Click-Fraud Chrome Extensions Removed from Store After 500,000 Downloads

Click-Fraud Chrome Extensions Removed from Store After 500,000 Downloads

Extensions for Google’s Chrome browser have to work within certain restrictions, but that hasn’t stopped people from sneaking in malicious features. Researchers from security firm ICEBRG report finding a cluster of scam extensions in the Google Web Store with a combined download figure of more than 500,000. Google has removed the extensions, but the creators of these extensions probably still made a mountain of cash from the scheme.

According to ICEBRG, it first became aware of the dangerous extensions after finding a suspicious spike in outbound network traffic on a client’s machine. The team tracked that to an extension called Change HTTP Request Header running a hidden a click-fraud package. As the user goes about his or her business, the extension reaches out to a control server to generate money by clicking ads. The control server actually uses the victim’s computer as a proxy to make it look like a person is clicking the ads and affiliate links that benefit the extension owners. That’s why the extensions generate so much suspicious outbound traffic.

ICEBRG eventually found three more extensions doing the same thing: Nyoogle, Stickies, and Lite Bookmarks. Of the extensions found, Nyoogle had by far the most downloads at more than 500,000 (it promised custom Google logos). The others, including the extension that tipped off ICEBRG, were very small by comparison.

Click-Fraud Chrome Extensions Removed from Store After 500,000 Downloads

By default, Chrome extensions can only run JavaScript contained within the JSON in the Web Store. That means Google’s security measures can catch malicious behavior. However, developers can enable JSON download capabilities in their extensions. In this case, the developers loaded the extension with new code to generate fake clicks. ICEBRG notes that the extensions could have been used to steal data or probe networks for other vulnerabilities. However, the goal of this scheme was apparently to go unnoticed and make as much money as possible.

Google has removed the offending extensions from the store and blocked the developer accounts. Chrome has a reputation for being one of the most secure browsers in the world. It gets frequent updates to patch security holes, and the browser processes are sandboxed from the system. The issue isn’t so much with Chrome itself as it is with extensions in general. Any browser that allows users to run third-party code will be potentially vulnerable to attack. The best course of action is to limit the extensions you run to those from Google and other developer accounts you trust.

Continue reading

How to Download YouTube Videos

We've singled out two options that get solid reviews and don't require you to install adware.

Developer Accidentally Makes Forza Horizon 4 Available for Download 4 Months Early

Forza Horizon 4 isn't set to come out for four more months, but the developers accidentally pushed it out to some fans over the weekend. Of course, downloaders have harvested a partial list of cars from the game files.

US Mobile Download Speeds Shot Up in 2018, T-Mobile Beats Verizon

Ookla's 2018 report on Internet bandwidth and performance is available and it shows substantial gains for all major carriers.

Forza Horizons 4 Buyers Can’t Download Game Thanks to Windows Store Bug

Fans of the racing franchise have been dismayed to learn that after six years Microsoft still can't get the store working right.