Hard to believe but cyberattacks through browser extensions are becoming normal as hackers grow their act vector.
How does Multi-Factor Authentication work?
The multi-factor authentication (MFA) system verifies users’ identity and accesses a system, application, or online service by requiring them to provide multiple forms of identification or credentials. Beyond the traditional username and password combination, it adds an additional layer of security.
As part of multi-factor authentication, there are three common factors:
- Factor of knowledge: Something the user knows, such as a password or PIN.
- Possession factor: Something the user possesses, usually a smartphone, security token, or smart card.
- Inherence factor: Something inherent to the user, often based on biometric characteristics like fingerprint, facial recognition, or voice
Despite a compromised or stolen factor, an unauthorized person cannot gain access without overcoming the additional factors. As a result, security is significantly enhanced, and attackers are less likely to be able to impersonate legitimate users as a result.
Systems and services may implement MFA differently. A one-time verification code can be sent to a mobile device, fingerprints or faces can be recognized on a smartphone, and a smart card can be inserted into a card reader. Location-based authentication and behavioral biometrics are also available in some services.
By requiring multiple forms of verification throughout the authentication process, Multi-Factor Authentication helps protect against unauthorized access.
How do Browser Extensions work?
An extension, also known as an add-on, is a piece of software that extends the functionality of a web browser. By integrating external services, adding new features, or modifying existing ones, they enhance the browsing experience.
An extension adds additional functionality to a web browser, such as Google Chrome, Mozilla Firefox, or Microsoft Edge, beyond its default capabilities. It is possible for browser vendors to develop them themselves or for third party developers to do so.
Extensions for browsers are commonly used and used in the following ways:
- Extensions can add new tools and features to the browser, such as ad blockers, password managers, translation tools, note-taking tools, and download managers.
- A browser extension allows users to customize the appearance and behavior of their browser, including changing themes, skins, and the interface.
- Users can add extensions that assist with productivity, such as task managers, email notifications, calendar integrations, or to-do lists.
- Communication and social media: Extensions can extend social media platforms, let web content be shared easily, or integrate messaging services.
- VPNs, ad blockers, anti-tracking tools, and script blockers are extensions that help protect user privacy and enhance security.
- Developers can use browser extensions for debugging, inspecting web pages, editing CSS, analyzing performance, or automating tasks.
The official extensions marketplaces or stores associated with each browser distribute browser extensions. Extensions can be installed from these stores, and users can manage their installed extensions within the browser’s settings.
Although browser extensions can provide useful functionality, they can also pose security risks if they are not obtained from trusted sources. To minimize the risk of malware or privacy breaches, users should exercise caution when installing extensions from reputable developers or official stores.
Why are Browser Extensions Risky?
A threat actor has a wide range of attack options. User-centric applications have become increasingly popular in recent years. As opposed to highly protected administrator accounts, hackers target applications or extensions that can be easily installed by users without IT involvement,
- Chrome-based browser extensions are one example of the proliferation of extensions. This malware was discovered by Trustwave, disguised as an extension for Google Drive.
- Threat actors were able to check browser history, take screenshots, and inject malicious scripts that targeted cryptocurrency exchanges after installing the extension.
Moreover, cybersecurity giant Kaspersky recently discovered 34 malicious Chrome extensions that had been downloaded over 87 million times. Users are at risk of data leakage and system compromise when multiple malicious extensions target their installations.
Unchecked user control poses risks
There was a time when users were running with the least privileges instead of being primarily administrators. As a result, malicious applications and attacks had a reduced attack surface. Depending on the nature of the attack, the damage may be limited to the user’s profile and data they could access.
The separation of user and administrative accounts provides significantly enhanced security in the event of a compromised user account. The user applications and extensions have increased because users felt safe with this separation.
Chromium-based browser extensions or development tools such as Visual Studio Code are examples of extensions. As these extensions are downloaded from traditionally trusted sources, such as Google and Microsoft’s Visual Studio Code extension repository, users may need to examine the installation process more carefully.
There is an increase in attacks via extensions and tools installed via user profiles as a result of this lack of attention.
Users can be silently compromised from trusted sources by buying extensions or packages that were once legitimate.
A Guide to Preventing Damage from User-Profile Extensions and Packages
In order to protect themselves, what can an IT department and a user do? The use of allow-lists and vetting extensions and packages is one strategy to proactively limit what users can install. By doing so, both users and administrators are assured that only safe packages are used.
- Apps and extensions can be allowed or blocked in Chrome
- Manage extensions with group policies in Edge
- Extension settings in Chrome
Especially if done by a third party, IT administrators should monitor extensions and packages that allow ownership changes. A user extension may attempt to read data that a profile can see, including passwords stored locally on a file.
Having a password alone is not enough to access a sensitive system, which emphasizes the necessity for Multi-Factor Authentication (MFA).
A user’s account must be quickly cleaned and reset after an attack. User-profile attacks can use the data inside user profiles, so phishing emails sent from legitimate accounts could further expand the attack.
Improvements and hazards associated with user profiles
Although admin accounts have shifted to limited user accounts, users can still install applications themselves which pose an evolving threat. Various applications, such as extensions and packages, can appear legitimate while auto-updating.
Managed IT service providers (MSPs) and IT organizations must therefore proactively control what their users install and use.
When a user’s credentials are compromised, it is crucial that an organization quickly verify the user’s identity and reset their credentials. Immediately stopping the attack and cleaning the user’s account and system will prevent future problems.
Is your network following industry best practices?
Gain new business and never worry about the effects after ransomware attack.
Our Complimentary Network and Security Assessment can put your IT to the test against other Toronto managed IT services providers.
365 iT SOLUTIONS offers Toronto award-winning services including:
- Managed IT Services Toronto
- IT Outsourcing Services Toronto
- Tech Support Services Toronto
- IT Support Services Toronto
- Cloud Services Toronto
- Managed Security Services Toronto
- Cyber Security Training and Dark Web Monitoring Toronto
- Business continuity and disaster recovery (BCDR)Toronto
We Make IT Simple!
