1 child)

    TL;Dr: Browser extensions are malware sleeper agents.

    The systemic problem isn't just one malicious actor. It's that the security model incentivizes this behavior:

    1. Build something legitimate
    2. Pass review and gain trust signals (installs, reviews, verified badges)
    3. Collect large user base
    4. Weaponize via update
    5. Profit before detection

    ShadyPanda proved this works. And now every sophisticated threat actor knows the playbook.

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
  • [–] 2 points 11 months ago

    So, asking the past defenders of such a situation again, was XUL really worse or is it in effect the same?

    Except XUL also allowed such customization that very rarely an extension would become as popular as they become now. Fragmentation as a defense.

    (That refers to the discussions about Firefox dropping XUL in the past, killing many-many good extensions and ways to make them and alternative browsers built on XULRunner.)

  • permalink
  • fedilink
  • source
  • parent
    • [–] 3 points 11 months ago (4 children)

    So what's the lesson? How can we trust browser extensions? Ublock could go bad and cook half the globe.

  • permalink
  • fedilink
  • source
  • hideshow 4 child comments
    •
  • [–] 3 points 11 months ago (1 child)

    @Fizz @homesweethomeMrL samething with everyrhing we use... You can go gentoo way and compile yourself the software you use, but even that way unless you check every line of code, you are trusting that the code behave the way you supose it does

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 11 months ago*

    I really dont wanna do that. Firefox should add 3rd party repos so my distro packagers can handle that. They love that nerd shit and I trust them more than Firefox or chrome

  • permalink
  • fedilink
  • source
  • parent
  • [–] 2 points 11 months ago (1 child)

    It's really unbelievable at this point. It's like that gentoo, meme, you have to compile your extension from sources. Even worse, as the 'supply chain' chain attack in ssh showed, you have to read the code yourself too. I am not sure if Linux becoming popular is a good thing anymore.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
    • [–] 3 points 11 months ago (2 children)

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
  • [–] 8 points 11 months ago (1 child)

    I don't see anything special on this screenshot. Most of the websites display this, at least when you have an European IP. This pop up is only exceptional in that it doesn't lag on my phone, displays correctly and has a "Reject all" button

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •