![Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VIDEO]](https://assets.crowdstrike.com/is/image/crowdstrikeinc/video-ATTCK2-1)
![Qatar’s Commercial Bank Chooses CrowdStrike Falcon®: A Partnership Based on Trust [VIDEO]](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Edward-Gonam-Qatar-Blog2-1)
![Endpoint Protection and Threat Intelligence: The Way Forward [VIDEO]](https://assets.crowdstrike.com/is/image/crowdstrikeinc/GK-Blog_Images-1)
As workforce productivity increasingly depends on web-based applications, browsers have become essential gateways to the “connectivity economy.” According to recent data, 93% of desktop internet traffic in 2023 traversed through four popular web browsers.
With their diverse functionalities and use cases, browsers are the most used desktop applications. To further expand their utility, it’s common to install and use browser extensions: small software modules that enhance and personalize the functionality of web browsers. Users install them to tailor their browsing experience to better meet their needs and preferences, and they range from ad blockers and security tools to productivity enhancers and shopping assistants. Like regular applications, however, browser extensions can become sources of malware and be exploited by attackers, which means they carry significant risks.
In this blog, we’ll explore why browser extensions are particularly attractive to threat actors and how new capabilities in CrowdStrike Falcon® Exposure Management can help security teams detect and assess these risks to stay ahead of attackers.
What Makes Browser Extensions Problematic
When an end user installs a browser extension, the permissions granted open the door to a world of possibilities — and vulnerabilities. Depending on what's allowed, these extensions can access a veritable treasure trove of information: everything from web traffic and saved credentials to session cookies, clipboard data and beyond. Though legitimate extensions often require such permissions to operate effectively, in the wrong hands, these permissions can become tools for exploitation, giving bad actors the keys to critical data and private information.
The rich data obtained through such means can subsequently be weaponized and monetized by criminals. For example, using privileged data, they can craft better phishing emails or use credentials harvested to carry out identity-based attacks.
CrowdStrike’s analysis of browser extensions in our production environments indicates that well over half of them require what may be considered excessive permissions. This means that these permissions carry strong risks, as they may allow threat actors to see all web traffic or manipulate browser tabs.
Further, because extensions are embedded into browser applications and do not create process start events, they can be harder to detect than ordinary desktop applications, allowing threat actors to obfuscate and persist their malicious activities.
How Adversaries Deploy Malicious Extensions
Extensions can be relatively easy to develop, but they don’t typically come with a web browser out of the box. Therefore, the act of deploying malicious extensions onto target victim browsers is an important part of the tradecraft. Adversaries achieve this by employing various tactics.
One common method is to list deceptive extensions on browser stores. Deception can be achieved in a number ways, including by mimicking legitimate well-known vendor product names or by publishing extensions with popular productivity purposes.
Another popular tactic is ownership takeover, where threat actors purchase or otherwise take over previously legitimate browser extensions that already have a user base and push out malicious updates to compromise target systems.
The most dangerous method is perhaps “sideloading,” which involves installing browser extensions from sources outside the official web store by directly adding the extension files. This method bypasses the usual safeguards that come with the browser stores. Attackers exploit this method by bundling malicious extensions with seemingly legitimate software applications. When users install these applications, the hidden extensions are also installed, granting attackers access to the users' browser and data.
Even with the web store method, browser extensions can expand their permissions upon installation and download additional malicious payloads. This is a popular obfuscation tactic where adversaries publish extensions to web stores with minimal initial permission requirements but expand their footprint with harmful intentions. A case in point was the notorious PDF Toolbox malicious browser extension, which downloaded additional payloads upon installation to enhance its capabilities and persistence.
