The last 5+ years the only malware found on my Windows computers were Chrome extensions. Not found by Avast, but by (my about weekly) manual scan with MBAM free. One of the extensions I remember is Zoom, other two or three I forgot.
37k Chrome users downloaded a fake Adblock Plus extension
31–40 of 42 posts
Re: 37k Chrome users downloaded a fake Adblock Plus extension
#32Reminiscent of the problem earlier this year where GOOGLE DOCS ITSELF was spoofed with a Google-approved (for a brief window, at least) web app called "Google Docs":
https://www.theverge.com/2017/5/3/15534768/google-docs-phish...
It's pretty insane that Google keeps tripping over itself on this same issue. Surely they have the means and know-how to prevent it.
Re: 37k Chrome users downloaded a fake Adblock Plus extension
#33What are Google's rules about names? Only difference I can see here is the fake one is called "AdBlock" and the real one "Adblock". Is changing the case of one letter enough to get an extension into the Chrome store? Or even worse are overlapping names allowed?
It’s hard enough to tell someone which is best, telling them the particular capitalization is impossible without giving them a direct link. In addition, preventing duplicate names is fairly hard if you support unicode. Characters like the zero width space, Mongolian vowel separator and many others make it algorithmically different but visually they are the same.
That's not really n issue. You can always compared normalized versions of the name.
Re: 37k Chrome users downloaded a fake Adblock Plus extension
#34Earlier quoted context omitted.
I am a mechanical engineer not a software developer. Any advice for me?
Personal auditing doesn't really solve the problem because extensions update automatically, and there are numerous cases of the authors of popular extensions being approached to sell out their userbase in exchange for cash, providing a motive for formerly-audited extensions to go bad. Here's some basic tips at defending yourself: 1. Minimize the amount of extensions you use to the bare essentials. If you can live wit…
Chrome does a good job of notifying you when an extension needs new permissions, like if it's been hacked to keylog you on every page or something.
Of course, most users have fatigue for these sorts of dialogues and just hit accept (I have done the same in a lot of cases).
I also like Extension Update Notifier
https://chrome.google.com/webstore/detail/nlldbplhbaopldicmc...
Which pops up a toast notification whenever your extensions get updated. At least then it's not a silent upgrade and you can investigate if you wish.
Re: 37k Chrome users downloaded a fake Adblock Plus extension
#35Earlier quoted context omitted.
>This is the case especially as the genuine extension in this case has no direct author website and instead lists a repo on Github It's the other way round for me. I only install an extension if I find the github (or similar) repo with sufficient activity, stars or whatever. I would even sometimes use google search with the site:github.com string when looking for extensions or android apps. It would be nice if the ch…
Ordinarily, people might find seeing the repository straight-up too jarring. For people who aren't in the IT world, I'm not sure that seeing Github will be some definitive proof that an extension is legit.
Even in the IT world, having spent literally my entire career writing code, I found github completely inscrutable when it first arrived, because all the explanatory text gets pushed down to the bottom of the page where you can't see it, which is completely opposite from... well... pretty much any other system of organizing information I have ever seen, ever.
I felt really pissed off, actually, that so many people were cluttering up hackernews with all these low-effort links to random unexplained directories inside unfamiliar source repos, somehow thinking it reasonable to presume that we would all want to just dig around in their source code trying to understand what it was they were attempting to do. "github.com" became a negative value signal just as strong as "experts-exchange.com", and I tried to avoid ever clicking on such worthless links.
It was probably a couple of years before I ever had reason to actually use github and discover that the information I had wanted had been present all along. Now of course the inverted layout has become second nature... but I still think it's a bad idea to send anyone who is not already a github user to a github link and expect them to find anything useful to do with it.
Re: 37k Chrome users downloaded a fake Adblock Plus extension
#36Extensions are the new "Let's play find the download button on a webpage" that's been around for years. [1] So many users download replicas of uBlock and find it hard to install the original uBlock Origin extension. Countless times have I had to send them direct link to Chrome's extension site just to make sure they're installing the right one. This is the case especially as the genuine extension in this case has no…
Chrome extension malware is very common
* https://www.reddit.com/r/chrome/comments/6fotke/the_great_su...
* https://threatpost.com/seven-more-chrome-extensions-compromi...
* http://chrispederick.com/blog/web-developer-for-chrome-compr...
* https://www.reddit.com/r/Windows10/comments/6hvzzt/psa_my_ch...
* https://thehackernews.com/2017/07/chrome-extention-hacking-a...
* https://arstechnica.com/security/2017/01/ciscos-webex-chrome...
* https://www.bleepingcomputer.com/news/security/coinhive-is-r...
* https://lifehacker.com/many-browser-extensions-have-become-a...
Re: 37k Chrome users downloaded a fake Adblock Plus extension
#37Earlier quoted context omitted.
Ordinarily, people might find seeing the repository straight-up too jarring. For people who aren't in the IT world, I'm not sure that seeing Github will be some definitive proof that an extension is legit.
Even for people who are that isn't really "definitive proof" of anything.
If a project looks popular, you can at least assume it isn't total rubbish though.
Re: 37k Chrome users downloaded a fake Adblock Plus extension
#38Re: 37k Chrome users downloaded a fake Adblock Plus extension
#39Extensions are the new "Let's play find the download button on a webpage" that's been around for years. [1] So many users download replicas of uBlock and find it hard to install the original uBlock Origin extension. Countless times have I had to send them direct link to Chrome's extension site just to make sure they're installing the right one. This is the case especially as the genuine extension in this case has no…
I always get my addons straight from github. That way I'm running the latest version and bypassing Mozilla.
But you have to be an advanced user, it is complex now to install an "unsupported" adon.
Re: 37k Chrome users downloaded a fake Adblock Plus extension
#40It's even worse. 3,878,417 computers have a fake uBlock Origin clone called uBlock Plus (playing on the fact that there's Adblock and Adblock Plus) installed.
https://chrome.google.com/webstore/detail/ublock-plus/kjagjn...