1

A large amount of people use add-ons such as NoScript or AdBlock to avoid exploitation by malicious JavaScript from advertisments. This decreases the risk of becoming the victim of web-exploits.

But wouldn’t it be possible - if a bug was to be found in one of these popular extensions – that this actually increases the risk? As many people use it, I would assume that there would be quite a large interest in finding such bugs.
Would an extension possibly cause security problems even if the target browser does not have a specifically exploitable bug? I believe that Chrome tries to keep security issues at bay through its sandbox, but is this still a possible scenario?

  • While I can't give you a hard and fast answer, my gut tells me that yeah, if there is a bug in the add-on that is exploitable, then it can most definitely be used. – Desthro Oct 14 '14 at 19:10
1

Yes, the more components you have on any process, the more room for vulnerabilities.

In the case of browser extensions, some of them have permission to read all your history, cookies, navigation data and even change code on the pages you access. Some of them don't have vulnerabilities, but are design to inject malicious code.

AdBlock and NoScript are popular extensions, so it's expected to them to be targeted.

  • So basically it's a struggle between one threat and the other. But I guess currently the benefit is larger than the possible risk in the future, right? – John Oct 14 '14 at 20:20
  • The benefit is a lot greater than the threat. NoScript are protecting you for millions of real threats and being target of a dozen. – ThoriumBR Oct 14 '14 at 20:23
1

Adding new software always increases risk. It must be balanced against any benefits you might receive from the use of it, how sensitive the data it might be able to access, and how "risky" you think the software is. When I speak of software riskiness, I mean how good the programming practices are of the group that wrote it. Often in larger organizations they review source code or at least the processes businesses perform to ensure their code is reasonably secure.

Absolutely an attacker is going to target things that are in wide use. It's sort of the same reason that for a long time there was little Mac malware or vulnerabilities discovered...no one cared.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.