Is IA safe?

Question

Is IA safe?

Accepted Answer

IA is medium risk. ImageAssistant generates a permanent 32-character random identifier the first time it runs and stores it in extension storage keyed to the extension's own runtime ID. On every browser startup, the service worker encrypts this identifier with a custom substitution cipher and appends it as a `finger` parameter to every remote URL before fetching. Dynamic analysis captured six GET requests to pullywood.com carrying this parameter within the first few seconds of browser launch, with no user interaction required. The `finger` value was identical across multiple requests to the same URL endpoint in the same session, confirming it is stable across restarts and tied to this specific installation. On every browser startup, ImageAssistant's service worker fetches a configuration file from pullywood.com containing regex URL-rewrite rules that control how the extension transforms image URLs during extraction — for example, replacing thumbnail-path segments with full-resolution equivalents. Dynamic analysis observed three GET requests to this endpoint and confirmed the response was written into chrome.storage.local under the key `_pullywood_RegexpUrlRule`. The stored ruleset contained over 50 regex patterns targeting image CDNs across multiple platforms. No integrity check (such as a hash or cryptographic signature) is applied to the fetched content; the extension loads and executes whatever the server currently returns.

Is ImageAssistant Batch Image Downloader safe?

Findings