The Great Suspender: New maintainer is probably malicious

Re:The Great Suspender: New maintainer is probably malicious by fiddlerwoaroof on Sunday January 03, 2021 @11:57AM (#25622937)

If you enumerate the ways browsers can make network requests, and if you have access to the source code of the extension, you could prepend the code with a bit of JavaScript that replaces the various network-related functions and methods with code that logs and/or validates the URL before making a request.

[ Parent | on HN ]

Re:The Great Suspender: New maintainer is probably malicious by whoopdedo on Sunday January 03, 2021 @01:07PM (#25623560)

The attacker will then inspect itself to see if network loggers are being used, or if it's running in a test environment (network location, machine fingerprint, et.al.) then adapt its behavior accordingly to avoid setting off any warnings.

[ Parent | on HN ]

Re:The Great Suspender: New maintainer is probably malicious by fiddlerwoaroof on Sunday January 03, 2021 @01:14PM (#25623609)

No, I’m saying modify the source of the extension so that the extension can only make requests to a whitelist of urls. The extension might be able to disable malicious functionality or something, but you can be certain that it’s not making malicious requests.

[ Parent | on HN ]

Re:The Great Suspender: New maintainer is probably malicious by prox on Sunday January 03, 2021 @01:50PM (#25623976)

On my android tablet they checked if my keyboard was us/eu (rain down the malware) or russian/chinese (Keep the app as-is)

And this was Google Play verified with a million downloads.

[ Parent | on HN ]