(Press-News.org) Browser extensions, the software add-ons that help users customize and enhance their web browsers, are wildly popular. Some of the most-used extensions find shopping deals, fix grammar and typos, manage passwords, or translate web pages. The types of extensions available are nearly endless, and many have become indispensable tools for businesses and everyday users.
While these extensions can make web browsing more accessible, productive, and rewarding, they are not without risk. New research from Georgia Tech reveals that thousands of browser extensions pose significant threats to privacy, and hundreds automatically extract private user content from within webpages — affecting millions of internet users.
Led by Frank Li, assistant professor in the School of Cybersecurity and Privacy and the School of Electrical and Computer Engineering, and Ph.D. student Qinge Xie, a team of researchers developed a new system that monitors if and how browser extensions collect user content from webpages. The team, which also includes Paul Pearce, assistant professor in the School of Cybersecurity and Privacy and the School of Computer Science, and Manoj Vignesh Kasi Murali, a Georgia Tech M.S. alumnus, presented their research paper at the Usenix Security Symposium, a top cybersecurity conference, in August.
“We know from prior research that browser extensions collect users’ browser activity and history, but some of the most sensitive user data is located within webpages, such as emails, social media profiles, medical records, banking information, and more,” Li said. “We wanted to know if extensions are also collecting personal data from these webpages.”
The team designed a web framework, Arcanum, to test whether extensions automatically extract user data from webpages. They used the system to study every functional extension — more than 100,000 — available in the Chrome Web Store. Specifically, they used the system to monitor whether the extensions extracted user data from seven popular websites known to contain sensitive information: Amazon, Facebook, Gmail, Instagram, LinkedIn, Outlook, and PayPal.
The researchers observed that browser extension collection of potentially sensitive and private data is pervasive. They identified more than 3,000 browser extensions that automatically collect user-specific data, affecting tens of millions of users. More than 200 extensions directly took sensitive user data from webpages and uploaded it to servers.
Browser extensions do sometimes collect user data for legitimate reasons — for example, when the data collected is related to the extension’s functionality or purpose. For this reason, it can be challenging to identify the intent behind the extension’s data collection behavior.
To investigate further, the researchers took a sample group of the flagged extensions and compared each extension’s data collection behavior to its privacy policy and web store description, which are supposed to explain how the extension is used and what information it will collect. This allowed the researchers to investigate whether users would reasonably expect extensions to automatically collect their data as part of their function.
In this sample group, the researchers found that none of them clearly described the automated user data collection in their privacy policy or web store description.
“Unfortunately, the same capabilities that extensions rely on to enrich the web browsing experience can also be abused to harm user privacy, and potentially without users’ knowledge or explicit consent,” Xie said. “Even in cases where data collection is benign and necessary for legitimate functionality, it introduces privacy risks. Sensitive user data can be transmitted and stored by a third party, which may further share the data or possibly leak the data during a data breach.”
According to the researchers, their findings suggest that companies like Google could develop stricter privacy policies for extensions or more broadly enforce existing policies. Major companies whose users’ sensitive data is being collected could also increase measures to protect their customers.
“I don’t believe individual users should have to bear the burden of worrying about their privacy or protecting their data, because they may not have the capability or technical knowledge to figure out what’s happening,” Li said. “The goal of this type of work is to bring these issues to the organizations or stakeholders that can influence data collection, in hopes that it can guide them in enhancing user privacy.”
Citation: Xie, et al. “Arcanum: Detecting and Evaluating the Privacy Risks of Browser Extensions on Web Pages and Web Content,” 33rd USENIX Security Symposium, August 14–16, 2024.
#####
The Georgia Institute of Technology, or Georgia Tech, is one of the top public research universities in the U.S., developing leaders who advance technology and improve the human condition. The Institute offers business, computing, design, engineering, liberal arts, and sciences degrees. Its more than 45,000 undergraduate and graduate students, representing 50 states and more than 148 countries, study at the main campus in Atlanta, at campuses in France and China, and through distance and online learning. As a leading technological university, Georgia Tech is an engine of economic development for Georgia, the Southeast, and the nation, conducting more than $1 billion in research annually for government, industry, and society.
END
Study finds thousands of browser extensions compromise user data
2024-09-17
[Attachments] See images for this press release:
ELSE PRESS RELEASES FROM THIS DATE:
Building better DNA editors: Retrons raise the bar for gene research
2024-09-17
SAN FRANCISCO—Within bacterial cells, specialized immune systems known as retrons fend off viral attacks. But that’s not all they can do.
Scientists, including Seth Shipman, PhD, at Gladstone Institutes, have shown that retrons also serve an important purpose in the lab: precise DNA editing. In fact, retrons can be combined with CRISPR—the far more famous bacterial-defense-system-turned-gene-editor—to better edit human cells.
Yet, for all their potential to help scientists better understand disease and develop new therapies, only a small number of retrons have been studied. In nature, many thousands of variations exist, some with greater gene-editing powers than ...
Study shows SIM models improve health data
2024-09-17
First-of-its-kind research by Tarang Parekh, assistant professor of epidemiology, reviewed the State Innovation Models (SIM), a payment system introduced by the Centers for Medicare and Medicaid Services in 2013, which provides financial incentives to states to develop innovative payment models to improve healthcare systems.
In the study, recently published in the American Journal of Epidemiology, Parekh compared data from 2010 to 2015 from three SIM participating states, Arkansas, Massachusetts and Vermont, to Florida, Nebraska and New Mexico, which do not participate in ...
Study suggests humor could help people engage with colorectal cancer information
2024-09-17
BUFFALO, N.Y. – Colorectal cancer (CRC) is no laughing matter. It’s the second-leading cause of cancer deaths globally, according to the World Health Organization. But new research led by the University at Buffalo suggests that humor can be an effective mechanism for reaching people who otherwise avoid information about colorectal cancer screening or other health messaging.
The research, published online ahead of print in the British Journal of Health Psychology, found that in people who demonstrated a ...
Q&A: Ethical decision-making around neurotechnology treatments
2024-09-17
UNIVERSITY PARK, Pa. — A novel neurotechnology treatment known as deep brain stimulation (DBS) can benefit patients with neurological disorders, but it involves surgical procedures with potential risks. Assessing the risk-benefit tradeoffs and the ethics in making decisions about whether to begin such treatments and when can be tricky for both patients and clinicians.
Laura Cabrera, associate professor of engineering science and mechanics, received a four-year, $1.5 million grant from the National Institutes of Health to research and develop ...
A smoother way to study ‘twistronics’
2024-09-17
A discovery six years ago took the condensed-matter physics world by storm: Ultra-thin carbon stacked in two slightly askew layers became a superconductor, and changing the twist angle between layers could toggle their electrical properties. The landmark 2018 paper describing “magic-angle graphene superlattices” launched a new field called “twistronics,” and the first author was then-MIT graduate student and recent Harvard Junior Fellow Yuan Cao.
Together with Harvard physicists Amir ...
UT Health San Antonio finds genetic risk-factor overlap between Alzheimer’s disease, and all-cause and vascular dementias
2024-09-17
SAN ANTONIO, Sept. 17, 2024 – In landmark research, scientists at The University of Texas Health Science Center at San Antonio (UT Health San Antonio) have reported the largest-ever genome-wide association study of dementia from all causes, revealing an overlap of genetic risks including neurodegeneration, vascular factors and cerebral small-vessel disease.
Genome-wide association studies help scientists identify genes associated with a particular disease or trait by exploring the entire set of DNA, or genome, of a ...
UM School of Medicine aims to accelerate basic science research and advance drug therapies with newly-created department
2024-09-17
University of Maryland School of Medicine (UMSOM) Dean Mark T. Gladwin, MD, has announced the formation of a new Department of Pharmacology, Physiology and Drug Development, which merges the Department of Physiology and Department of Pharmacology. This new Department aligns the basic science research efforts of both entities with a strong emphasis on the development of new drug therapies.
The Department will host three divisions spanning Cancer Therapeutics, Molecular Physiology, and Neuropharmacology, creating additional opportunities for research partnerships across current UMSOM Centers, ...
Can Google street view data improve public health?
2024-09-17
Big data and artificial intelligence are transforming how we think about health, from detecting diseases and spotting patterns to predicting outcomes and speeding up response times.
In a new study analyzing two million Google Street View images from New York City streets, a team of New York University researchers evaluated the utility of this digital data in informing public health decision-making. Their findings, published in the Proceedings of the National Academy of Sciences (PNAS), show how relying on street view images alone may lead ...
Mapping out matter’s building blocks in 3D
2024-09-17
NEWPORT NEWS, VA – Deep inside what we perceive as solid matter, the landscape is anything but stationary. The interior of the building blocks of the atom’s nucleus — particles called hadrons that a high school student would recognize as protons and neutrons — are made up of a seething mixture of interacting quarks and gluons, known collectively as partons.
A group of physicists has now come together to map out these partons and disentangle how they interact to form hadrons. Based at the U.S. Department of Energy’s Thomas Jefferson National Accelerator Facility and known as the HadStruc Collaboration, these ...
Cancer patients want financial screening early in care, study finds
2024-09-17
Patients want providers to reach out early and often to ask about financial needs
First study seeking cancer patient input on how they want to be screened
Findings show how to best deploy policies to screen cancer patients for financial concerns
CHICAGO --- Patients with cancer want their care team to assess them early in treatment about their concerns related to costs of care, reports a Northwestern Medicine study. It is the first time a study has sought cancer patients’ input on how they want to be screened for financial needs.
The financial impact of treatment, referred to as financial toxicity, includes direct costs, such as how much ...