- [Instructor] Browser add-ons or extensions
are a valuable way to add functionality for web users,
but they can also turn malicious.
Let's take a look at how add-ons and extensions work,
and what security risks they pose.
Browser add-ons provide third party developers
with the ability to customize the browsing experience
by adding functionality to the browser.
Some examples of this include adding email
functionality to a web-based email system,
such as returning messages to the inbox
after a specified period of time.
Extensions might also post pages
to social media websites, manage passwords,
or run video conferences for you.
There are, however, some security risks
inherent with browser add-ons.
First, you might not know who wrote the code.
A malicious author might embed Trojan
horses within a browser extension.
Second, the permissions granted to an extension
may be overly broad, giving third parties
access to your personal information.
Let's take a look at how you can
manage browser extensions in Chrome.
We'll pull down the Chrome menu
and choose More Tools, followed by Extensions.
This will show you a set of tiles
corresponding to each of the extensions
that are currently installed in your browser.
I can choose the Details button
for any one of these extensions to learn more about it.
For example, I just clicked on the Details
for the Cisco WebEx Extension.
I can see a description that this is an extension
used to join WebEx meetings using Google Chrome.
I can see the version of the extension
and the amount of space that it consumes.
Also the permissions that this extension has been granted.
This extension has the permission to read
and change all of my data on websites that I visit,
and to communicate with cooperating
applications running on my system.
I'm going to go back to the set of extension tiles,
and I have two options on this screen for each extension.
I can use the Toggle button to change
whether an extension is currently active in my browser,
and I can use the Remove button
to completely remove an extension from my system.
There's another risk with browser extensions.
Here's a story of legitimate extensions
being taken over for illegitimate purposes.
There's actually a market for extensions
that have large audiences, because those extensions
can then be reused for other purposes,
such as advertising to that large audience.
Whether attackers write their own malicious add-ons
or purchase and repurpose a popular existing add-on,
this extra code jeopardizes security.
Security professionals must be careful to understand
what extensions are running on browsers in their
environments and limit use to trusted add-ons
with limited permissions to access data and information.