Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

1/18/2018
05:23 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Rogue Chrome, Firefox Extensions Hijack Browsers; Prevent Easy Removal

Malwarebytes describes malicious extensions as 'one of a kind'

Any malware that hijacks your browser to serve up ads or to redirect you to random websites can be annoying. Even more so are extensions that take control of your browser and prevent you from landing on pages that can help you get rid of them.

Security researchers at Malwarebytes recently discovered extensions for Chrome and Firefox that display precisely that behavior. According to the security vendor, the extensions are designed to hijack browsers and then block users from removing them by closing out pages with information on extensions and add-ons, or by steering users to pages where extensions aren't listed. Rogue extensions like these are often an overlooked attack vector that can leave organizations exposed to serious threats.

News of the rogue extensions follows a report from the ICEBRG Security Research team just this week about several malicious Chrome extensions in Google's Chrome store that has impacted some 500,000 users around the world, including many organizations.

"The Chrome extension is a one-of-a-kind so far," says Pieter Arntz, malware intelligence researcher at Malwarebytes. The code that forces the extension to install on a victim's browser itself looks re-used from another family of forced extensions, he says. "But the code to take users away from the extensions list in Chrome, I've never seen before."

The Firefox extension was a first as well when Malwarebytes initially spotted it, Arntz says. But researchers have already spotted a second version of it since then, he said.

The Chrome extension seems targeted at a specific demographic since it is in Spanish and promises to give users the weather in Colombia. But when installed, it opens a minimized Chrome window to the side of the screen that then accesses dozens of YouTube videos every minute, Arntz says. "So, we assume it was designed to quickly drive up the number of views for those videos." The extension has been around for several weeks and is available in the Chrome Web Store, he notes.

The Firefox extensions meanwhile are being pushed by cryptocurency faucets and similar websites that reward visitors with free content or other incentives for completing tasks like watching ads or completing captchas.

One of the ways users can be trapped into doing forced installs of malicious browsers is by landing on websites designed solely for that purpose. Users can often end up on these sites via redirects from adult, keygen, and software cracking sites, according to Malwarebytes.

"What we call a forced install is that when a website is designed to keep the user there until he decides to install the extension," Arntz says. Such websites employ javascripts, login prompts and various HTML5 tricks to essentially lock down the browser and prevent a user from browsing to another site or even closing down the tab until the extension is installed.

Chrome users have an easier time escaping such sites, by simply opening a new tab and then shutting down the offending tab, while Firefox users can only close them out via the TaskManager.

However, compared to Chrome users, Firefox users can disable the rogue extension more easily once it is actually installed simply by running the browser in Safe Mode, Arntz says. Firefox's Safe Mode allows users to see a list of all browser extensions, even when the extensions are not active, making it relatively simply to uninstall unwanted ones. Chrome in contrast, does not allow users to see any installed extensions when it is started with the extensions disabled.

"In Chrome, you will have to figure out the name of the extension folder and make some significant change there before you can access the list of extensions. Chrome not showing the extensions when you start it with the extensions disabled [has] a big handicap there," Arntz says.

Related content:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
1/22/2018 | 10:23:52 PM
Re: Future throughts
@REISEN: How is Opera? I remember using it years ago and finding it a bit lackluster -- serviceable but not as useful as the alternatives.

Of course, these days, I dislike those alternatives.
REISEN1955
100%
0%
REISEN1955,
User Rank: Ninja
1/19/2018 | 10:17:26 AM
Re: Future throughts
Clean your history, cache and ext frequently.  OPERA will shortly have a COINHIVE blocking setting.  It is only going to get worse people!!!  
sull1991
100%
0%
sull1991,
User Rank: Apprentice
1/18/2018 | 10:10:48 PM
Future throughts
I am scared on how big this is gonna be in future =/
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment:   It's a PEN test of our cloud security.
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7245
PUBLISHED: 2020-01-23
Incorrect username validation in the registration processes of CTFd through 2.2.2 allows a remote attacker to take over an arbitrary account after initiating a password reset. This is related to register() and reset_password() in auth.py. To exploit the vulnerability, one must register with a userna...
CVE-2019-14885
PUBLISHED: 2020-01-23
A flaw was found in the JBoss EAP Vault system in all versions before 7.2.6.GA. Confidential information of the system property's security attribute value is revealed in the JBoss EAP log file when executing a JBoss CLI 'reload' command. This flaw can lead to the exposure of confidential information...
CVE-2019-17570
PUBLISHED: 2020-01-23
An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code. Apache XML-RPC is no longer maintained and this issue...
CVE-2020-6007
PUBLISHED: 2020-01-23
Philips Hue Bridge model 2.X prior to and including version 1935144020 contains a Heap-based Buffer Overflow when handling a long ZCL string during the commissioning phase, resulting in a remote code execution.
CVE-2012-4606
PUBLISHED: 2020-01-23
Citrix XenServer 4.1, 6.0, 5.6 SP2, 5.6 Feature Pack 1, 5.6 Common Criteria, 5.6, 5.5, 5.0, and 5.0 Update 3 contains a Local Privilege Escalation Vulnerability which could allow local users with access to a guest operating system to gain elevated privileges.