Google Bans Auto Install

Wednesday, January 2, 2013 @ 03:01 PM gHale

Google has taken two steps to prevent its Chrome browser from becoming an attack vector for malware that runs as extensions to the browser.

Like many other browsers, Chrome allows users to install “extensions,” apps that add functionality. Google even runs the “Chrome Web Store” to promote extensions.

Apache Malware Installs Zeus
Exploit Kit Guarantee
IE Exploit Eyes Mouse Cursor
Chrome Wards Off BlackHole

Some of the extensions in the store are illegitimate, data stealing attackers that trick users with offers to do things like change the color of Facebook, said researchers at security firm Webroot.

Google has responded in two ways, one of which is a new service “To help keep you safe on the web” that will see the company “analyzing every extension that is uploaded to the Web Store and take down those we recognize to be malicious.”

Changes are also coming in the forthcoming version 25 of the browser, which will no longer allow extensions to install without users’ knowledge. That’s currently possible because Chrome, when running on Windows, can allow unseen installs “to allow users to opt-in to adding a useful extension to Chrome as a part of the installation of another application.”

“Unfortunately,” Google said in a blog post, “this feature has been widely abused by third parties to silently install extensions into Chrome without proper acknowledgement from users.”

Chrome 25 will therefore remove the auto-install feature, replacing it with a new system that presents a screen below when extensions try to integrate with the browser.

Leave a Reply

You must be logged in to post a comment.