Skip to main content

500 Chrome Extensions Secretly Uploaded Private Data From Millions of Users

More than 500 browser extensions downloaded millions of times from Google's Chrome Web Store surreptitiously uploaded private browsing data to attacker-controlled servers, researchers said on Thursday. Ars Technica reports: The extensions were part of a long-running malvertising and ad-fraud scheme that was discovered by independent researcher Jamila Kaya. She and researchers from Cisco-owned Duo Security eventually identified 71 Chrome Web Store extensions that had more than 1.7 million installations. After the researchers privately reported their findings to Google, the company identified more than 430 additional extensions. Google has since removed all known extensions. "In the case reported here, the Chrome extension creators had specifically made extensions that obfuscated the underlying advertising functionality from users," Kaya and Duo Security Jacob Rickerd wrote in a report. "This was done in order to connect the browser clients to a command and control architecture, exfiltrate private browsing data without the users' knowledge, expose the user to risk of exploit through advertising streams, and attempt to evade the Chrome Web Store's fraud detection mechanisms."

The extensions were mostly presented as tools that provided various promotion- and advertising-as-a service utilities. In fact, they engaged in ad fraud and malvertising by shuffling infected browsers through a maze of sketchy domains. Each plugin first connected to a domain that used the same name as the plugin (e.g.: Mapstrek[.]com or ArcadeYum[.]com) to check for instructions on whether to uninstall themselves. The plugins then redirected browsers to one of a handful of hard-coded control servers to receive additional instructions, locations to upload data, advertisement feed lists, and domains for future redirects. Infected browsers then uploaded user data, updated plugin configurations, and flowed through a stream of site redirections. The researchers say the campaign dates back to at least January 2019, but it's possible that the operators were active "as early as 2017."


from Slashdot: News for nerds, stuff that matters https://ift.tt/2vzDFmc
via IFTTT
Labels:

Comments

Post a Comment

Popular posts from this blog

Dark Mode vs. Light Mode: Which Is Better?

Recently a well-respected UI consulting firm (the Nielsen Norman Group) published their analysis of academic studies on the question of whether Dark Mode or Light Mode was better for reading? Cosima Piepenbrock and her colleagues at the Institut für Experimentelle Psychologie in Düsseldorf, Germany studied two groups of adults with normal (or corrected-to-normal) vision: young adults (18 to 33 years old) and older adults (60 to 85 years old). None of the participants suffered from any eye diseases (e.g., cataract)... Their results showed that light mode won across all dimensions : irrespective of age, the positive contrast polarity was better for both visual-acuity tasks and for proofreading tasks... Another study, published in the journal Human Factors by the same research group, looked at how text size interacts with contrast polarity in a proofreading task. It found that the positive-polarity advantage increased linearly as the font size was decreased: namely, the smaller the fon...
Post a Comment
Read more

One of the Most Destructive Botnets Can Now Spread To Nearby Wi-Fi Networks

The sophistication of the Emotet malware's code base and its regularly evolving methods for tricking targets into clicking on malicious links has allowed it to spread widely. "Now, Emotet is adopting yet another way to spread: using already compromised devices to infect devices connected to nearby Wi-Fi networks ," reports Ars Technica. From the report: Last month, Emotet operators were caught using an updated version that uses infected devices to enumerate all nearby Wi-Fi networks. It uses a programming interface called wlanAPI to profile the SSID, signal strength, and use of WPA or other encryption methods for password-protecting access. Then, the malware uses one of two password lists to guess commonly used default username and password combinations. After successfully gaining access to a new Wi-Fi network, the infected device enumerates all non-hidden devices that are connected to it. Using a second password list, the malware then tries to guess credentials for each...
Post a Comment
Read more

Microsoft Wants Schoolchildren Playing Minecraft To Learn Math

Long-time Slashdot reader theodp writes: A Microsoft blog post notes the company has lined up K-12 educators to sing the praises of Minecraft Education Edition at the Future of Education Technology Conference , where it'll also be pitching Microsoft Education in general. A 2019 Recap of Minecraft: Education Edition (and an accompanying video) highlight Microsoft's success in getting teachers to use Minecraft to teach subjects across the K-12 curriculum, not just Hour of Code tutorials . Microsoft's ambitions for Minecraft were tipped in a 2015 press release , which included the lofty claim that "Minecraft has the power to transform learning on a global scale...." There are some teacher walkthrough videos available for review, like the unlisted one for Math Bed Wars! , a Common Core-aligned Minecraft-based lesson that teaches multiplication commutativity ("Students build arrays to show commutative properties of multiplication while constructing defense...
Post a Comment
Read more