Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
How dangerous for the user such 3rd party search/ad Internet Explorer toolbars are?
Are they able to modify my page results and maliciously implement Cross-Site Scripting stealing for example credit card or social security numbers?
Yes. Such malicious extensions have always been developed. I think one of the best example we can mention is the notorious ZombieBrowserPack which is an opensource project develop first as a POC by Zoltan Balazs and which targets various the most used browsers (Chrome, Firefox and IE). This plugin can be manipulated remotely to steal authentication credentials and even bypass two-factor authentication mechanisms such as the ones implemented by Yahoo and Google, or simply hijack your Facebook account.
Are they able to access information beyond the browser (files, list applications, network configuration information?
Yes. The same extension we just mentioned is able take screenshots using your machine's webcam, and not only can be used to mainuplate your files but also download other malicious files to execute them on the machine's victim.
Are they able to transmit information regarding my Internet surfing behaviour back to their developers even when I don't interact with them?
Yes. Actually this plugin behaves as an HTTP proxy allowing an attacker to communicate with a server on the victim's internal network without any interactions required to be performed by the victim.
In the beginning, such extensions were used by attackers for click fraud by, for example, hijacking search queries; but the short and very rich history of the Web shows teaches us a long list of extensions developed to fulfill a targeted goals . Just to give you an example:
Through the analysis of more than 48,000 extensions from the Google Chrome web store, the group of researchers was able to detect 130 malicious extensions, including one with 5.5 million affected users.
Nowadays, you do not need only to use a malicious extension to be a victim of one of the scenarii you mentioned, but a simple visit to a given compromised webpage could lead to a drive-by download attack by exploiting your browser's vulnerabilities which are more frequently carried on by the extensions you install leading to spyware and adware (in the less dramatic cases) to infect your machine as it happened with visitors of Amnesty International's homepage on 2011 of which many users became victims.
So before making the decision to install any plugin to your browser, you need to be careful by checking the permissions requested by its developers, and when you visit a webpage prompting you a message to install a plugin to be able to view its content then do not hurry to follow the instructions (for example if you have already the Flash plugin installed and the page asks you to install it then this is likely to be a drive-by download attack requiring the user's interaction). And as a general safety practice, never install a plugin unless useful and install as few as possible of them and verify if you can the behavior and source code of your extensions from time to time as it is done here.