Chrome Extension with 105,000 installs is a Cryptocurrency Miner

Por Wagas em 29/12/2017 no site HackRead

“Archive Poster” extension for Chrome browser is being currently used by 105,000 users. The primary function of this extension is to allow users to “quickly reblog, queue, draft, and like posts right from another blog’s archive” but now, a Las Vegas-based security researcher Troy Mursch (“Bad Packets” on Twitter) has identified that Archive Poster is infecting user browser with a cryptocurrency miner.

Generating Monero Through CoinHive

According to Bad Packets’ analysis, the malicious Chrome extension is using cryptocurrency mining code provided by CoinHive and uses victim’s computer power to generate Monero (XMR) digital coin (1 XMR equals $392.71 USD). CoinHive is a company that provides cryptocurrency miner, which sends any coins mined by the browser to the owner of the website, application or extension.

In the case of Archive Poster, a number of users reviewed that the extension tries to use their browser for mining purposes. One of the reviews posted on December 8th, 2017, by Furkan Tunalı said “I rated it 5 before. Now it’s mining with your CPU by CoinHive in the background. Beware Sad.”

Screenshot grab shows reviews posted by users

In a Twitter thread, Bad Packets stated that CoinHive’s JavaScript code loads from this URL: https://c7e935.netlify[.]com/b.js

Extension Is Up And Running

Mursch told HackRead that they reported the issue to Google but there was no response from the company. Another user who reported the presence of cryptocurrency miner extension received the following reply that did not make sense.

View image on Twitter

Dung D. Bär@DungDerBaer

Replying to @bad_packets @Google

I contacted the Google Chrome Store Support about this and they wrote back that. Is this a joke? "only the owner of the item can change the behavior of this item." !? So Google allows hyjacked crypto mining in Chrome addons!? Seriously?

8:50 AM - Dec 29, 2017

•  11 Reply
 
•  Retweets
 
•  22 likes

Twitter Ads info and privacy

Remember, a couple of weeks ago, HackRead identified a malware scam in which hackers used Google AdWords and Google Sites to drop malware in fake Chrome browser downloader file. The issue was reported to Google, however, there was no reply from the company.

Mursch is urging users to report “Archive Poster” extension to Google but maintains that it might be work of a “disgruntled employee.”

Monero Mining On Facebook And Android Phones

Monero mining is not limited to PCs, extensions or websites. In fact, hackers are infecting Android apps with Monero code to use Android devices to generate Monero coins. Furthermore, Facebook users on Messenger are also at risk of being infected with Monero mining Malware called Digmine.

How To Stop CoinHive Code From Using Your CPU Power

In October this year, Google announced blocking cryprocurrency miners with new security features in Chrome, but, Opera browser was quick to understand the seriousness of the matter and introduced Opera 50 beta version that comes with a builtin cryptocurrency Mining Blocker.

Since the use of the CoinHive code is increasing, there are several ways to block the code from using your computer. For instance, No Coin and minerBlock extensions available on Chrome web store are developed to block any crypto miners from using your computing power.

At the time of publishing this article, Archive Poster extension was still available on Chrome Web Store.

Google Chrome vai bloquear redirecionamentos indesejados

Por IDGNow em 09/11/2017

O Google anunciou nesta semana uma série de novos recursos do Chrome para proteger os usuários contra conteúdos indesejados na Internet.

O pacote de novidades da gigante de buscas será lançado aos poucos nas próximas versões do seu navegador no início de 2018 e inclui principalmente o combate a tentativas de tirar proveitos dos usuários por meio de redirecionamentos a páginas não confiáveis. 

Por isso, a partir do lançamento do Chrome 64, atualmente no estágio pré-beta Canary, os redirecionamentos feitos por anúncios de terceiros serão barrados. Assim, em vez de o usuário ser redirecionado diretamente, ele continuará na página que estava e verá uma barra com informações – a não ser que já tenha interagido com aquele conteúdo antes.

A outra mudança anunciada pelo Google será liberada com o Chrome 65, que irá barrar um tipo de redirecionamento em que, após clicar em um site desejado, o usuário é levado para uma nova aba diferente e indesejada - segundo o Google, essa é uma violação do bloqueador de pop-ups do Chrome. Assim como no caso anterior, o browser irá bloquear o redirecionamento e mostrar uma barra de informação ao usuário, que conseguirá chegar ao destino desejado.

Ferramenta para donos de site

Além dessas novidades para melhorar a experiência dos usuários, o Google também lançou nesta semana o chamado Relatóriod e Experiência Abusivas com o objetivo de “ajudar os donos de sites a se prepararem para essa mudança”.

Com os relatórios, os administradores de páginas poderão verificar se qualquer uma das experiências abusivas citadas acima foram encontradas em seus sites. Caso elas não sejam resolvidas em 30 dias, o Chrome irá ativar a prevenção de novas abas e janelas para aquele site

Google Chrome will warn users of ‘man in the middle’ attack

By Uzair Amir on September 11, 2017

No site HackHead

It looks like Google is finally taking serious measures to secure its most used product the Chrome web browser. The tech giant has announced that upcoming Chrome 63 browser will be equipped with a new security feature aiming to alert users of ‘man in the middle’ attacks (MitM) in which an attacker intercepts communication between two systems.

Coming this year in December, Chrome 63 will send notifications after detecting a large number of SSL connection errors implying that an attacker is trying to intercept your web traffic. The new security measure will tackle send notifications for malware as well as legitimate applications. That means in case your firewall or anti-virus software fails to detect and notify you or a malware evades anti-virus detection, Chrome 63 will have your back.

More: Fake Chrome & Firefox Font Update Drops RAT and Locky Ransomware

The person behind developing this technology is Sasha Perigo‏ who announced the news on Twitter. “Excited to announce my intern project is launching in @GoogleChrome M63! New error pages to help users struggling with MITM software,” tweeted Perigo‏.

 Follow

Sasha Perigo @sashaperigo

Excited to announce my intern project is launching in @GoogleChrome M63! New error pages to help users struggling with MITM software.  pic.twitter.com/qItF3T1K1z

6:08 PM - Sep 8, 2017

•  4040 Replies
 
 249
• 249 Retweets
 
 1,103
• 1,103 likes

Twitter Ads info and privacy

“1 For this error page, we say a user has “misconfigured” software if they don’t have the root required for the MITM program – 2 We check the error code the certificate validator threw, and check fields on the missing cert to see if it’s MITM software – 3 This error page will only be shown to users who were already seeing SSL errors. If you’re not seeing SSL errors right now, you’re all good”, Perigo‏.

Google plans to release the Chrome 63 on December 5 however you can test the feature on Chrome Canary.

Remember, about six months ago; Google introduced “Safe Browsing” feature for macOS that sends notifications to users whenever they visit a malicious website or download a file containing malware. Moreover, Google also launched a bug bounty program for Androidoperating system showing its commitment to a secure its mobile operating system.

8 More Chrome Extensions Hijacked to Target 4.8 Million Users

Swati Khandelwal
Em 16/08/2017 no site The Hacker News

Google's Chrome web browser Extensions are under attack with a series of developers being hacked within last one month.

Almost two weeks ago, we reported how unknown attackers managed to compromise the Chrome Web Store account of a developer team and hijacked Copyfish extension, and then modified it to distribute spam correspondence to users.

Just two days after that incident, some unknown attackers then hijacked another popular extension'Web Developer' and then updated it to directly inject advertisements into the web browser of over its 1 million users.

After Chris Pederick, the creator of 'Web Developer' Chrome extension that offers various web development tools to its users, reported to Proofpoint that his extension had been compromised, the security vendor analysed the issue and found further add-ons in the Chrome Store that had also been altered.

According to the latest report published by the researchers at Proofpoint on Monday, the expanded list of compromised Chrome Extensions are as below:

• Chrometana (1.1.3)
• Infinity New Tab (3.12.3)
• CopyFish (2.8.5)
• Web Paint (1.2.1)
• Social Fixer (20.1.1)

Proofpoint researcher Kafeine also believes Chrome extensions TouchVPN and Betternet VPN were also compromised in the same way at the end of June.

In all the above cases, some unknown attackers first gained access to the developers' Google web accounts by sending out phishing emails with malicious links to steal account credentials.

Once the attackers gained access to the accounts, either they hijacked their respective extensions and then modified them to perform malicious tasks, or they add malicious Javascript code to them in an attempt to hijack traffic and expose users to fake ads and password theft in order to generate revenue.

In the case of the Copyfish extension, the attackers even moved the whole extension to one of its developers' accounts, preventing the software company from removing the infected extension from the Chrome store, even after being spotted compromised behaviour of the extension.

"Threat actors continue to look for new ways to drive traffic to affiliate programs and effectively surface malicious advertisements to users," researchers concluded. "In the cases described here, they are leveraging compromised Chrome extensions to hijack traffic and substitute advertisements on victims' browsers." 

"Once they obtain developer credentials through emailed phishing campaigns, they can publish malicious versions of legitimate extensions."

At this time, it is unclear who is behind the hijackings of Chrome Web extensions.

The best way to protect yourself from such attacks is always to be suspicious of uninvited documents sent over a phishing email and never click on links inside those documents unless verifying the source.