3

I have received a .zip file containg a browser extension for Google Chrome.

How can I test this safely? Current options I consider:

1) Using a VM. Installing VirtualBox on my macos, and then running it from there. Disadvantages is: slow & clunky

2) Creating a separate user on my system and testing there. Disadvantages: you have to switch user when you want to test something.

How do you tackle this?

| improve this question | |
  • I would spin up a new VM and install it into a test version of Chrome. I would set up an intercepting proxy like Burp or Fiddler, configure Chrome to use it and watch all communication the plugin may try and make – iainpb Feb 22 '18 at 14:10
  • Can you elaborate on "test version of chrome"? – FooBar Feb 22 '18 at 14:13
  • As in i'd install a version of Chrome on to your test VM specifically for testing this plugin if you do not trust it. Once my testing was complete, i'd destroy the VM. I'm not referring to any special distribution of Chrome, i'd use the same build as is on your normal machine if you can. – iainpb Feb 22 '18 at 14:16
  • However, I am also curious, if I am being too paranoia? Would the browser extension be able to go out of it's shell, and infect my system, keylog, or what-not? – FooBar Feb 22 '18 at 16:45
  • A malicious chrome extension would still need to break the browser sandbox to do anything to the rest of the system, but it could stick around and persist through removal attempts. While it wouldn't be able to keylog anything outside the browser, it could do anything inside until you manage to remove it completely. – timuzhti Feb 25 '18 at 13:24
1

If you want to run untrusted software, then it should be run in an isolated environment as much as possible. At minimum, this means that you have to use a Virtual Machine, but also that you have to not attach it to a network interface, and not share resources if not necessary (e.g. clipboard, storage). If you do need network connectivity, make sure that the network is shielded from sensitive network-accessible services on your computer and local network.

Especially in Chrome, browser extensions are supposedly well-isolated from the system. E.g. extensions installed from the Chrome Web Store do not have access to local files by default. There are exceptions though: Extensions loaded from "Load unpacked extension" at chrome://extensions' get local file access by default.
And there are sometimes bugs in the browser that allow extensions to do more than they should (this is why you should always test in the newest (stable) version of a browser - new security bugs are found and fixed in every release).

A well-configured Virtual Machine generally provides sufficient protection against malicious browser extensions. But you should be careful with deriving conclusions:

  • It is okay to use a VM to test functionality (e.g. if you want to test an ad blocker, you can visit a website and see if the ads are gone.).
  • The absence of malicious behavior cannot be used to prove that the extension is not malicious. Extensions could obscure or postpone execution of malicious code. I have seen quite some "ad blocker" forks that bury malicious code too between the seemingly legitimate code.

If you need a high level of certainty of what an extension does, then you should read its source code, e.g. using the Extension Source Viewer (disclosure: I authored this software).

| improve this answer | |
1

I recommend using a VM because it is designed to be securely isolated from the rest of your system. This especially important now that now-publically-known vulnerabilities such Spectre/Meltdown/to-be-discovered-vuln allow simple things such as JavaScript to read memory that they should not have access to.

While it is really slow, I have found that the inconvenience reminds me that I'm on a VM and that it is the home of untrusted code, not personal data.

Regarding using multiple system accounts: it simply puts the untrusted code closer to be your system than it needs to be. In addition, I can tell you from personal experience (I tried out #2 a few years ago, setting up 6 accounts in total) that it will drive you crazy

| improve this answer | |
  • Just a note, it’s possible for Spectre to read memory outside of the VM, but it’s currently difficult to exploit. – Steve Feb 25 '18 at 6:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.