Our customer system prints badly. For years the credit control and customer service teams worked around it with a free browser extension that turned any web page into a tidy PDF. It had been in the browser's store for six years, had over a million users and a good rating, and about three hundred of our staff had installed it. Installing extensions did not need IT, and none of us had thought of one as software we were responsible for.
In April the developer sold it. Extensions update themselves silently, and the new owner's first update asked for no new permissions, because it did not need any. A tool that converts web pages already has permission to read every page you open. The new version used that permission to send the contents of pages to a server abroad.
We learned about it in June from a news article, after a researcher had reported it and the store had removed it. Our web proxy logs showed nine weeks of traffic from our laptops to that server, a little over two gigabytes. It included screens from our customer system with names, addresses and credit limits, and from credit control, the bank details on direct debit forms. We reported it to the regulator and wrote to the customers affected.
Our controls on software were strict. Nothing ran on a company laptop without approval, and new applications went through a security review. But extensions live inside the browser, which was approved, so they had never reached that process. And the review we had in mind for software was a review of the code. With an extension, the permission is granted once, at install, and the code behind it can change hands at any time afterwards.
Browser policy now blocks every extension except an approved list of fourteen. Removing the rest took out about nineteen hundred installations of three hundred and forty different extensions. For each approved one we record the publisher, and a change of ownership or a request for new permissions disables it until we have looked again. We also fixed the actual problem. Proper PDF export in the customer system took a developer two weeks, and nobody has asked for a converter since.
When we approve an extension, we are not only trusting the person who wrote it. We are trusting whoever buys it next.
– Serguey Shinder
Top comments (0)