Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We busted a fake Chrome extension that was trying to steal data

extrahop.com

Post reply on HN
Print view View original

21–30 of 33 posts

Re: We busted a fake Chrome extension that was trying to steal data

#21

Post by cws »

porlune wrote: post #12

It should be noted, that at one time, Postman was a chrome extension. They recently depreciated that extension. http://blog.getpostman.com/2017/11/01/goodbye-postman-chrome...

Yep that’s a great point. That deprecation probably contributed to the gap that the malware uploader exploited. People expect an extension called postman, and they find it. Their guard is down and they download the fake one. I don’t know the solution but there has to be a better way for App/extension stores to handle this relatively common scenario.

Re: We busted a fake Chrome extension that was trying to steal data

#22

Post by behringer »

codedokode wrote: post #16

This is a serious issue with Chrome Store. Google doesn't properly warn users that the store is not premoderated and can contain malware. Instead, they have made a colourful positively looking site without necessary warnings.

Neither does download.com. Maybe what we need is a good A/V designed around chrome and firefox et al.

Re: We busted a fake Chrome extension that was trying to steal data

#23

Post by cws »

tyingq wrote: post #17

"It's also not clear how any other tool would have detected the long-lived, persistent outbound connection with relatively low bandwidth" Perhaps, but this extension could have been stealthier. It was using a plaintext web socket on port 6332. If the extension author had instead gotten a Google analytics account, and exfiltrated data via encrypted https GETS to Google servers, it might have never been spotted. That k…

Totally. This extension was trying to be stealthy about exfiltrating data...but it wasn’t trying that hard. As noted in the article, the same developer had at least one other extension using the same code to obfuscate and exfiltrate data. Seems like sort of a spray and pray approach

Re: We busted a fake Chrome extension that was trying to steal data

#24

Post by GeekRaconteur »

cws wrote: post #8
kungfufrog wrote: post #4

The blog post was moderately informative/useful and interesting, marketing brochure website behind it next to useless and can't find anything meaningful about what they actually sell or do. Frustrating follow-up experience for me that reminds me of most enterprise ISVs.

It is a network traffic analysis product. You send it traffic via port mirror and it analyzes for shady behavior. Here’s the main overview of what it is https://www.extrahop.com/products/security/

And here's a technical overview of the product: https://www.extrahop.com/products/security/how-it-works/

Re: We busted a fake Chrome extension that was trying to steal data

#25

Post by empyrical »

Because the visibility of the Arc Welder extension (the one that lets you use Android apps on desktop chrome) is set to hidden, which hides it from both Web Store and Google Searches, there are malicious extensions that take advantage of this and will become the top search result for Arc Welder. And if you don't know where to look, it can be very hard to find the real link for Arc Welder. So as a result, these malicious Arc Welders often get many thousands of installs before being taken down. Very frustrating because even if you report them immediately after they are added, it takes a few days to take them down.

Re: We busted a fake Chrome extension that was trying to steal data

#26

Post by bobthechef »

toyg wrote: post #13
kalehrishi wrote: post #3

Black theme of tool makes me chuckle. Wondering how it became defacto color theme of hacking tools! Only thing missing is neon green.

Because it’s easier on the eyes. For people spending unhealthy amounts of time being bombarded by monitors right in the retinas, it’s a necessity.

Black text on a white background actually causes less eye strain esp. for people with astigmatism because the text is easier to read.

https://ux.stackexchange.com/questions/53264/dark-or-white-c...

Re: We busted a fake Chrome extension that was trying to steal data

#27

Post by cws »

empyrical wrote: post #25

Because the visibility of the Arc Welder extension (the one that lets you use Android apps on desktop chrome) is set to hidden, which hides it from both Web Store and Google Searches, there are malicious extensions that take advantage of this and will become the top search result for Arc Welder. And if you don't know where to look, it can be very hard to find the real link for Arc Welder. So as a result, these malici…

Yeah, that is incredibly frustrating. It seems to me that many of these types of scams target general consumers, piggybacking on legitimate app's names to get a few thousand people to pay a buck or give you some personal info, etc. These instances that target developer tools have the potential to do a different kind of damage to peoples' livelihoods.

Re: We busted a fake Chrome extension that was trying to steal data

#28

Post by aepiepaey »

astura wrote: post #18
toyg wrote: post #13

Earlier quoted context omitted.

Because it’s easier on the eyes. For people spending unhealthy amounts of time being bombarded by monitors right in the retinas, it’s a necessity.

It's not a "necessity," it's a personal preference. I started out programming on a dark theme (the emacs default) but I've used a light theme professionally for about 15 years (and no other dark applications). I prefer the light theme and I don't find it hard on my eyes one bit and I have astigmatism.

The Emacs default is bright (black text on white background), not dark.

The exception is if you're using it in a terminal, in which case it re-uses the terminal's colors.

Re: We busted a fake Chrome extension that was trying to steal data

#29

Post by cws »

ocdtrekkie wrote: post #5

As of this writing, the malicious "Postman" extension is still available in the Google Chrome extension store and has been downloaded over 27,000 times. This is pretty much par for the course, unfortunately.

I just searched for the fake Postman extension again and it appears to have been removed. Hurray!
Post reply on HN