Posted on Friday, February 14 2020 @ 15:28 CET by Thomas De Maesschalck
ARS Technica
writes security researchers discovered that over 500 browser extensions from Google's Chrome Web Store secretly collected and uploaded private user data to servers controlled by attackers. In total, these extensions were downloaded millions of times. They were part of a long-running ad-fraud and malvertising scheme:
The extensions were part of a long-running malvertising and ad-fraud scheme that was discovered by independent researcher Jamila Kaya. She and researchers from Cisco-owned Duo Security eventually identified 71 Chrome Web Store extensions that had more than 1.7 million installations. After the researchers privately reported their findings to Google, the company identified more than 430 additional extensions. Google has since removed all known extensions.
“In the case reported here, the Chrome extension creators had specifically made extensions that obfuscated the underlying advertising functionality from users,” Kaya and Duo Security researcher Jacob Rickerd wrote in a report. “This was done in order to connect the browser clients to a command and control architecture, exfiltrate private browsing data without the users’ knowledge, expose the user to risk of exploit through advertising streams, and attempt to evade the Chrome Web Store’s fraud detection mechanisms.”
