A report by security company Radware shows that Google Chrome users have been exposed to yet another wave of malicious extensions offered by the official Chrome Web Store.
Η Radware company reports that these extensions were used to perform “credential theft, encryption, scamin clicks and more". According to analysis της Radware, το κακόβουλο λογισμικό που ανακάλυψαν ήταν ενεργό τουλάχιστον από τον Μάρτιο του 2018. Έχει μολύνει περισσότερες από 100.000 συσκευές χρηστών σε περισσότερες από 100 χώρες και προχώρησε στην εγκατάσταση άλλων επτά τουλάχιστον διαφορετικών επεκτάσεων του Chrome με κακόβουλο περιεχόμενο, χρησιμοποιώντας τον ακόλουθο τρόπο επίθεσης:
1. Attackers use advertising on Facebook to approach potential victims.
2. Users are redirected to fake YouTube pages.
3. A question appears asking them to install a Chrome extension to play the video.
4. Clicking on “add extension” installs the extension and makes the user part of one botnet.
5. Malicious JavaScript runs during installation, which installs additional code from a command center.
The extensions used by the attackers were copies of various popular extensions of Chrome, with a similar name, but which contained additional malicious code within them. According to Radware's research, the following extensions (not the same but copies of them) have been identified as malicious:
Nigelify
PwnerLike
Alt-j
Fixed-case
Divinity 2 Original Sin: Wiki Skill Popup
keeprivate
iHabno
In the photo above the left extension is the normal one and the right one is the malicious one.
You can check the company website for extension IDs as well as other information. Google has already removed all of these copy-extensions.
Considering that the attackers have been operating the extensions since March 2018, it is clear - again - that Google's protection system is not working properly.
Chrome users should verify any extensions they are interested in before deciding to click the install button. One rule of thumb is that you should never install extensions that ask you to do this outside of the Chrome Web Store, but because as you can see there are malicious extensions hosted on the Store, this rule is not a panacea.
The main problem is that the majority of users can not check whether a Chrome extension is legal or not, as to be absolutely sure you need to analyze its code.