Moving up the Assemblyline Exposing malicious code in browse...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://redcanary.com/blog/threat-detection/assemblyline-browser-extensions/
• Blog Title: Moving up the Assemblyline: Exposing malicious code in browser extensions
• Suggested Section: Pentesting Web -> Browser Extension Pentesting Methodology (add a subsection like "Detecting malicious extension updates / supply-chain compromise via static version diffing (Assemblyline)")

🎯 Content Summary

Overview (problem + why it matters)

This post explains a defensive, version-diff-driven workflow to detect malicious browser extension updates (a common supply-chain compromise pattern). The key risk is that extensions are small code bundles with broad permissions and automatic updates, so a previously benign extension can become malicious without any user action. Red Canary notes that in enterprise environments the median number of unique extensions...

🔧 Technical Details

Static old-vs-new extension version diffing to detect supply-chain compromises: When an extension update is observed, submit both the previous and new extension packages to a static-analysis sandbox (e.g., Assemblyline) and compare the reports. Prioritize deltas that map to attacker capability changes: (1) new or modified service worker/background scripts (persistent privileged logic), (2) new or modified content scripts (DOM access/injection and data collection), (3) newly referenced domains (potential C2/exfil), and (4) newly triggered static-analysis signatures (e.g., Base64 decoding, cookie harvesting, suspicious network-request building, eval/obfuscation heuristics). Alerts are most reliable when these signals co-occur in the same update.

Pre-disclosure detection by removing threat-intel dependencies: To avoid only catching already-known malicious updates, disable threat-intel-feed-backed detections and instead rely on intrinsic static artifacts (extracted d...

🤖 Agent Actions

Summary

• Added a static version‑diffing workflow for detecting malicious browser extension updates, including high‑signal indicators and Assemblyline service usage.
• Added the Red Canary blog reference.

Files Changed

• src/pentesting-web/browser-extension-pentesting-methodology/README.md

Notes

• Tests not run (not requested).

If you want any tweaks to the wording or scope, tell me where to adjust.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://redcanary.com/blog/threat-detection/assemblyline-browser-extensions/

Content Categories: Based on the analysis, this content was categorized under "Pentesting Web -> Browser Extension Pentesting Methodology (add a subsection like "Detecting malicious extension updates / supply-chain compromise via static version diffing (Assemblyline)")".

Repository Maintenance:

• MD Files Formatting: 954 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0