GreedyBear: 150 Firefox extensions stole over $1 million worth of cryptocurrency

[Proty]

This really sound scary. It is obvious that there is no browser that is 100% secured morespecially if they are being loaded with extensions arbitrarily. We just need to be very careful when making use any browser because scammers are not rentelenless in there effort of looking for vulnerabilities in any browser.
The add-ons , especially the ones that appears to be official maybe more dangerous than we can ever think. I believe it will be wise if we can install extension from only trusted sources and if possible keep them to the minimum to reduce the impact of risk.

[qwertyup23]

<..snip..>
As a result, you can certainly conclude for yourself that the use of add-ons, which at first glance may seem legitimate and harmless, over time can acquire a dangerous direction, which means we must be very careful and reduce the use of add-ons to a minimum. Today's use of AI is becoming a gold mine for scammers, since these technologies are not only used in a positive direction.

To be honest, I never really understood the appeal of downloading add-ons and putting your BTCs inside. I mean, downloading add-ons already pose a risk (given that there are scam/fake applications recently) to your security, let alone storing your BTCs in them (built-in wallets).

If you truly want to utilize the convenience of add-ons, then make sure to put it in a device separate from your cryptocurrencies. At least in this way, you are being responsible and vigilant to all of your investments which could prevent any suspicious activities from happening.

In conclusion, please double or triple check everything you download from your personal device especially if it contains cryptocurrencies. If you plan on depositing it in a designated wallet, better store in a physical wallet or an exchange (though this is still a security risk) of your choice.

[ABCbits]

The forum often suggests using the Firefox browser as the most secure browser, as opposed to the Google-based browser.

Is it that common? I usually see people recommend Firefox due to better privacy (compared with Google Chrome).

It’s not common obviously and the problem as I see it here isn’t about the browser itself but, the extensions in which, the users themselves get to attach with the browser. We can’t really fault the browser on that note given that, we did put these extension setups in place and most times, not without any proper research on where it came from, we set it up because it works and that’s it.

Well, this is an eye opener eventually on the possibilities of hacks from these extensions.

I agree with you statement. Firefox (and other browser) already put several warning about add-ons. But by common, i mean recommending Firefox browser while claiming it has good security or bettery security privacy to other browser.

...However, many extensions from this history have gained a lot of reviews, and people often use reading these reviews as an additional factor for trust.

I am one of those who reads reviews to verify legitimacy of app, even if reviews are 'positive' but the way are worded often give away whether they are genuine or not, but with the rise of AI not sure how long this will work.

AI/chatbot can be misused to write fake review at lower cost, but issue of fake review and detecting fake/real review itself isn't exactly new issue.

[Mia Chloe]

That's right, verification is always mandatory. However, many extensions from this history have gained a lot of reviews, and people often use reading these reviews as an additional factor for trust. For me, they have now lost their meaning since they are no longer necessary.

Sometimes I like to say being lucky counts for your safety. We humans can be careless at times and the hopes are that in those careless of times that rarely come since you are properly informed, you don't eventually fall for any hack or you being targeted.

As for reviews they don't really matter. You could get hacked even on an open source software the fact that even with an open source wallet you need a fair understanding of some technicals to be able to verify you are using an authentic software.

[Alphakilo]

No matter how secure something appears to be, it's also in the users' best interest to make sure that they are careful while using it, especially when the time to use it for anything that has to do with funds comes. An extension is not just supposed to be installed when we don't trust the developer, especially on a PC we make use of and could easily be used to access our crypto wallet.

There is a guide that since I got in crypto I have not forgotten and it is "Don't trust, verify". And that is what I do when I want to download apps or even a browser's add on. For example, although we already know this, I always ensure to use the official marketplaces for before downloads and the number of downloads and reviews is what I also check.

Even before this, I do like an "idiot-check", of what the people are already saying about such an add-on on the internet. It seems basic but I have been saved countless times because of this. And if an app or add on is asking to have permission to things like my contacts, gallery or email, when it is not for those type od services, I do not even proceed.

[tech30338]

I would say that extensions are not automatically installed in both chrome and Firefox browsers, so compromising the system is the fault of the user, if he/she installed an extension that is with a load of malware, or the computer is infected, they might force install a extension or application, to stole a digital currency that is there, been using both chrome and Firefox for a long time, certainly some issues is with the user, clicking things they should not then blame something or someone, although this would happen to new users that just jump into crypto.