A new Chrome extension named ‘Under New Management’ checks installed extensions periodically and displays a warning to the user when a change of ownership or malicious compromise is detected.
Created by Google software engineer Matt Frisbie, the extension aims to plug a knowledge and potential security gap for users of Chrome extensions who are unaware that their software tools have been passed on to new hands.
As Frisbie explains on his GitHub page, developers of open-source extensions that are successful enough to garner a respectable number of downloads constantly receive offers from companies seeking to buy their projects. Once the transfer is done, companies seek to monetize their new assets using methods that seldom respect users’ privacy, including persistent tracking and collecting sensitive data.
The worst part of this process is that users are completely unaware of the transaction, the change of ownership, data handling and collection practices, etc. From their perspective, the extensions appear the same, still using the familiar icons/logos and offering unchanged functionality.
Apart from the legitimate change of ownership, there are also cases of extensions being hijacked by malicious actors who hacked into the Google accounts of the actual developers. In many cases, the attackers inject malicious code via an update to the extension and leave the operational aspect untouched so as not to raise suspicions.
The more extensions a user activates on their browser, the riskier the situation becomes, and there are people who rely on multiple add-ons for enhancing their productivity, unlocking customization or accessibility options, boosting privacy and security, managing passwords, blocking ads and trackers, enabling web development and design, empowering education and research, discovering media and entertainment, streamlining social media functions, finding shopping deals, and many more.
Under New Management works by checking specific elements that might indicate a change of ownership or a potential hijack. Data points include the developer name, developer website, developer email, extension name, publisher name, and extension ID.
The extension ID is generated based on a private key linked to the original developer, so when a project is acquired and development is passed to a new team, a different key will be used in subsequent uploads. That is unless the original private key is transferred to the new owner, allowing them to push updates without changing the extension ID.
When a change is detected, Under New Management lists the specific differences in the data points to enable users to discern these crucial details in the changes and draw their own conclusions regarding the status and ownership of their extension.
Under New Management is open-source, so its code and internal workings are open to scrutiny. Users can either build it from source or grab it straight from the Chrome Web Store.
RestorePrivacy cannot guarantee the project’s safety; however, if you’re using many Chrome extensions, it might be a good idea to keep it active and monitoring for changes in the background.