Extensions are small, easy to install and trusted by default. That combination is why T1176, Software Extensions, exists. MITRE describes adversaries abusing modular components of applications such as web browsers and integrated development environments to keep access. The tactic is persistence, and the platforms are Linux, macOS and Windows.
How attackers use it
Extensions usually arrive through official marketplaces and app stores, or are loaded by hand. They often inherit the permissions of the host application. MITRE lists several ways a bad one gets in: social engineering, a compromised marketplace, direct installation by a user, or installation by an adversary who already has access.
Two points from the page stand out. First, a malicious extension can have the same or a similar name as a good one. Second, marketplace security checks may not catch malicious components, so an attacker can get past automated scanners or lean on trust from the installation process. Adversaries may also misuse benign extensions, for example using legitimate functionality to tunnel data or bypass controls.
The sub-techniques cover the two big families, browser extensions (T1176.001) and IDE extensions (T1176.002).
How to detect it
MITRE's strategy looks for installation or execution of a malicious extension, followed by abnormal registry entries or outbound connections from the host application. By platform:
- Windows. Installation followed by abnormal registry entries or outbound connections from the host app.
- macOS. Installation of configuration profiles or plist entries tied to unauthorized browser extensions.
- Linux. Manual or script-based installation of extension-like modules into browser config directories or IDE plugin paths, followed by suspicious network activity.
Keep an inventory of installed extensions per user and compare over time. A new extension that nobody asked for is the signal.
How to reduce the risk
MITRE lists five mitigations.
- Limit installation. Only install extensions from trusted sources that can be verified.
- Audit. Make sure installed extensions are the intended ones, since many malicious extensions masquerade as legitimate ones.
- Train users to use few extensions and install only trusted ones.
- Update software so the OS and applications are current.
- Set an allow list or deny list of extensions that fits your policy.
Extensions that touch code and packages, such as IDE extensions, are part of your software supply chain. See the sub-technique posts for more.
Try it yourself
Typosquatted and malicious packages are the same trust problem as lookalike extensions. This demo shows how they are caught.
Click through it at your own pace, or open it full screen.
Quick check
Why can a malicious extension get past marketplace checks?
Marketplace security may be insufficient to catch malicious components, and attackers can exploit the trust built during installation.
Sources
- MITRE ATT&CK, T1176 Software Extensions
