Of course, Google doesn't want to do what Mozilla and Apple do and pay human beings to vet extension code looking for malware. They'll just claim that making ad blockers less effective is the only possible action they can take.
Mozilla claims that they review all the code, but in practice they don't. They have an automated tool that looks for certain things. If nothing is found, this is the end of the code review. If things are flagged, then a human will look at the code a little.
If you have an established extension and push an update, odds are there will be no human review of the code changes. That is how most malicious extensions happen.
Sure, Mozilla historically had less malicious extensions than Chrome. But that's for the same reason that Linux has less viruses than Windows: hackers will target the 90% of users and not waste time on the rest.
I say all this as a staunch Firefox user and maintainer of a handful of extensions.
They do seem to audit their recommended extensions[0] differently though. At least according to their FAQ, the extension can't get the recommended badge until it undergoes an actual security review.
Open question about that for me though, is after the initial review is done, do they audit the updates? Something tells me that may not be the case.
They do, I first came to know that from seeing ublock origin updates gets to other browsers first. The author then says that this is because it is Firefox recommended extension and have to go through the extensive review.
Apple does not vet extension code. They do have App Store review, but App Store reviewers are not software engineers, and they spend only a few minutes on average reviewing each submission.
Mozilla mostly doesn't review source code either, except for a small number of select, popular extensions.
This is one of the major differences between Apple's App Store rules and Google's Play Store rules. Apple has traditionally not allowed third party apps to download and execute code.
Apple doesn't trust you to write your own JavaScript engine, for instance. You have to use Apple's.
On the Play Store side, the ability to download executable code has proven to be an issue, as you mention.
Known as Joker, this family of malicious apps has been attacking Android users since late 2016 and more recently has become one of the most common Android threats.
One of the keys to Joker’s success is its roundabout way of attack. The apps are knockoffs of legitimate apps and, when downloaded from Play or a different market, contain no malicious code other than a “dropper.” After a delay of hours or even days, the dropper, which is heavily obfuscated and contains just a few lines of code, downloads a malicious component and drops it into the app.
Just don't allow extensions that do that. An automated search for eval(), remote imports and script tags would probably catch most of these and if someone manages to hide it from the auditors, since source code needs to be available, a security researcher would find and report it eventually.
Comments
Of course, Google doesn't want to do what Mozilla and Apple do and pay human beings to vet extension code looking for malware. They'll just claim that making ad blockers less effective is the only possible action they can take.
Mozilla claims that they review all the code, but in practice they don't. They have an automated tool that looks for certain things. If nothing is found, this is the end of the code review. If things are flagged, then a human will look at the code a little.
If you have an established extension and push an update, odds are there will be no human review of the code changes. That is how most malicious extensions happen.
Sure, Mozilla historically had less malicious extensions than Chrome. But that's for the same reason that Linux has less viruses than Windows: hackers will target the 90% of users and not waste time on the rest.
I say all this as a staunch Firefox user and maintainer of a handful of extensions.
They do seem to audit their recommended extensions[0] differently though. At least according to their FAQ, the extension can't get the recommended badge until it undergoes an actual security review.
Open question about that for me though, is after the initial review is done, do they audit the updates? Something tells me that may not be the case.
[0]: https://support.mozilla.org/en-US/kb/recommended-extensions-...
They do, I first came to know that from seeing ublock origin updates gets to other browsers first. The author then says that this is because it is Firefox recommended extension and have to go through the extensive review.
That makes me happy to read. Good to know Firefox is keeping that promise for the recommended extensions, at least
Apple does not vet extension code. They do have App Store review, but App Store reviewers are not software engineers, and they spend only a few minutes on average reviewing each submission.
Mozilla mostly doesn't review source code either, except for a small number of select, popular extensions.
Safari extensions are distributed through the App Store and do go through a review process.
Any Mozilla extension that has the recommended extension badge has been through a an extended review process.
As usual, Google avoids hiring human beings in any user support role.
It feels like you just repeated what I said.
If an extension can load and interpret new code on the fly, that code cannot be vetted by human beings.
This is one of the major differences between Apple's App Store rules and Google's Play Store rules. Apple has traditionally not allowed third party apps to download and execute code.
Apple doesn't trust you to write your own JavaScript engine, for instance. You have to use Apple's.
On the Play Store side, the ability to download executable code has proven to be an issue, as you mention.
One of the keys to Joker’s success is its roundabout way of attack. The apps are knockoffs of legitimate apps and, when downloaded from Play or a different market, contain no malicious code other than a “dropper.” After a delay of hours or even days, the dropper, which is heavily obfuscated and contains just a few lines of code, downloads a malicious component and drops it into the app.
https://arstechnica.com/information-technology/2020/09/joker...
Just don't allow extensions that do that. An automated search for eval(), remote imports and script tags would probably catch most of these and if someone manages to hide it from the auditors, since source code needs to be available, a security researcher would find and report it eventually.