Plug and Prey Scanning and Scoring Browser Extensions

Introduction to Browser Extension Security

Nishant Sharma, Head of Cybersecurity Research at Square, and Shya Prattab Singh, Principal Software Engineer at Square, discuss the growing threat of malicious browser extensions. They explain that browser extensions are small applications that run within a browser, accessing page content and performing background processing. Popular examples include password managers and ad blockers. The importance of browser security has increased as over 90% of work is now done via browsers, making them a prime target for malicious actors.

The Evolving Threat Landscape

Browser extensions have become a new frontier for cyberattacks. News reports highlight millions of installs of malicious Chrome extensions, and Google actively removes thousands of malicious extensions from its store annually. Supply chain attacks have also occurred, where compromised extensions are distributed across multiple enterprise endpoints. These extensions can act as spyware, exfiltrating user data.

Browser Extension Architecture

Browser extensions typically consist of four main components:

Manifest file: A JSON file defining the extension's properties, permissions, and scripts.

Service worker: A background process that runs independently of any specific web page.

Content script: Scripts that run in the context of a web page, allowing interaction with the DOM.

Pop-up or HTML pages: User interfaces that can be displayed when interacting with the extension.

Extensions operate within an "isolated world" by default, ensuring that their scripts and the web page's scripts have separate JavaScript variables, preventing conflicts and enhancing security. However, they run within the same process as the browser tab's renderer process, making content scripts harder to distinguish from regular page scripts.

Permissions and Analysis

Extensions require explicit permissions declared in their manifest file, adhering to the principle of least privilege. However, broad permissions like running on "every page" can be risky. Analyzing permissions is a crucial first step, but justification is key. For example, a "cookie editor" extension might reasonably request cookie permissions, while an AI assistant extension might not need them.

A Multi-Pillar Approach to Extension Analysis

To combat malicious extensions, a comprehensive analysis framework is proposed, moving beyond basic permission checks. This framework includes:

Metadata Analysis: Examining factors like the number of installs, reviews (including sentiment and keyword analysis), developer contact information (office address, domain age, email address), and detecting changes in ownership, which can indicate takeovers or secondary market sales.

Code Analysis: Utilizing LLMs and AI agents to understand the functionality of extension code (manifest, background scripts, content scripts) and provide reasoning for their assessment.

Composition Analysis: Assessing the extension's structure, including the presence of obfuscated code (e.g., WebAssembly) and the number and types of files, as hidden code can be a red flag.

Dynamic Analysis: Emulating user activity within a modified Chromium browser acting as an MITM proxy. This allows for intercepting API calls, network traffic, and observing the extension's behavior during runtime, especially when user interaction is required to trigger malicious actions.

AI Agentic Simulation: Employing AI agents to simulate user behavior, interact with the extension contextually, and generate logs of actions and reactions. These logs, combined with API and network data, are fed to LLMs for a final verdict.

Delta Analysis: Continuously monitoring extensions for updates and performing differential analysis to detect changes that might introduce malicious behavior. This is crucial given the frequent updates of extensions.

Scoring and Demo

Each of these analysis pillars contributes to a weighted scoring system, categorizing extensions as benign, risky, or malicious. A demo showcases the platform's capabilities, including metadata review (with justification for permissions), code analysis, composition analysis, dynamic analysis (API calls, network traffic, agentic simulation logs), and delta analysis. The platform aims to provide a clear changelog and identify vulnerabilities.

Case Study: Dynamic Analysis in Action

A second example demonstrates how dynamic analysis uncovered a malicious color-picking extension. Initially benign with over 100,000 installs, it later turned rogue. The modified version reported visited pages to its command and control server and could be directed by attackers to open specific URLs, potentially leading users into phishing scams. The network logs and AI agent logs clearly showed the extension reporting user activity (visiting GitHub and Google), allowing the AI to classify it as spyware.