Microsoft Bing Search Wit
🔍 Security Report Available View on Chrome Web StoreChrome will indicate if you already have this installed.
Overview
• See your point balance and status any time
• Get easy access to your rewards and redemption pages
• Quickly complete daily offers to earn points
• Track how many points you earn each day
• See how many points you need to redeem your goal reward
• See how many points you need to maintain Level 2 status this month (Level 2 members only)
About Microsoft Rewards
It’s the easiest way to get rewarded for doing what you already do. Just search with Bing, browse with Microsoft Edge, and shop at the Microsoft and Windows stores to earn free rewards. Just sign in to Microsoft Rewards or join today (https://www.bing.com/explore/rewards).
Here’s what you get
Movies, music, games, apps, and more. Just redeem the points for the content you want, or use points towards the purchase of an Xbox One and other great devices. No other program gives you benefits for doing the stuff you love with Microsoft products and devices.
Tags
Privacy Practices
Security Analysis — Microsoft Bing Search Wit
Permissions
Code Patterns Detected
External Connections
Package Contents 131 files · 1.5MB
What This Extension Does
The Microsoft Bing Search Wit extension helps users earn rewards by searching with Bing, browsing with Microsoft Edge, and shopping at Microsoft stores. It provides features to track points, redeem rewards, and maintain Level 2 status. This extension is suitable for users who want to utilize their Microsoft Rewards program effectively.
Permissions Explained
- cookiesexpected: This permission allows the extension to access cookies stored on your device.
Technical: The extension can read and modify browser cookies, which could be used for tracking or session hijacking if compromised. This is a HIGH-risk permission due to its potential impact on user data security. - managementexpected: This permission enables the extension to manage browser settings and extensions.
Technical: The extension can modify browser settings, install/uninstall other extensions, and access browser data. This is a MEDIUM-risk permission due to its potential impact on user control over their browser environment. - notificationsexpected: This permission allows the extension to display notifications to the user.
Technical: The extension can show notifications, which could be used for phishing or social engineering attacks if compromised. This is a MEDIUM-risk permission due to its potential impact on user experience and security awareness. - storageexpected: This permission enables the extension to store data locally on your device.
Technical: The extension can read/write local storage, which could be used for storing sensitive user data if compromised. This is a MEDIUM-risk permission due to its potential impact on user data security. - scriptingexpected: This permission allows the extension to execute scripts in the browser context.
Technical: The extension can inject scripts into web pages, which could be used for malicious activities like XSS attacks if compromised. This is a MEDIUM-risk permission due to its potential impact on user security and data integrity. - declarativeNetRequestexpected: This permission enables the extension to block or modify network requests.
Technical: The extension can intercept and modify HTTP requests, which could be used for malicious activities like data tampering or man-in-the-middle attacks if compromised. This is a HIGH-risk permission due to its potential impact on user security and data integrity. - http://*/*check this: This permission allows the extension to access all HTTP requests.
Technical: The extension can intercept and modify all HTTP requests, which could be used for malicious activities like data tampering or man-in-the-middle attacks if compromised. This is a CRITICAL-risk permission due to its potential impact on user security and data integrity. ⚠ 1 - https://*/*check this: This permission enables the extension to access all HTTPS requests.
Technical: The extension can intercept and modify all HTTPS requests, which could be used for malicious activities like data tampering or man-in-the-middle attacks if compromised. This is a CRITICAL-risk permission due to its potential impact on user security and data integrity. ⚠ 1
Your Data
The extension accesses cookies stored on your device, sends data to various Microsoft domains (e.g., www.bing.com, go.microsoft.com), and can potentially access sensitive user data if compromised.
Technical Details
Code Findings
This code pattern could potentially lead to cross-site scripting (XSS) attacks if an attacker injects malicious HTML into the extension's context.
Technical: The extension uses innerHTML assignment in its content script, which could be exploited by an attacker to inject malicious HTML. This is a medium-risk finding due to its potential impact on user security and data integrity.
💡 This pattern is commonly used for dynamic content injection in legitimate extensions.
The extension uses String.fromCharCode to obfuscate its code, making it harder to analyze and understand.
Technical: The extension uses String.fromCharCode to encode its code, which could be used for malicious activities like hiding malware or spyware. This is a medium-risk finding due to its potential impact on user security and data integrity.
💡 This pattern is commonly used in legitimate extensions for code obfuscation and compression.
The extension creates script elements dynamically, which could potentially lead to malicious activities like XSS attacks or code injection.
Technical: The extension uses document.createElement('script') to create script elements dynamically, which could be exploited by an attacker to inject malicious scripts. This is a high-risk finding due to its potential impact on user security and data integrity.
💡 This pattern is commonly used in legitimate extensions for dynamic content injection or code loading.
The Microsoft Bing Search Wit extension has some concerning permissions (http://*/*, https://*/*) and code patterns (innerHTML assignment, String.fromCharCode obfuscation, creates script elements dynamically). While it provides useful features for users, its potential security risks should be carefully evaluated before installation. Users are advised to exercise caution when installing this extension.
