Chrome extensions used to steal users' secrets
We are living in an era where technology is part of our lives. The usage of utilities to make our daily tasks easier and boost their efficiency and accuracy is an essential factor these days. As a result, new extensions emerge daily, a large volume with good intent and others taking advantage of bad purposes to benefit criminals.
McAfee highlighted in its recent publication some Chrome extensions used by crooks to get some benefits using affiliate IDs in eCommerce websites visited by victims. According to McAfee's analysis, more than 1,400,000 users were affected and victims of this schema from the five analyzed extensions.
Figure 1: Malicious Chrome extensions scrutinized by the McAfee research team.
As observed, these extensions have a specific purpose depending on their nature. One of them is related to Netflix and enables users to watch Netflix content together; another can be used to take screenshots of a website, etc. However, these extensions also track the users’ browsing activity, sending information to a C2 server controlled by criminals and tampering with cookies on the victims' web browsers to receive affiliate payment for purchased items.
Digging into the details
We can summarize the malicious process with the following flow:
- Initially, details about the victims’ machines are sent to the criminals’ side, including:
- Geolocation (city, zip code obtained via an online API)
- Referral URL
- APIsend value (random ID generated in runtime)
- The eCommerce website visited
- Extension name
- If the target eCommerce website is in a target list of affiliates, then proceed
- The tampering process happens, and an affiliate ID is added
- Criminals receive the benefit without the victim's authorization and knowledge
Figure 2 shows details about the victim machine collected in the “TrackData” request and sent to the C2 server.
Figure 2: Details about the victim machine collected during the navigation process.
If a match occurs with a hardcoded list of affiliate eCommerce websites, then a JSON response is obtained with the details for the tampering process. Criminals meticulously test the malicious process, and two different tampering operations are received, namely:
- Result[‘c’] – passf_url: A specific iframe will be injected over the target website.
- Result[‘e’] setCookie: The cookie will be tampered with via the affiliate ID.
Figure 3: Source code responsible for setting the cookie on the target eCommerce website.
The next Figure shows the scenario when a specific iframe is injected, and the cookie is modified with the target affiliate ID.
Figure 4: Iframe injected in specific website with the cookie modified with the target affiliate ID.
During the McAfee analysis, the researchers also identified a routine capable of bypassing schema detection. In detail, every time the victim runs the extensions, it validates the current date with the installation time. If it is > 15 days from the time of installation, then proceed. With this trick, criminals can avoid automated analysis and security checks.
Part of the mentioned routine is presented below, where the getTime() call is used to obtain the current time and compared if it is > 15 days after its installation.
Figure 5: Anti-detection mechanism found during the extension analysis.
Being careful with Chrome extensions
Due to the exponential growth of online services, different extensions have been released in the last few years to facilitate and improve the users’ experience. From the criminals' point of view, we can see this as an ideal scenario, and the number of extensions with bad intent has emerged quickly.
While there is no perfect formula for stopping threats of this nature, users should pay attention to the requested permissions and if the extension does what is supposed or announced. Also, the authenticity of the extension should be analyzed carefully, understanding if it is trustworthy, who the author is, examining the comments from other users, the extension rating, and simply by googling a bit about it.
The smallest sign or abnormal behavior should be an object of analysis. Be proactive.
Sources:
Malicious Chrome extensions, McAfee
- Exam Pass Guarantee
- Live expert instruction
- Hands-on labs
- CREA exam voucher
In this Series
- Chrome extensions used to steal users' secrets
- How AsyncRAT is escaping security defenses
- Luna ransomware encrypts Windows, Linux and ESXi systems
- Bahamut Android malware and its new features
- LockBit 3.0 ransomware analysis
- AstraLocker releases the ransomware decryptors
- Analysis of Nokoyawa ransomware
- Goodwill ransomware group is propagating unusual demands to get the decryption key
- Dangerous IoT EnemyBot botnet is now attacking other targets
- Fileless malware uses event logger to hide malware
- Nerbian RAT Using COVID-19 templates
- Popular evasion techniques in the malware landscape
- Sunnyday ransomware analysis
- 9 online tools for malware analysis
- Blackguard malware analysis
- Behind Conti: Leaks reveal inner workings of ransomware group
- ZLoader: What it is, how it works and how to prevent it | Malware spotlight [2022 update]
- WhisperGate: A destructive malware to destroy Ukraine computer systems
- Electron Bot Malware is disseminated via Microsoft's Official Store and is capable of controlling social media apps
- SockDetour: the backdoor impacting U.S. defense contractors
- HermeticWiper malware used against Ukraine
- MyloBot 2022: A botnet that only sends extortion emails
- Mars Stealer malware analysis
- How to remove ransomware: Best free decryption tools and resources
- Purple Fox rootkit and how it has been disseminated in the wild
- Deadbolt ransomware: The real weapon against IoT devices
- Log4j - the remote code execution vulnerability that stopped the world
- Rook ransomware analysis
- Modus operandi of BlackByte ransomware
- Emotet malware returns
- Mekotio banker trojan returns with new TTP
- Android malware BrazKing returns
- Malware instrumentation with Frida
- Malware analysis arsenal: Top 15 tools
- Redline stealer malware: Full analysis
- A full analysis of the BlackMatter ransomware
- A full analysis of Horus Eyes RAT
- REvil ransomware: Lessons learned from a major supply chain attack
- Pingback malware: How it works and how to prevent it
- Android malware worm auto-spreads via WhatsApp messages
- Malware analysis: Ragnarok ransomware
- Taidoor malware: what it is, how it works and how to prevent it | malware spotlight
- SUNBURST backdoor malware: What it is, how it works, and how to prevent it | Malware spotlight
- ZHtrap botnet: How it works and how to prevent it
- DearCry ransomware: How it works and how to prevent it
- How criminals are using Windows Background Intelligent Transfer Service
- How the Javali trojan weaponizes Avira antivirus
- HelloKitty: The ransomware affecting CD Projekt Red and Cyberpunk 2077
- DreamBus Botnet: An analysis
- Kobalos malware: A complex Linux threat
- What is Operation Dream Job by Lazarus?
Get certified and advance your career!
- Exam Pass Guarantee
- Live instruction
- CompTIA, ISACA, ISC2, Cisco, Microsoft and more!
Malware analysis
Malware analysis
Malware analysis
Malware analysis