Browser Extension Research Articles

Unveiling the Underbelly of Web Application Vulnerabilities: A Critical Exploration

This study reveals web application weaknesses and demonstrates how frequent security flaws permit unauthorized entry to web solutions. Many web applications are at risk due to the secrecy of the data they store. Recognizing this theme plays a key role in identifying the threats in play. We examined the OWASP's Top 10 weaknesses together with Session Hijacking and Weak Password Management. Violent Monkey shows the methods to take advantage of this breach by mixing practical exploration with tools, including Burp Suite and Nmap, Wireshark, and browser extensions Cookie Editor. With Cookie Editor at hand, session hijacking happens in a moment as session cookies can be easily gathered with Google Dorking and transmitted to a premium account. Violent monkey effectively represents a key illustration of privilege escalation. An authorized user can access premium features by placing a script in the client component of a web service. Errors occur in managing passwords because a 10-thousand-character password gets made and endorsed without input validation from the system. Thanks to these weaknesses, hackers gain unauthorized access and compromise data. Investigating strong vulnerability management motivates this project and encourages additional research into how machine learning can identify weaknesses and provide timely threat-related data

Toward Context-Aware Privacy Enhancing Technologies for Online Self-Disclosure

Voluntary sharing of personal information is at the heart of user engagement on social media and central to platforms' business models. From the users' perspective, so-called self-disclosure is closely connected with both privacy risks and social rewards. Prior work has studied contextual influences on self-disclosure, from platform affordances and interface design to user demographics and perceived social capital. Our work takes a mixed-methods approach to understand the contextual information which might be integrated in the development of privacy-enhancing technologies. Through observational study of several Reddit communities, we explore the ways in which topic of discussion, group norms, peer effects, and audience size are correlated with personal information sharing. We then build and test a prototype privacy-enhancing tool that exposes these contextual factors. Our work culminates in a browser extension that automatically detects instances of self-disclosure in Reddit posts at the time of posting and provides additional context to users before they post to support enhanced privacy decision-making. We share this prototype with social media users, solicit their feedback, and outline a path forward for privacy-enhancing technologies in this space.

Real-time phishing URL detection framework using knowledge distilled ELECTRA

The rise of cyber threats, particularly URL-based phishing attacks, has tarnished the digital age despite its unparalleled access to information. These attacks often deceive users into disclosing confidential information by redirecting them to fraudulent websites. Existing browser-based methods, predominantly relying on blacklist approaches, have failed to effectively detect phishing attacks. To counteract this issue, we propose a novel system that integrates a deep learning model with a user-centric Chrome browser extension to detect and alert users about potential phishing URLs instantly. Our approach introduces a Knowledge Distilled ELECTRA model for URL detection and achieves remarkable performance metrics of 99.74% accuracy and a 99.43% F1-score on a diverse dataset of 450,176 URLs. Coupled with the browser extension, our system provides real-time feedback, empowering users to make informed decisions about the websites they visit. Additionally, we incorporate a user feedback loop for continuous model enhancement. This work sets a precedent by offering a seamless, robust, and efficient solution to mitigate phishing threats for internet users.

Support Personas: A Concept for Tailored Support of Users of Privacy-Enhancing Technologies

In many applications and websites people use in their everyday life, their privacy and data are threatened, e.g., by script tracking during browsing. Although researchers and companies have developed privacy-enhancing technologies (PETs), they are often difficult to use for lay users. In this paper, we conducted a literature review to classify users into different extit{support personas} based on their privacy competence and privacy concern. With developers of PETs in mind, support personas were envisioned to facilitate the customization of software according to the support needs of different users. In order to demonstrate the usefulness of support personas and based on workshop sessions with 15 participants, we designed a browser extension that supports users with the issue of script tracking by providing different user interfaces for different support personas. The following qualitative evaluation with 31 participants showed that the developed UI elements worked as intended for the different support personas. Therefore, we conclude the concept of support personas is useful in the development process of usable applications that enhance the privacy of the users while also educating them and thus potentially increasing their privacy literacy.

Teaching Astronomy in the Age of Misinformation

Anyone teaching science is facing a rising tide of online misinformation, and students are often ill-equipped to judge the reliability of what they see online. A project is described to use machine learning to detect and flag misinformation, based on initial training by science undergraduates. The neural networks are 95% reliable when applied to an initial testbed of articles on evolution and climate change. The technology will be released as a web browser extension and eventually as a smartphone app.

What Does It Mean to Be Creepy? Responses to Visualizations of Personal Browsing Activity, Online Tracking, and Targeted Ads

Internet companies routinely follow users around the web, building profiles for ad targeting based on inferred attributes. Prior work has shown that these practices, generally, are creepy—but what does that mean? To help answer this question, we substantially revised an open-source browser extension built to observe a user's browsing behavior and present them with a tracker's perspective of that behavior. Our updated extension models possible interest inferences far more accurately, integrates data scraped from the user's Google ad dashboard, and summarizes ads the user was shown. Most critically, it introduces ten novel visualizations that show implications of the collected data, both the mundane (e.g., total number of ads you've been served) and the provocative (e.g., your interest in reproductive health, a potentially sensitive topic). We use our extension as a design probe in a week-long field study with 200 participants. We find that users do perceive online tracking as creepy—but that the meaning of creepiness is far from universal. Participants felt differently about creepiness even when their data presented similar visualizations, and even when responding to the most potentially provocative visualizations—in no case did more than 66% of participants agree that any one visualization was creepy.

WRIT: Web Request Integrity and Attestation Against Malicious Browser Extensions

WRIT: Web Request Integrity and Attestation Against Malicious Browser Extensions

In-Page Navigation Aids for Screen-Reader Users with Automatic Topicalisation and Labelling

Navigation aids such as headers and internal links provide vital support for screen-reader users on web documents to grasp a document’s structure. However, when such navigation aids are unavailable or not appropriately marked up, this situation can cause serious difficulties. This article presents the design and evaluation of a tool for automatically generating navigation aids with headers and internal links for screen readers with topicalisation and labelling algorithms. The proposed tool uses natural language processing techniques to divide a web document into topic segments and label each segment in two cycles based on its content. We conducted an initial user study in the first cycle with eight blind and partially-sighted screen reader users. The evaluation involved tasks with questions answered by participants with information from texts with and without automatically generated headers. The results in the first cycle provided preliminary indicators of performance improvement and cognitive load reduction. The second cycle involved co-designing an improved version with two blind experts in web accessibility, resulting in a browser extension which injects automatically generated headers and in-page navigation with internal links, along with improvements in the generation of labels using OpenAI’s ChatGPT. The browser extension was evaluated by seven blind participants using the same four texts used to evaluate the preliminary prototype developed in the first cycle. With the two development cycles, the study provided important insights into the design of navigation aids for screen-reader users using natural language processing techniques, including the potential use of generative artificial intelligence for assistive technologies and limitations that need to be explored in future research.

Phishing detection tool for financial emails

Phishing attacks have emerged as a significant cybersecurity threat, especially within the financial domain, where email serves as a prevalent vector for malicious activities. This project report outlines the development and evaluation of a Chrome browser extension tailored to bolster email security, specifically focusing on detecting and mitigating phishing attempts in financial communications. The study begins with a thorough examination of the techniques and tactics used by phishing attackers in financial email campaigns. A sophisticated awareness of the changing landscape of phishing assaults is required to develop successful defences. The key contribution of this work is the development of a powerful Chrome browser extension that easily integrates with common email services in the financial sector. This extension harnesses a blend of machine learning algorithms, URL analysis, and user-friendly interfaces to identify potentially malicious financial emails. It rigorously scans email content, scrutinizing hyperlinks and attachments for signs of phishing. The extension evaluates URL reputations, checks for typical phishing indicators, and examines email headers. In case any suspicious elements are identified, users receive real-time alerts, enabling them to make informed decisions about the safety of financial emails. To ensure the extension’s accuracy and effectiveness within the financial context, an extensive dataset of real-world phishing emails and legitimate financial messages is employed for training and testing. The report offers a comprehensive analysis of the extension’s performance, emphasizing its capability to detect and prevent phishing attempts in financial emails while minimizing false positives. In addition to its detection capabilities, the extension actively promotes user awareness and education regarding phishing threats within the financial sector. It provides guidance on recognizing phishing red flags and offers educational resources to enhance user security practices. This work concludes with an evaluation of the extension’s usability and its potential impact on enhancing email security within the financial domain. It underscores the critical role of proactive measures, such as this extension, in addressing the evolving threat landscape of phishing attacks in the digital age, particularly within financial communications.

Analyzing Security Risks in Browser Extension Search Tools: A Literature Review

The literature review titled "Analyzing Security Risks in Browser Extension Search Tools" explores the growing interconnection between the digital and physical domains and the vulnerabilities and threats that accompany it. The study highlights how the Darkweb can be used for communication and anonymity, but because it is encrypted, it presents difficulties for law enforcement. Although browser extensions are essential for improving user experiences when browsing, they also offer security vulnerabilities like cross-site scripting and privilege escalation that can be used maliciously. The study emphasizes the necessity of better detection techniques for malicious extensions using Static and dynamic analysis combined, as well as the significance of advanced threat analysis and AI integration to foresee and mitigate cyber attacks.In order to improve the practical applicability of security measures, the study also urges a deeper comprehension of user behaviors and socioeconomic dynamics inside the Darkweb ecosystem. In order to successfully handle evolving cyber risks, future research topics include developing automated security testing procedures, upgrading authorship attribution algorithms for user privacy, and developing tools such as the WAP static analysis tool. Keywords: Browser add-ons, security hazards, Darkweb, online threats, sophisticated threat analysis, artificial intelligence integration, methods of detection, user conduct, and acknowledgment of authors WAP tool, cybersecurity, and automated security testing.

Walkthrough phishing detection techniques

Phishing has emerged as a significant cyber threat, resulting in huge financial frauds for internet users annually. This malicious activity uses social engineering and upgraded methodologies (like file archiver in the browser, content injection, calendar phishing, more convincing fake websites or emails, voice manipulation, or other tools designed to deceive and exploit the target’s confidence) to extract sensitive information from unsuspected victims. In order to mitigate these attacks, several methods and tools have been devised; various detection techniques and block phishing websites, and browser extensions that notify users about suspicious websites. Our work elaborates on meticulous analysis of the detection of phishing attacks by classifying them into four broader categories based on the adopted methodologies like List-Based Detection, Heuristic-Based Detection, machine learning (ML)-based, and deep learning (DL)-based. Additionally, it summarizes the popular devised schemes, highlighting their advantages and limitations, and how these are suitable for the different types of deployments.

Detection of Phishing Websites using Machine Learning

Abstract: Malicious links or attachments through emails that can perform various functions, including capturing the victim's login credentials or account information is send by phishing. these victims, cause money loss, and identity theft is harmful. In these the phishing problem by developing an extension for the Google Chrome web browser we can contribute to solve this. we used JavaScript PL in development of these feature. a combination of Blacklisting and semantic analysis methods was used to preventing the attack. and the proposed solution was tested and it can be compared to existing approache.

Secure Browse: AI-Powered Phishing Defense for Browsers

Purpose: With the rising threat of phishing attacks exploiting user naivety, this report introduces a novel approach to bolster web security. Traditional rule-based systems and existing solutions fall short in addressing sophisticated phishing attempts. The proposed solution entails a Chromium-based browser extension that leverages machine learning classification techniques. Methodology: A Python web server, utilizing decision trees, k- nearest neighbors, and random forests, assesses the legitimacy of a given URL. The extension communicates with the server, providing real-time notifications to users when visiting potential phishing sites. Findings: Experimental results demonstrate the effectiveness of the ensemble model with an accuracy of 90.68%, marking a significant improvement over rule-based alternatives. Unique contribution to theory, policy and practice: Future work includes refining models, incorporating user feedback, and expanding the application to diverse platforms and contexts.

Auto-Logout Google Account Extension

Abstract: This project aims to develop a browser extension that automatically logs out users from their Gmail accounts upon browser closure, bolstering security, especially during power outages. It also alerts users before closing the browser if any webpage has a logged-in Google account to prevent unauthorized access. Given the risks associated with forgotten password emails and the broad access granted by Google accounts, such as to Drive and Photos, the extension plays a crucial role in mitigating potential data breaches. Additionally, it facilitates the management of Google account data, including location information and device identifiers, offering proactive protection against unauthorized access and security threats like phishing attacks and malware

PhishingRTDS: A real-time detection system for phishing attacks using a Deep Learning model

In recent years, phishing attacks have become more intelligent and more challenging to detect using typical phishing methods. Moreover, attackers have leveraged some web development techniques to increase the website's legitimacy in victims' eyes, such as using JFrame to design a window that looks like a browser inside the webpage. In this paper, we design a system that detects three types of phishing attacks: Tiny Uniform Resource Locators (TinyURLs), Browsers in the Browser (BiTB), and regular phishing attacks. In this system, we aim to protect victims from mistakenly downloading malicious software into their systems. We split our system into three parts: Deep Learning model (DL), browser extension, and docker container. First, we design a DL model using bidirectional long short-term memory (BiLSTM) and an attention mechanism to classify the URL as phishing or benign. Our model shows 99% in its precision, recall, and F1 score. Second, we design a browser extension to extract the original URL from the suspect webpage and then send it to the docker container. Then, the docker container opens the webpage and extracts all URLs from its HyperText Markup Language (HTML) and JavaScript. Then, each URL passes to a DL model for classification, resulting in a list of labels for each webpage. Therefore, we use three decision strategies: Single Phishing Strategy (SPhS), Mean Sum Strategy (MSS), and Weighted Average Strategy (WeAS) to decide whether the webpage is phishing or benign. Our findings indicate that the best results among the three strategies were WeAS.

Ensemble Learning-Based Browser Extension for Mitigating Cyber Attacks Carried out using Malicious Short URLs

As digitization continues to expand and cybercrimes become more prevalent, making it is crucial to prioritize the implementation of robust security measures. Malicious short URLs are frequently utilized as a vector for cyber-attacks on online forums and social media platforms. To address this issue, a plugin-based solution that uses ensemble learning to combine random forest, k-neighbors classifier, and logistic regression into a stacked model, was developed. The model was trained over the combination of three most popular kaggle datasets, with over 1081195 URLs. Additionally, gradient boosting was applied to further enhance the model's performance, resulting in a 92% accuracy in the detection. We developed the browser extension with Flask and JavaScript that identifies URLs as malicious or safe, for facilitation of the proposed solution. The work emphasizes the need for effective measures to mitigate cyber-attack risks, particularly those involving malicious short URLs.

Evaluative Exploration of Data Monetisation Platform Capabilities

The article explores the capabilities of various data monetization platforms, such as Gener8, Datacoup, Datawallet, and Swash, highlighting their innovative approaches, user benefits, ethical considerations, and privacy implications. Through comparative analysis, the study examines how these platforms transform personal data into economic value, offering users different methods for monetizing online behaviour, social media interactions, and web activity. Gener8, for instance, rewards users for ad viewing and enhances online shopping experiences, while Datacoup allows for direct data sales, emphasizing user consent and transparency. Swash offers a passive income model through a browser extension, prioritizing user privacy and employing blockchain technology for secure transactions. The article delves into the ethical and privacy concerns arising from data commodification, advocating for robust regulatory frameworks and transparency in data transactions. It concludes that while these platforms offer new opportunities for personal data monetization, they also necessitate careful consideration of privacy implications, underscoring the need for ongoing dialogue around the value of personal data and individuals' rights in the digital marketplace.

Website Data Transparency in the Browser

Data collection by websites and their integrated third parties is often not transparent. We design privacy interfaces for the browser to help people understand who is collecting which data from them. In a proof of concept browser extension, Privacy Pioneer, we implement a privacy popup, a privacy history interface, and a watchlist to notify people when their data is collected. For detecting location data collection, we develop a machine learning model based on TinyBERT, which reaches an average F1 score of 0.94. We supplement our model with deterministic methods to detect trackers, collection of personal data, and other monetization techniques. In a usability study with 100 participants 82% found Privacy Pioneer easy to understand and 90% found it useful indicating the value of privacy interfaces directly integrated in the browser.

Increased Usage of Alt Text Is Required Across Ontario Public Library Social Media Feeds to Increase the Accessibility of Content

A Review of: Hill, H., & Oswald, K. (2023). “May be a picture of a dog and a book”: The inaccessibility of public libraries’ social media feeds. Partnership, 18(1), 1–14. https://doi.org/10.21083/partnership.v18i1.7008 Objective – The research project sought to explore how accessible the social media feeds of Ontario public libraries are, particularly the use of alt text for images, by assessing the usage of alt text and by making recommendations for appropriate use within social media posts. Design – Collection of social media posts and computer-assisted textual analysis of visual media content. Setting – 76 public libraries and 9 public library systems in Ontario, Canada. Subjects – Approximately 900 Ontario public library social media posts from Facebook, Twitter, and Instagram. Methods – A random number generator sampling of 30 libraries per platform from the relevant social media accounts from a spreadsheet created using Ontario Public Library Statistics (OPLS) data of social media usage from the included libraries was initially created capturing 76 individual libraries. Then the researchers performed targeted sampling of posts from the nine library systems serving over 250,000 residents each. Researchers identified the 10 most recent posts from each included platform feed, and then undertook textual analysis for the presence of alt text with each post using two Mozilla Firefox browser extensions that determine the presence of alt text. Main Results – Of the 76 unique libraries chosen by the random sampling and the nine library systems that serve populations over 250,000, only two regularly used alt text and five had at least one instance of alt text. Only Toronto Public Library regularly included alt text across each of the three social media platforms analyzed by the study. The study also initially aimed to assess the quality of alt text used by public libraries in social media posts. However, due to the lack of alt text use across the sample, this was not possible at the scale initially aimed for, although a small number of examples are analyzed in the findings. Conclusion – The initial goal of analyzing the alt text to make recommendations for improved usage could not be realized due to the surprising lack of inclusion of any alt text across the sampled posts. This lack of any alt text can prevent some disabled users from engaging with content and information, leading to an inequitable experience. Public libraries should consider how accessible their engagement with users is and seek to improve the accessibility of social media posts.

Exploiting the untapped functional potential of Memento aggregators beyond aggregation

AbstractWeb archives capture, retain, and present historical versions of web pages. Viewing web archives often amounts to a user visiting the Wayback Machine homepage, typing in a URL, then choosing a date and time significant of the capture. Other web archives also capture the web and use Memento as an interoperable point of querying their captures. Memento aggregators are web accessible software packages that allow clients to send requests for past web pages to a single endpoint source that then relays that request to a set of web archives. Though few deployed aggregator instances exist that exhibit this aggregation trait, they all, for the most part, align to a model of serving a request for a URI of an original resource (URI-R) to a client by first querying then aggregating the results of the responses from a collection of web archives. This single tier querying need not be the logical flow of an aggregator, so long as a user can still utilize the aggregator from a single URL. In this paper, we discuss theoretical aggregation models of web archives. We first describe the status quo as the conventional behavior exhibited by an aggregator. We then build on prior work to describe a multi-tiered, structured querying model that may be exhibited by an aggregator. We highlight some potential issues and high-level optimization to ensure efficient aggregation while also extending on the state-of-the-art of memento aggregation. Part of our contribution is the extension of an open-source, user-deployable Memento aggregator to exhibit the capability described in this paper. We also extend a browser extension that typically consults an aggregator to have the ability to aggregate itself rather than needing to consult an external service. A purely client-side, browser-based Memento aggregator is novel to this work.