Click-Fraud Chrome Extensions Removed from Store After 500,000 Downloads

Click-Fraud Chrome Extensions Removed from Store After 500,000 Downloads

Extensions for Google’s Chrome browser have to work within certain restrictions, but that hasn’t stopped people from sneaking in malicious features. Researchers from security firm ICEBRG report finding a cluster of scam extensions in the Google Web Store with a combined download figure of more than 500,000. Google has removed the extensions, but the creators of these extensions probably still made a mountain of cash from the scheme.

According to ICEBRG, it first became aware of the dangerous extensions after finding a suspicious spike in outbound network traffic on a client’s machine. The team tracked that to an extension called Change HTTP Request Header running a hidden a click-fraud package. As the user goes about his or her business, the extension reaches out to a control server to generate money by clicking ads. The control server actually uses the victim’s computer as a proxy to make it look like a person is clicking the ads and affiliate links that benefit the extension owners. That’s why the extensions generate so much suspicious outbound traffic.

ICEBRG eventually found three more extensions doing the same thing: Nyoogle, Stickies, and Lite Bookmarks. Of the extensions found, Nyoogle had by far the most downloads at more than 500,000 (it promised custom Google logos). The others, including the extension that tipped off ICEBRG, were very small by comparison.

Click-Fraud Chrome Extensions Removed from Store After 500,000 Downloads

By default, Chrome extensions can only run JavaScript contained within the JSON in the Web Store. That means Google’s security measures can catch malicious behavior. However, developers can enable JSON download capabilities in their extensions. In this case, the developers loaded the extension with new code to generate fake clicks. ICEBRG notes that the extensions could have been used to steal data or probe networks for other vulnerabilities. However, the goal of this scheme was apparently to go unnoticed and make as much money as possible.

Google has removed the offending extensions from the store and blocked the developer accounts. Chrome has a reputation for being one of the most secure browsers in the world. It gets frequent updates to patch security holes, and the browser processes are sandboxed from the system. The issue isn’t so much with Chrome itself as it is with extensions in general. Any browser that allows users to run third-party code will be potentially vulnerable to attack. The best course of action is to limit the extensions you run to those from Google and other developer accounts you trust.

Continue reading

Western Digital’s My Cloud Storage Devices Have Hard-Coded Backdoor

Western Digital's My Cloud network attached storage (NAS) devices claim to offer an easy, all-in-one solution for storing your data at home. However, they might also be providing an easy, all-in-one solution for hackers to steal your data take control of your device.

New macOS Security Bug Unlocks App Store With Any Password

Apple's macOS High Sierra has a flaw in the latest version that allows admin users to bypass a locked app store by entering any password they like.

Trump’s Executive Orders Boosting Rural Broadband Won’t Stop FCC Sabotage

President Trump has issued a pair of executive orders aimed at helping rural Americans receive broadband service, but his instructions will only apply to a relatively small number of people and could make the actual problem worse.

21 States Sue to Stop Net Neutrality Rollback

Twenty-one states and the District of Columbia have requested a review of the FCC's decision to dismantle net neutrality. Meanwhile, 50 Senators have agreed to vote against the FCC's decision — but House support and a potential Trump veto loom large.