How Do Chrome Extensions Turn Browsers Into Scraping Botnets?

TL;DR

Chrome extensions can turn browsers into scraping botnets by embedding Mellowtel, a JavaScript library that relays scraping traffic through users’ devices in exchange for developer payments. The network reportedly involves nearly 1 million browsers, and extensions with existing “all URLs” permissions may receive the library through automatic updates without another user prompt. Read on to understand the permissions, incentives, and weak consent safeguards involved.

Transcript

Browser extensions turn nearly 1 million browsers into website scraping bots. Oh boy, two of my least favorite things. Chrome extensions and botn nets. This is quite the story. As soon as I saw this shared by my chat, I knew I had to talk about it because I know too much about all of the pieces here. I've built some very popular Chrome extensions a... Read More

Key Insights

• The Mellowtel JavaScript library transforms browser extensions into a distributed web-scraping network, turning nearly 1 million devices into an unwitting bot army by relaying scraping requests through users' browsers.
• Demand for data has never been greater because of the AI race, where everyone needs data to train models, which raises the incentive to work around scraping blockers.
• Websites are restricting content access harder than ever, with Twitter closing its firehose and Reddit locking down its API almost entirely, so scraping the site becomes a free alternative to paid API access.
• The newest and sketchiest monetization method pays extension developers in exchange for the unused bandwidth of users who have the extension installed, rather than only selling clickstream data.
• The 'all URLs' permission is the dangerous one because it lets the extension run on any page, including your bank, giving it access to the contents of every page you visit.
• Extensions that already hold 'all URLs' permissions (ad blockers, autocomplete tools, page-customizers) can add Mellowtel without changing permissions, so the update auto-installs and users are never prompted.
• Mellowtel is open source, GPL-licensed, and marketed as consensual and transparent, which shows that open-source and good branding do not make code trustworthy.
• User opt-in is functionally optional because the code has no checks to confirm a real user approved bandwidth sharing, letting a developer opt all users in on their behalf.

Questions & Answers

Q: How do Chrome extensions turn browsers into scraping botnets?

Extension developers can install the Mellowtel JavaScript library and use their extensions to relay web-scraping requests through users’ browsers. This creates a distributed scraping network in which nearly 1 million devices reportedly act as an unwitting bot army while developers are paid for users’ unused bandwidth.

Q: What is Mellowtel, and what does it do?

Mellowtel is an open-source, GPL-licensed JavaScript library available through npm. It transforms browser extensions into request brokers by injecting a content script into visited pages and relaying scraping traffic through users’ browsers.

Q: How can an extension add Mellowtel without alerting users?

Mellowtel requires declarative net request and “all URLs” permissions. Extensions such as ad blockers, autocomplete tools, and page customizers may already possess those permissions, so adding the library may not trigger a new permission prompt when an update automatically installs.

Q: Why is the “all URLs” permission dangerous?

The “all URLs” permission allows an extension to run on any page a user visits and access that page’s contents. That reach can include sensitive pages such as a user’s bank, so extensions holding the permission require particular caution.

Q: Does Mellowtel require genuine user consent for bandwidth sharing?

Mellowtel’s documentation asks developers to let users opt in, but the code does not verify that a real user approved bandwidth sharing. A developer can choose whether the library runs and may opt users in without building a genuine consent interface.

Q: Why are extension developers attracted to monetization libraries?

Popular extensions create ongoing update and maintenance work, while charging users is not always straightforward. Monetization-as-a-service companies offer developers an easier path to payment by adding a library to an existing extension, sometimes without requesting new permissions.

Q: How does bandwidth monetization differ from clickstream monetization?

Clickstream libraries track browsing behavior so ad-tech companies can aggregate it into browsing profiles for advertising purposes. The bandwidth model instead pays extension developers for using installed users’ unused bandwidth to relay requests, including web-scraping traffic.

Q: Why is demand for browser-based web scraping increasing?

The AI race has increased demand for data used to train models while websites have restricted access to their content. Twitter closed its firehose almost entirely and Reddit locked down its API, creating a stronger incentive to scrape websites instead of paying for API access.

Summary & Key Takeaways

• Browser extensions are turning nearly 1 million browsers into website-scraping bots. The AI race has made data more valuable than ever while sites like Twitter and Reddit lock down their APIs, so scraping websites for free becomes a strong incentive, and botnet-style monetization of extensions is spreading.

• Extension developers face heavy maintenance burdens and struggle to monetize, so monetization-as-a-service companies offer libraries that can be added, sometimes without new permissions, in exchange for payment. Older versions track browsing behavior for clickstream ad data, but the newer, sketchier method sells users' unused bandwidth.

• Mellowtel is an open-source, GPL-licensed JS library installable via npm. It needs declarative net request and 'all URLs' permissions, injects a content script into every page, and although docs ask developers to let users opt in, there are no checks enforcing genuine user consent.