Browser extensions by Google
Keep on top of your extensions! Extensions like this can capture personal data and it’s important to keep them up to date.
Google has released a statement that they have disabled eight Chrome and Firefox extensions. The disabling followed the revelation of a security flaw which allowed user’s personal information to leak. With so much data collected that it appears the extensions have been able to access streams of information including iCloud and OneDrive. “This leak exposed personal and corporate information on an unprecedented scale that has impacted millions of individuals,” wrote security researcher Sam Jadali, who conducted the investigation for months.
The information gathering happened quickly in real time. A marketing company called Nacho Analytics recieved the links almost immediately. According to Ars Technica, this company specializes in measuring traffic to different websites, which helps its clients
“Millions of people worldwide opted in to anonymously share their browsing history with us,” Nacho Analytics claims on its website, which states that the service is completely legal.
Indeed some browser extensions often have privacy policies that state that there may be “anonymous” information collection. However, Jadali found that Nacho Analytics, its partners and its website failed to remove links to personal information from the collection. Paid and trial members of Nacho Analytics can search for this data on the website, simply by entering some relevant domains
The 8 extensions had a total of 4.1 million users in 2018, with a large concentration of them being customers and corporate employees. Many major companies like Amazon, Apple and Facebook have had data leaks due to this distribution scheme.
Shutdowns
In response to the findings, Google and Mozilla shut down the extensions. According to Jadali, Hover Zoom, SpeakIt!, SuperZoom, SaveFrom.net Helper, FairShare Unlock, PanelMeasurement, Branded Surveys and Panel Community Surveys were implicated in the “scandal” and he urges users to uninstall them immediately.
This seems to be the case. No customers affected gained access to information that’s sensitive in nature, like links provided by Nacho Analytics. This way, no harm was done and this is all according to their FAQs as well. “This was not a hack. No sharing of personal information took place. No customer information (names, credit cards, emails, etc.) was viewed,” Nacho Analytics said on its website. “However, in an abundance of caution, we are suspending access to any sensitive data,” the company added. “We are not accepting new subscriptions to Nacho Analytics.”
The incident highlighted a potential weakness of browser extensions. They need the ability to read and write data from websites in order to function, which leaves them very vulnerable. Google is taking a step to make Chrome extensions safe. This change will come later in the year and restrict using extensions that process sensitive data through Chrome.
Some Google restrictions upset some people who rely on legitimate extensions, but many others think the risks are worth it
“Nacho Analytics isn’t the only company that uses extensions for data harvesting,” Jadali said. “There are a few more companies as well that work closely with us.” “There are other companies selling similar data collected in the same way.”
If you enjoyed this post, then you may also like this one.
Author: PC-GR
The World of Technology
