Any known vaulerabilities around utorrent/spigot media extension?

amosel

My Macbook's force touched keypad stopped working for no apparent reason. That was alarming. After restating the mac twice I got it working again.
The second restart, I got an alert from safari saying: "Safari can no longer use the extension 'Searchme' because the extension is no longer valid". That was even more alarming because I never installed this one.
I looked up online and found this, this and this.
Apparently utorrent automatically installs the search me extension which I think can create a vulnerability, specially with safari extensions but not exclusively.
Should I be concerned about my safari 1password extension?

---

1Password Version: Not Provided
Extension Version: Not Provided
OS Version: Not Provided
Sync Type: Not Provided
Referrer: forum-search:safari extensions search me

danco

(I have deleted your duplicate post.) I can't say whether this creates any vulnerabilities with 1PW, though I would guess not. An AgileBits staff member will give you better information.

But, as you have seen in the articles you cite, this bundling of adware is unfortunately all too common on download sites.

I would recommend using Malwarebytes Anti-Malware program to get rid of such stuff (they have taken over Adware Medic, which was previously the best answer).

littlebobbytables

Hi @amosel,

There is little another extension could do directly to our extension but what you should be conscious of is that any extension can view the contents of a web page. So while this Searchme extension could never do anything like view your entire vault it could observe all page loads looking for login items. I'm not saying it has, merely this is possible and the reason you do have be vigilant over what extensions you install.So if you're worried at all given you don't remember ever giving permission to install it you might want to consider updating your passwords now that you have removed it.

Hopefully that made sense but if not please do say and I'll try and reword it.

amosel

Thanks for addressing this! Is there a quick method to change all your passwords?

littlebobbytables

Hi @amosel,

There isn't a quick or automated way to do this I'm afraid. It would require manually logging into each site in turn and navigating to the right place to change your password. We do have a page titled Changing a saved password (Mac) that will show how 1Password can help and the idea is that when 1Password recognises you're on a password change form it will ask if you want to update a Login item. If it doesn't don't panic as any use of the Password Generator does result in the creation of a Password item. Worst case scenario you should be able to copy the password from this item and edit the real Login item to update but I hope in most cases this won't be required (assuming you're running the latest versions of both 1Password for Mac and the extension which are 6.0.1 and 4.5.2 respectively).

We are mulling over the idea of assisted password changing but it's a fragile thing. Each site has to be explicitly handled as every site is different and one small change could affect the ability of 1Password to work meaning everything would have to be actively monitored and lots of code for backing off rather than making a mistake. That isn't to say it isn't a neat idea but as there are no standards for web developers to adhere to when creating things like password change forms it does make it tricky.