{"id":13176,"date":"2018-08-23T08:10:02","date_gmt":"2018-08-23T16:10:02","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2018\/08\/23\/news-6943\/"},"modified":"2018-08-23T08:10:02","modified_gmt":"2018-08-23T16:10:02","slug":"news-6943","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2018\/08\/23\/news-6943\/","title":{"rendered":"Can search extensions keep your searches private?"},"content":{"rendered":"

Credit to Author: Pieter Arntz| Date: Thu, 23 Aug 2018 15:00:00 +0000<\/strong><\/p>\n

One of the most common things most of us do on the Internet is search, whether we are looking up the price of the latest gadget or we need to find the address of that great restaurant recommended by a friend. The dizzying number of Google search queries per second (more than 40,000, on average) tells us there is plenty of money to be made by advertising in search results.<\/p>\n

It’s not just big names in the search industry who are aware of this fact. Others want a piece of the pie, too. But what can they hope to accomplish when their budget is nowhere near that of the marquee players, and one of their prospective competitors has managed to turn its brand name into a verb<\/a>?<\/p>\n

The only thing that makes sense in this scenario is to offer something that others don\u2019t. And with recent data breaches, online tracking, targeted advertising, and\u00a0other privacy-threatening events all leaving us worried about our online privacy, some smart developers have created\u00a0browser extensions<\/a> that promise to keep prying eyes away from our searches.<\/p>\n

We have noticed quite a few new names in this fledgling industry. In fact, some of them are so similar in their advertising, wording, coding, and use of images, that there is no other explanation besides their developers deciding power lies in numbers\u2014of extensions, brand names, and domain names. And they’re all doing, or rather not<\/em> doing, the same thing in an attempt to make the cash register ring.<\/p>\n

In case you were wondering whether any of these are worth the time it takes to install them, the short answer is no<\/strong>.<\/p>\n

\"Search<\/a><\/p>\n

Investigation<\/h3>\n

To investigate this trend that we’ve been watching since summer 2017, we looked at 25 extensions that advertise that they offer more privacy during searches. One of the first things we noticed was that over half of these extensions were so alike, we classified them as a single family.<\/p>\n

Our generic detection name for smaller variants belonging to this family is PUP.Optional.SearchAlgo.Generic<\/a>. It’s named after the domain this family uses to route its searches. As far as I can tell, they all end up displaying Yahoo Search results, but this isn\u2019t hardcoded into the extension, so the redirect is probably decided on-the-fly by the code on the searchalgo.com servers. That would make it easier for them to switch in case they get a better offer than the one from Yahoo Search.<\/p>\n

Breakdown<\/h3>\n

We have looked into a few of the top results found while searching for private search extensions, and found several nefarious or questionable similarities. It may come as no surprise that all of these extensions, not just the one from the \u201csearchalgo\u201d family, have been added to our detections as potentially unwanted programs (PUPs)<\/a>. Here’s a breakdown of what we found:<\/p>\n

Protocol:<\/strong> While a few of the extensions actually use the https<\/a> protocol to conduct their searches, most of them do not. This leaves us immediately wanting for more privacy when we hit the search button. Using the https protocol would at least make eavesdropping harder.<\/p>\n

Results:<\/strong> The division rate of those that display their results on a site of their own and those that simply redirect us to Yahoo Search is about fifty-fifty.<\/p>\n

Code:<\/strong> We looked at the code of the extensions to see if developers were paying attention to the privacy of the search or search results. We found no trace of any such code.<\/p>\n

Browsers:<\/strong>\u00a0Most of the extensions we found were only available for Chrome. A few were intended for Firefox. This is probably due to the much bigger market share<\/a> for Chrome at the moment.<\/p>\n

The technical details<\/h3>\n

Looking at the code of one of the major families, we can see that this is the main search routine:<\/p>\n

 <\/p>\n

\"search<\/a><\/p>\n

In case you got your hopes up when you spotted the word \u201cencode,\u201d the encodeURIComponent() function encodes a Uniform Resource Identifier (URI) component by replacing each instance of certain characters by one, two, three, or four escape sequences representing the UTF-8 encoding of the character. This is only used to ensure that certain special characters, like backslashes, don\u2019t get read as code. So, no privacy enhancement there.<\/p>\n

As mentioned before, one of the larger families in this category uses its own domain to redirect searches through to the most profitable established search engine.<\/p>\n

\"user<\/a><\/p>\n

The most profitable for the extension authors must be Yahoo Search by the look of the results. Others fetch results from a popular search engine and add their own header and a \u201cfew\u201d advertisements to earn money.<\/p>\n

\"header<\/a><\/p>\n

Extra functionality<\/h3>\n

Some of these search extensions also promise extra functionality. We have seen variants that promise to be specialized in:<\/p>\n