General infosec tip: keep your browser add-ons to the absolute minimum you can live with. Add-ons are attack vectors. The more you have - the more at risk you are. And only install the ones you have a reason to trust.
Nah, browsers are sandboxed to absolute shit it is such a pain in the ass to make an extension just to do a phishing attack or to buy the ownership of one to introduce malicious code.
At most an extension with really broad permissions like read/write contents of any page (a fact that is made obvious upon installation) can replace a link to take you to a phishing page to harvest creds, but thanks to SSL and HTTPS it won’t even work without fifty some odd warnings
You live by that and I’ll live by the advice I’ve seen from infosec professionals that recommend as few add-ons as possible due to security concerns. But yes, browsers are getting more secure over time and that’s good.
You obviously shouldn’t install closed source or otherwise shady extensions from dodgy authors you don’t know, but on the whole there is very little they can do that you should worry about.
Most “advice” comes from people who want to sell you something and the infosec industry is mostly a scam to drain B2B procurement budgets plus a few gay furry researchers at defcon who are incomprehensible savants and actual malware authors who do something, unless they just write crappy .NET junk.
This isn’t even a vulnerability. It’s just phishing that requires a user to have file extensions turned off, then download a dodgy as hell .PDF file that isn’t one due to hidden extension, which then uses a milquetoast .hta trojan downloader that only works if one has IE enabled on Windows AND opens the .pdf in MS Edge to pull in reverse shell code via probably psexec of some sort.
There are so many steps one wonders why not just send a iamnotavirus.exe uac prompt and all to download, compile and run ransomware from vxunderground source code then and there.
Worrying about stuff like this in browser is akin to using a VPN on public WiFi to avoid MITM attacks, there’s nothing wrong with it but there’s basically nothing to actually worry about there.
https://addons.mozilla.org/en-US/firefox/addon/redirect-mobile-wikipedia/
General infosec tip: keep your browser add-ons to the absolute minimum you can live with. Add-ons are attack vectors. The more you have - the more at risk you are. And only install the ones you have a reason to trust.
Nah, browsers are sandboxed to absolute shit it is such a pain in the ass to make an extension just to do a phishing attack or to buy the ownership of one to introduce malicious code.
At most an extension with really broad permissions like read/write contents of any page (a fact that is made obvious upon installation) can replace a link to take you to a phishing page to harvest creds, but thanks to SSL and HTTPS it won’t even work without fifty some odd warnings
You live by that and I’ll live by the advice I’ve seen from infosec professionals that recommend as few add-ons as possible due to security concerns. But yes, browsers are getting more secure over time and that’s good.
I’m an cybersec MSc and an infosec professional.
You obviously shouldn’t install closed source or otherwise shady extensions from dodgy authors you don’t know, but on the whole there is very little they can do that you should worry about.
Most “advice” comes from people who want to sell you something and the infosec industry is mostly a scam to drain B2B procurement budgets plus a few gay furry researchers at defcon who are incomprehensible savants and actual malware authors who do something, unless they just write crappy .NET junk.
Take for example an average “”“zero-day”“” in 2024: https://arstechnica.com/security/2024/07/threat-actors-exploited-windows-0-day-for-more-than-a-year-before-microsoft-fixed-it/
This isn’t even a vulnerability. It’s just phishing that requires a user to have file extensions turned off, then download a dodgy as hell .PDF file that isn’t one due to hidden extension, which then uses a milquetoast .hta trojan downloader that only works if one has IE enabled on Windows AND opens the .pdf in MS Edge to pull in reverse shell code via probably psexec of some sort.
There are so many steps one wonders why not just send a iamnotavirus.exe uac prompt and all to download, compile and run ransomware from vxunderground source code then and there.
Worrying about stuff like this in browser is akin to using a VPN on public WiFi to avoid MITM attacks, there’s nothing wrong with it but there’s basically nothing to actually worry about there.