A report by security company Radware shows that its users Google Chrome were exposed to yet another wave of malicious extensions offered to them by the official Chrome Web Store.
Η Radware company reports that the extensions αυτές χρησιμοποιήθηκαν για την implementation “κλοπής διαπιστευτηρίων, κρυπτογράφησης, απάτης σε κλικς και άλλα”. Σύμφωνα με την ανάλυση της Radware, το malware which they discovered has been active since at least March 2018. It has infected more than 100.000 user devices in more than 100 countries and proceeded to install at least seven other different malicious Chrome extensions using the following attack method:
1. Attackers use Facebook advertising to reach potential victims.
2. Users are redirected to fake YouTube pages.
3. A question appears asking them to install a Chrome extension to play the video.
4. Clicking on “add extension” installs the extension and makes the user part of one botnet.
5. Malicious JavaScript runs during installation, which installs additional code from a command center.
The extensions used by the attackers were copies of various popular extensions of Chrome, with a similar name, but which contained additional malicious code within them. According to Radware's research, the following extensions (not the same but copies of them) have been identified as malicious:
Nigelify
PwnerLike
Alt-j
Fixed-case
Divinity 2 Original Sin: Wiki Skill Popup
keeprivate
iHabno
In the photo above the left extension is the normal one and the right one is the malicious one.
You can check the company website for extension IDs as well as other information. Google has already removed all of these copy-extensions.
Considering that the attackers have been operating the extensions since March 2018, it is clear - again - that Google's protection system is not working properly.
Chrome users should verify any extensions they are interested in before deciding to click the install button. One rule of thumb is that you should never install extensions that ask you to do this outside of the Chrome Web Store, but because as you can see there are malicious extensions hosted on the Store, this rule is not a panacea.
The main problem is that the majority of users can not check whether a Chrome extension is legal or not, as to be absolutely sure you need to analyze its code.