Microsoft has a fake extensions problem in its Microsoft Edge Store

[sman]

Microsoft has a fake extensions problem in its Microsoft Edge Store

Microsoft has a fake extensions problem in its Microsoft Edge Store - gHacks Tech News

Quote

After the removal of several fake extensions last week, Microsoft once again had to remove a fake extension. Last week, it became known that several fake extensions were removed by Microsoft that were made to look like extensions from legitimate services. Affected products were the content blocker uBlock Origin, the VPN services NordVPN, Adguard VPN and TunnelBear VPN, and other legitimate browser extensions.

Abusive add-ons aren’t just a Chrome and Firefox problem. Now it’s Edge’s turn

Abusive add-ons aren’t just a Chrome and Firefox problem. Now it’s Edge’s turn | Ars Technica

Now I see, why I had problems of redirection. I installed Adguard VPN and find it's afake one and no wonder I faced problems, which seemed to vanish after removing extensions.

[exile360]

Yep, that explains it.  Sadly, using reputable companies and products to push PUPs and malware is a common practice and has been for many years (remember all the rogue/fake AVs years ago that pretended to be legitimate Microsoft, Trend Micro, Symantec/Norton products among others?).  For a long time now, fake Flash player, QuckTime, Java and other browser plugins/extensions have been found in the wild bundled with PUPs, and I've seen tons of them in the Chrome web store, Mozilla add-ons site and other legitimate sources for extensions and add-ons for browsers, so Microsoft is going to have to be diligent and users will have to do research and be cautious about what they install, just as they must be when downloading anything from anywhere else on the web.

[sman]

Second it. A real shocker to me to find that MS store harbors fake extensions and I installed Adguard VPN (w/o second thoughts believing it ti be a Adguard product) and well have to be careful from now on.

[exile360]

Yes, you would think they'd employ some of that nifty AI/ML tech they're so proud of that they use for tracking users online and to help protect intellectual property, not to mention how they already protect IP on sites like YouTube.  I'm certain it would be easy to identify and flag fake add-ons using the same name/company info, images and icons on their download pages, especially since they often just copy/paste the exact description/text as well, much the same way that Google does for movie studios, music publishers and YouTube content creators for copyright claims/flags, except it would be much easier to do programmatically since a machine can much more easily identify identical text strings (such as copyrighted/trademarked product/company names) and static images (such as icons and application UIs) to flag them when identical, then if it does turn out to be some kind of false positive/honest mistake, the company/individual that uploaded the offending add-on can petition Microsoft to review it to get a set of actual human eyes on it to make the determination of whether or not it should be allowed/whitelisted.

Considering how much money Microsoft and Google have invested into AI for similar tasks, it should be trivial for them to accomplish this and provide a much safer environment for their users/customers to download extensions for their browsers.

Edited December 5, 2020 by exile360

[sman]

Now first of all when a product extension is allowed, should there not be a rule to intimate the companies before granting final permissions to host it's product in the web store? Unless the companies too acknowledge the products, than only final clearance be made and why did MS bungle here, w/o verifying with the company on the product? It sucks.

[exile360]

Yes, that's something that Apple does where they have an extensive review process for hosting apps on their app store.  I suspect that the criteria for getting an extension hosted on Microsoft's web store is much less rigorous, otherwise it likely wouldn't happen so often that bad extensions make it onto their site.