Extensions for Google’s Chrome browser have to work within certain restrictions, but that hasn’t stopped people from sneaking in malicious features. Researchers from security firm ICEBRG report finding a cluster of scam extensions in the Google Web Store with a combined download figure of more than 500,000. Google has removed the extensions, but the creators of these extensions probably still made a mountain of cash from the scheme.
According to ICEBRG, it first became aware of the dangerous extensions after finding a suspicious spike in outbound network traffic on a client’s machine. The team tracked that to an extension called Change HTTP Request Header running a hidden a click-fraud package. As the user goes about his or her business, the extension reaches out to a control server to generate money by clicking ads. The control server actually uses the victim’s computer as a proxy to make it look like a person is clicking the ads and affiliate links that benefit the extension owners. That’s why the extensions generate so much suspicious outbound traffic.
ICEBRG eventually found three more extensions doing the same thing: Nyoogle, Stickies, and Lite Bookmarks. Of the extensions found, Nyoogle had by far the most downloads at more than 500,000 (it promised custom Google logos). The others, including the extension that tipped off ICEBRG, were very small by comparison.
Google has removed the offending extensions from the store and blocked the developer accounts. Chrome has a reputation for being one of the most secure browsers in the world. It gets frequent updates to patch security holes, and the browser processes are sandboxed from the system. The issue isn’t so much with Chrome itself as it is with extensions in general. Any browser that allows users to run third-party code will be potentially vulnerable to attack. The best course of action is to limit the extensions you run to those from Google and other developer accounts you trust.
Emergency Windows Update Removes Intel’s Buggy Spectre Patch
Microsoft has issued a rare out-of-cycle patch for Windows systems that removes Intel's Spectre patch. That has to be embarrassing for Intel.
EA Admits Defeat, Unlocks All Battlefront 2 Heroes, Removes Pay-to-Win Mechanics
EA has revamped the entire Battlefront 2 progression system, removed its pay-to-win mechanics, and now rewards players for, you know, actually playing the game.
Valve Removed Steam Machines From Its Home Page
You can still access what remains of the Steam Machine landing site via a direct link — not that you'll see much when you get there.
FTC Warns Companies ‘Warranty Void if Removed’ Stickers Are Flatly Illegal
The FTC has sent letters to multiple companies, informing them that "void if removed" warranty stickers are illegal and not permitted under federal law.