Thread by @krippenreiter

⚠️ A browser extension is always a double-edged sword.

In general, there isn't much to disagree with in what @panosmek has written in this fantastic thread, but here are few additional thoughts:

🧵👇 [1/13]

https://twitter.com/panosmek/status/1652383985450770439

[2/13] Browser extensions in and of themselves can easily be the source of #exploits.

So, rather than securing your #browser session, increasing your #privacy, or acting as a warning tool before signing transactions, it may turn out to be your worst enemy.

[3/13] — Attack Vectors —

🧐 There are merely two malicious concepts that will be exploited by #hackers to harm you while using #browser extensions:

🔸 Supply-Chain attack
🔸 Man-in-the-middle attack

[4/13] — 1⃣ Supply-Chain Attack —

Supply-Chain attacks are a threat that targets software DEVs and providers.

The objective is to get access to source codes, build processes, or update mechanisms through infecting legitimate programs in order to distribute #malware

[5/13] — 2⃣ Supply-Chain Attack —

In the case of #browser extensions, this means that the #hacker will tamper somewhere along the line of delivering updates or installing the extensions.

As an example, look at the following:
🔗 wordfence.com/blog/2017/08/c…

[6/13] — 3⃣ Supply-Chain Attack —

Another unfortunate example is when DEVs sell their extension product to other firms without informing you.

They may then decide to spread #malware or spy on you, and they may not have your best interests at heart.

🔗 theregister.com/2021/01/07/gre…

[7/13] — 1⃣ Man-In-The-Middle Attack —

#MITM, which is used in combination with the supply chain attack, is the fact that the suspicious actor intercepts your #browser internet traffic.

In most situations, this is used to eavesdrop on or tamper with your network data.

[8/13] — 1⃣ Solutions —

In general, #browser providers have safeguards in place to protect users from these kind of browser #extension attacks, so don't worry, they're not as widespread as you may assume.

Nonetheless, I would never suggest using any browser extension.

[9/13] — 2⃣ Solutions —

In general, when actively using a #wallet, you must be aware that a single incorrectly signed TX will probably drain your whole wallet.

Hence, my 1st advice is:

🔸 For heavy activity, use hot #wallets
🔸 For #EVM-based NFTs, use burner wallets

[10/13] — 3⃣ Solutions —

Transferring low-value TXs initially is always suggested before moving larger amounts.

But please don't let this distract you from the reality that #vulnerabilities can be engineered to trigger only when specific parameters (values) are satisfied. 😅

[11/13] — 4⃣ Solutions —

If you don't want to abandon #browser extensions, use them only to "check" the TX intent within a constrained environment known as a virtual machine.

"Checking" may be done quickly and easily with:
[1] sandboxie-plus.com
[2] github.com/sandboxie-plus/

[12/13] — 5⃣ Solutions —

The actual signature for the requested TX should only be submitted on a new operating system and browser.

As a result, my final advice is:

🔸 Purchase and utilize a #hardwarewallet.
🔸 Purchase and use a dedicated laptop.
🔸 Install no #extensions.

[13/13] I hope you appreciated this 🧵 that sheds some light on some of the negative aspects of browser extensions. 😅

Please follow me here:
@krippenreiter 🙏

Feel free to contribute by sharing here: 👇

https://twitter.com/krippenreiter/status/1652487407726460928?s=20

@threadreaderapp unroll