search

mallorybowes / chrome-mal-ids

Effort to list and aggregate known malicious Google Chrome Extension IDs
49 stars 14 forks source link

Test / Port to Windows / Mac / Chromebook #2

Open mallorybowes opened 4 years ago

mallorybowes commented 4 years ago

Just a wishlist item. I'm not a programmer (far from it) but should be able to figure out a "native" way to get this idea to work on multiple endpoints.

mallorybowes commented 4 years ago

Contributor @blauwers added support for Mac to the current script in the repo. Windows still needs to be done.

tchad-rogers commented 3 years ago

I tested this on MacOS Big Sur 11.1 on a 2020 13" MacBook Pro w/ Apple Silicon M1. It works perfectly without any modification.

tchad-rogers commented 3 years ago

In case other Jamf admins find this: yes, it works perfectly as an extension attribute. Wrap the output in "<result>" {...} "</result>" and you're done.

edit: actually... nope. Jamf recon runs as root, so the script checks for extensions installed to the root user's profile... which is none. It runs, but it does not return the expected result... it always finds no compromised extensions. I'm working on a fix... it's very Jamf-specific, so I will not submit it as a PR back to this repo. Message me if you need the Jamf-updated script.

JustACuteGirlLookingForAManToFixHerBugs commented 3 years ago

chanting Windows! Windows! Windows!

mallorybowes commented 3 years ago

chanting Windows! Windows! Windows!

Lol. I've thought about making an attempt to flail "The Worst Powershell Script Ever Written" together (since Windows is def not my AoE) but I'm still working on the reformatting / adding metadata to the existing extension list. (Yes, I'm incredibly slow since I tasked myself over the holidays to have that completed. It's coming. I promise. :-)

Other Windows ppl jump in if I'm wrong here but as a temp bodge, I think one thing that could work currently for Win10 is installing WSL2 and adding Ubuntu (or other distro) to get the bash shell working in Windows. That would allow the currently posted script to run and it would probably just need the correct path(s) to the user's Chrome / Brave / Edge / other Chrome-based extension directories. (I'm sensing adding the option for command-line path args to the existing script could be helpful... (⌐⊙_⊙) )

I don't currently have a Windows machine to test on (one is in the post and will be here soon) but I can add a reminder in my calendar to check that script process out once the new machine shows up. (And btw, I'm def not switching to Windows. I'm going to test using Qubes to run Win10 for malware detonations. =)

mallorybowes commented 3 years ago

Another note on this issue: I'll be converting my old laptop to a Chromebook using Neverware so will have a way to test for that platform.

adamcysec commented 1 year ago

I've created Powershell script for Windows called Scan-ChromeExtensions.ps1 located in pull request #20. Let me know if you have any questions.