Menu
Researchers play cat and mouse with Google's anti-phishing Chrome extension

Researchers play cat and mouse with Google's anti-phishing Chrome extension

Security researchers found nine different ways to defeat Google's Password Alert extension for Chrome

For the past several days security researchers have raced to demonstrate that phishing protections added by a new Google Chrome extension can be bypassed with ease.

The Password Alert extension, developed by Google and released Wednesday, is designed to alert Chrome users when they input their Gmail passwords on websites that don't belong to Google and are therefore part of phishing attacks.

By Thursday, an information security consultant named Paul Moore had already devised a method that attackers could use to block the extension's alerts.

Google fixed that initial bypass in a new version released Friday, but since then it's been a cat and mouse game between Google's developers and security researchers who kept finding more and more ways to defeat the extension.

At the moment, the tally stands at nine bypasses, the latest of which was developed by Moore today. According to the researcher, only three of them have been patched by Google so far. The extension's latest version -- 1.6 -- was released Friday.

The majority of these exploits can be resolved easily, but a couple are difficult, if not impossible, to fix, Moore said Monday via email.

For example, an exploit developed by researchers from Dutch software security company Securify works by sandboxing an IFRAME.

"I can't see how Securify's sandbox exploit can be resolved without nullifying the sandbox completely," Moore said. "Likewise, my 'refresh on keypress' bypass works by exploiting a race condition which an extension probably cannot resolve."

In response to these exploits, the head of the webspam team at Google, Matt Cutts, commented on Twitter that: "A world in which every single phisher in the world has to play catchup/counterattack is a better world than today."

While that might be true, it's also a bit disingenuous, Moore said. "These exploits, some of which are downright comical, put the user at a disadvantage, not the attacker."

The extension will protect against the simplest phishing attacks and for that Google should be commended, but it arguably offers little protection against more sophisticated attacks and "no security is better than a false sense of security," the researcher said.

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags Securifyonline safetyGooglesecurityscamsExploits / vulnerabilities

Slideshows

Top 50 defining moments of the New Zealand channel in 2016

Top 50 defining moments of the New Zealand channel in 2016

Reseller News looks back on a tumultuous 12 months for the New Zealand channel, assessing the fallout from a year of sizeable industry change. Whether it be local or global mergers and acquisitions, distribution deals or job changes, the channel that started the year differs somewhat to the one set to finish it - Reseller News assesses the key moments that made 2016.​

Top 50 defining moments of the New Zealand channel in 2016
​Hewlett Packard Enterprise honours high achieving NZ channel

​Hewlett Packard Enterprise honours high achieving NZ channel

Hewlett Packard Enterprise honoured its top performing Kiwi partners at the second running of its HPE Partner Awards in New Zealand, held at a glitzy ceremony in Auckland. Recognising excellence across eight categories - from distributors to resellers - the tech giant celebrated its first year as a standalone company, following its official split from HP in 2015.

​Hewlett Packard Enterprise honours high achieving NZ channel
Nutanix treats channel partners to Christmas cruise

Nutanix treats channel partners to Christmas cruise

Nutanix recently took to the seas for a Christmas Cruise around Sydney Harbour with its Australia and New Zealand staff, customers and partners to celebrate a stellar year for the vendor. With the sun out, they were all smiles and mingled over drinks and food.

Nutanix treats channel partners to Christmas cruise
Show Comments