Over 20 Million Users Installed Malicious Ad Blockers From Chrome Store

[AWS]

If you have installed any of the below-mentioned Ad blocker extension in your Chrome browser, you could have been hacked.

 

A security researcher has spotted five malicious ad blockers extension in the Google Chrome Store that had already been installed by at least 20 million users.

 

Unfortunately, malicious browser extensions are nothing new. They often have access to everything you do online and could allow its creators to steal any information victims enter into any website they visit, including passwords, web browsing history and credit card details.

 

Discovered by Andrey Meshkov, co-founder of Adguard, these five malicious extensions are copycat versions of some legitimate, well-known Ad Blockers.

 

Creators of these extensions also used popular keywords in their names and descriptions to rank top in the search results, increasing the possibility of getting more users to download them.

"All the extensions I've highlighted are simple rip-offs with a few lines of code and some analytics code added by the authors," Meshkov

says

.

After Meshkov reported his findings to Google on Tuesday, the tech giant immediately removed all of the following mentioned malicious ad blockers extension from its Chrome Store:

• AdRemover for Google Chrome™ (10 million+ users)
  
• uBlock Plus (8 million+ users)
  
• [Fake] Adblock Pro (2 million+ users)
  
• HD for YouTube™ (400,000+ users)
  
• Webutation (30,000+ users)
  

Meshkov downloaded the ‘AdRemover’ extension for Chrome, and after analyzing it, he discovered that malicious code hidden inside the modified version of jQuery, a well-known JavaScript library, sends information about some websites a user visits back to a remote server.

 

Also Read: Someone Hijacks A Popular Chrome Extension to Push Malware

 

The malicious extension then receives commands from the remote server, which are executed in the extension 'background page' and can change your browser's behavior in any way.

 

To avoid detection, these commands send by the remote server are hidden inside a harmless-looking image.

"These commands are scripts which are then executed in the privileged context (extension's background page) and can change your browser behavior in any way," Meshkov says.

"Basically, this is a botnet composed of browsers infected with the fake Adblock extensions," Meshkov says. "The browser will do whatever the command center server owner orders it to do."

The researcher also analyzed other extensions on the Chrome Store and found four more extensions using similar tactics.

 

Also Read: Malicious Chrome Extension Hijacks CryptoCurrencies and Wallets

 

Since browser extension takes permission to access to all the web pages you visit, it can do practically anything.

 

So, you are advised to install as few extensions as possible and only from companies you trust.

 

Source: Hacker News

[allheart55 Cindy E]

Wow! Makes me happy that I don't use Chrome.

[AWS]

I started using Chrome about 50% of the time lately.

 

This can happen with Firefox, but, like the Apple App store the process to get an extension in is a little more secure.

[allheart55 Cindy E]

It's beginning to feel as if nothing is safe any more.

[plodr]

I have chrome on a USB stick. I use it on one Windows computer because a site someone loaded some things on for me required chrome to download the files.

 

Of course it is on my three android devices. I use it from time to time on there but I do have FF installed. I also had Palemoon installed but he pulled out of doing any android development. I have AdBlockPlus browser on 1 or 2 devices. it won't work on the 3rd because my Asus tablet uses an Intel chip and it stopped working on that. Tech support was very helpful tracking down the reason why it stopped working after an update.