7 ms·

I guess this is as good a place as any to post that I noticed something similar had happened to [User-Agent Switcher for Google Chrome](https://chrome.google.co

I guess this is as good a place as any to post that I noticed something similar had happened to [User-Agent Switcher for Google Chrome](https://chrome.google.com/webstore/detail/user-agent-switcher-for-g/ffhkkpnppgnfaobgihpdblnhmmbodake?hl=en https://chrome.google.com/webstore/detail/user-agent-switche...) and [Block Site](https://chrome.google.com/webstore/detail/block-site/eiimnmioipafcokbfikbljfdeojpcgbh?hl=en https://chrome.google.com/webstore/detail/block-site/eiimnmi...). The "report abuse" link on the page is useless. The former is very insidious in that it actually hides the malware in a .jpg file that appears benign at first (promo.jpg for anyone who wants to analyze) but when loaded in a canvas element and decoded in some manner yields js that goes on to send all the user's http requests to some domain while also injecting ads and redirecting to affiliate links.

i_am_nomad 9y ago
That is some fine detective work there, Lieutenant! :) What tipped you off in the first place to the malware in User-Agent Switcher?
- krackers 9y ago
  The odd post requests I noticed to uaswitcher.org in wireshark while I was trying to create a packet capture. I saw that it contained my browsing history urls in double encoded base64 format. Interestingly it appears the extension was infected ~4 years back, taken down, and somehow later re-added, only to be reinfested with malware within the last few months. Suffice to say, I am now paranoid and have audited all my extensions, tossed out everything with obfuscated js, and run all my extensions in developer mode so I can be sure they never update without my consent.
  - kyle-rb 9y ago
    > urls in double encoded base64 format I've seen that somewhere else; is it just for obfuscation? Or is there some other reason for it?
    - krackers 9y ago
      From what I've seen online a lot of these adware extensions do something similar. To me it doesn't make sense as an obfuscation method since anyone capable of capturing traces of network activity (or using chrome dev tools to do the equivalent) can probably recognize a base64 encoding and can just run the decoder a second time. Maybe it might fool some automated analyzers though.
      - icelancer 9y ago
        I've definitely seen naive analyzers just do something like: -Input string -If string is Base64 encoded --Run base64decode(string) -Output new string With no recursion for an iterated check of any sort of encoding.
  - codedokode 9y ago
    I don't use browser extensions at all because they are often made by unknown developers and I cannot trust them.
    - stevenh 9y ago
      I always thought it was strange that Google bothered adding so many XSS prevention measures to Chrome when they also happily give UXSS abilities to extension developers, complete with the veneer of trust provided by the Chrome web store.
      - FussyZeus 9y ago
        > veneer of trust provided by the Chrome web store Seriously? Who trusts the Chrome store or the Android store for that matter? If you've ever once submitted an app and seen how loose the security is, I can't see how you'd have any faith in their system.
        cyphar 9y ago
        You're viscously agreeing here. "Veneer" means a very thin layer of pretty material on top of cheaper material -- in this context the comment was saying that the trust afforded to Google is skin-deep and is probably unjustified.
        FussyZeus 9y ago
        Ahh you're quite right. Apologies, not enough coffee yet.
    - posterboy 9y ago
      and if an extension is not downright malignand, they are often slow.
deleted 9y ago
[deleted]
krisgenre 9y ago
Damn! I was using this all along!. Removed it immediately and checked the chrome store for an alternative, there's one from Google itself.
- krackers 9y ago
  You're referring to this one right? https://chrome.google.com/webstore/detail/user-agent-switcher-for-c/djflhoibgkdhkhhcedjiklpkjnoahfmg https://chrome.google.com/webstore/detail/user-agent-switche... Is there any way to confirm that this is actually from google though, and not just some 3rd party who chose their publisher name as "google.com"? Most official google extensions have a "by google" badge in the right hand column whereas this one lacks it.
  - detaro 9y ago
    It's interesting, if you go to the support tab and follow the link to the maker's support website, you end up on https://spoofer-extension.appspot.com/ https://spoofer-extension.appspot.com/ The contact page there links to "Glenn Willson" as the author - and their G+ page has a link to The User-Agent Switcher Has A New Owner: Google! http://www.glennwilson.info/2017/02/the-user-agent-switcher-has-new-owner.html http://www.glennwilson.info/2017/02/the-user-agent-switcher-... Now, is that trustworthy or not? Good question.
    - shasheene 9y ago
      Search for an official Google Chrome extension (such as Chrome Remote Desktop). You'll see a 'By Google' logo (https://chrome.google.com/webstore/category/collection/by_google?hl=en https://chrome.google.com/webstore/category/collection/by_go...) as well as an 'offered by google.com'. This just has the 'offered by google.com'. I would have assumed a 'By Google' logo would have been added after acquisition?
      - heffer 9y ago
        If you go to the listing of all Google extensions (the URL you linked) and open the "Chrome Sign Builder" Extension, go to Related -> "More from this Developer" you will find the User-Agent Switcher for Chrome. So it does seem legit.
gorhill 9y ago
> it actually hides the malware in a .jpg file that appears benign at first (promo.jpg for anyone who wants to analyze) but when loaded in a canvas element and decoded in some manner I am guessing the extensions had a "content_security_policy" key in its manifest[1], with a 'unsafe-eval' CSP directive in its value? Any extension which declare such CSP directive in its manifest should be presumed malicious until further thorough investigation proves otherwise. The 'unsafe-eval' in a manifest is essentially the ability for an extension to execute arbitrary code in the extension context which can't be code-reviewed by reading the source files. EDIT: "User-Agent Switcher for Google Chrome" confirmed to have a 'unsafe-eval' in its manifest. "Block site" does not declare 'unsafe-eval' in its manifest. It does however add many "script-src" directives in its manifest, including one for ".wips.com", which means the extension can pull javascript resources not bundled with the extension from its own web site (hence outside of the Chrome store review process if any), and thus the behavior of the extension is subject to change at any time as far as its permissions allow. So I guess the suspicion should be extended to any extension declaring a "content_security_policy" key in its manifest. === [1] https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/content_security_policy https://developer.mozilla.org/en-US/Add-ons/WebExtensions/ma...
- occultist_throw 9y ago
  So how does unsafe-eval and loading scripts dynamically pass any sort of "google security scan"? It would seem obvious that the moment a script tries to load arbitrary code outside of the package, it should fail.
  - horsawlarway 9y ago
    Because unfortunately many, many libraries and templating engines rely on evaling code. Generated code is code that's outside of the package. There are also a few (keyword: FEW) valid reasons for using eval in situations where it's beneficial to pull updates and modules from a known and trusted location. In those cases though, if you're not signing server side and validating signatures in the extension with a pre-shared cert, you've still got problems (single MITM attack can compromise your extension going forward). Long story short, eval is still a very useful feature. It needs to be used properly, and it should be used rarely, but it's incredibly powerful, and lots of things you don't really think about suddenly stop working if it goes away.
milankragujevic 9y ago
I am mortified. I had this extension installed for 2 years... What info did they get and what can they do to me? Please help... (I uninstalled it, talking about User-Agent Switcher)
- coverband 9y ago
  Are you sure it's "User-Agent Switcher for Google Chrome", not just "User-Agent Switcher"? See my other comment that refers to the difference.
- krackers 9y ago
  I had the same concern when I found out. I narrowed it to see that it was probably only within the last ~5 months that it was updated to include the badware. I don't have the skills to decode it fully (since it was obfuscated quite heavily) but I know at the very least that it sends browsing history and injects ads. I'm not sure if extensions also have the capability to capture the https body info, but I erred on the safe side and also changed passwords.
mustacheemperor 9y ago
Wow, I went to try and add a 1-star review to each to warn users (since both have extremely high ratings) and you need to install the malware-ridden extension to leave a review. So we have a web store that that average Chrome users think is "safe," especially when apps have high review scores, and no meaningful ability to report malware to Google or to the users. Nice.
- binaryblitz 9y ago
  There is literally a 'Report Abuse' button about two inches below the download button. That's what you use in this case. Being able to leave a review of something you haven't tried would just be silly.
QAPereo 9y ago
Are there any known problems with Random User Agent?
coverband 9y ago
Beware: I also have a User Agent Switcher extension installed and was surprised to hear about this malware. Looks like the one I've been using safely is called "User-Agent Switcher" (https://chrome.google.com/webstore/detail/user-agent-switcher/lkmofgnohbedopheiphabfhfjgkhfcgf https://chrome.google.com/webstore/detail/user-agent-switche...) and is only 23KB (whereas the "... for Google Chrome" is at 350KB).
- coverband 9y ago
  For reference, on Windows the Chrome extensions are stored in a path ~similar~ to this one I have: C:\Users\<login.name>\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkmofgnohbedopheiphabfhfjgkhfcgf\2.0_0 "lkmofgnohbedopheiphabfhfjgkhfcgf" is the identifier for the user-agent extension I've been using for a while, and looking at the code, it's very straightforward and not spying on anything. It has not been updated since 2013 (and the website listed for the dev, www.toolshack.com, is not online), so I'm guessing a lot of users just go with other extensions that have received updates. BTW, Google itself offers a similar extension at 120KB called "User-Agent Switcher for Chrome" (not "... for Google Chrome") here: https://chrome.google.com/webstore/detail/user-agent-switcher-for-c/djflhoibgkdhkhhcedjiklpkjnoahfmg https://chrome.google.com/webstore/detail/user-agent-switche...

i_am_nomad 9y ago

That is some fine detective work there, Lieutenant! :) What tipped you off in the first place to the malware in User-Agent Switcher?

krackers 9y ago
The odd post requests I noticed to uaswitcher.org in wireshark while I was trying to create a packet capture. I saw that it contained my browsing history urls in double encoded base64 format. Interestingly it appears the extension was infected ~4 years back, taken down, and somehow later re-added, only to be reinfested with malware within the last few months. Suffice to say, I am now paranoid and have audited all my extensions, tossed out everything with obfuscated js, and run all my extensions in developer mode so I can be sure they never update without my consent.
- kyle-rb 9y ago
  > urls in double encoded base64 format I've seen that somewhere else; is it just for obfuscation? Or is there some other reason for it?
  - krackers 9y ago
    From what I've seen online a lot of these adware extensions do something similar. To me it doesn't make sense as an obfuscation method since anyone capable of capturing traces of network activity (or using chrome dev tools to do the equivalent) can probably recognize a base64 encoding and can just run the decoder a second time. Maybe it might fool some automated analyzers though.
    - icelancer 9y ago
      I've definitely seen naive analyzers just do something like: -Input string -If string is Base64 encoded --Run base64decode(string) -Output new string With no recursion for an iterated check of any sort of encoding.
- codedokode 9y ago
  I don't use browser extensions at all because they are often made by unknown developers and I cannot trust them.
  - stevenh 9y ago
    I always thought it was strange that Google bothered adding so many XSS prevention measures to Chrome when they also happily give UXSS abilities to extension developers, complete with the veneer of trust provided by the Chrome web store.
    - FussyZeus 9y ago
      > veneer of trust provided by the Chrome web store Seriously? Who trusts the Chrome store or the Android store for that matter? If you've ever once submitted an app and seen how loose the security is, I can't see how you'd have any faith in their system.
      - cyphar 9y ago
        You're viscously agreeing here. "Veneer" means a very thin layer of pretty material on top of cheaper material -- in this context the comment was saying that the trust afforded to Google is skin-deep and is probably unjustified.
        FussyZeus 9y ago
        Ahh you're quite right. Apologies, not enough coffee yet.
  - posterboy 9y ago
    and if an extension is not downright malignand, they are often slow.

deleted 9y ago

[deleted]

krisgenre 9y ago

Damn! I was using this all along!. Removed it immediately and checked the chrome store for an alternative, there's one from Google itself.

krackers 9y ago
You're referring to this one right? https://chrome.google.com/webstore/detail/user-agent-switcher-for-c/djflhoibgkdhkhhcedjiklpkjnoahfmg https://chrome.google.com/webstore/detail/user-agent-switche... Is there any way to confirm that this is actually from google though, and not just some 3rd party who chose their publisher name as "google.com"? Most official google extensions have a "by google" badge in the right hand column whereas this one lacks it.
- detaro 9y ago
  It's interesting, if you go to the support tab and follow the link to the maker's support website, you end up on https://spoofer-extension.appspot.com/ https://spoofer-extension.appspot.com/ The contact page there links to "Glenn Willson" as the author - and their G+ page has a link to The User-Agent Switcher Has A New Owner: Google! http://www.glennwilson.info/2017/02/the-user-agent-switcher-has-new-owner.html http://www.glennwilson.info/2017/02/the-user-agent-switcher-... Now, is that trustworthy or not? Good question.
  - shasheene 9y ago
    Search for an official Google Chrome extension (such as Chrome Remote Desktop). You'll see a 'By Google' logo (https://chrome.google.com/webstore/category/collection/by_google?hl=en https://chrome.google.com/webstore/category/collection/by_go...) as well as an 'offered by google.com'. This just has the 'offered by google.com'. I would have assumed a 'By Google' logo would have been added after acquisition?
    - heffer 9y ago
      If you go to the listing of all Google extensions (the URL you linked) and open the "Chrome Sign Builder" Extension, go to Related -> "More from this Developer" you will find the User-Agent Switcher for Chrome. So it does seem legit.

gorhill 9y ago

> it actually hides the malware in a .jpg file that appears benign at first (promo.jpg for anyone who wants to analyze) but when loaded in a canvas element and decoded in some manner I am guessing the extensions had a "content_security_policy" key in its manifest[1], with a 'unsafe-eval' CSP directive in its value? Any extension which declare such CSP directive in its manifest should be presumed malicious until further thorough investigation proves otherwise. The 'unsafe-eval' in a manifest is essentially the ability for an extension to execute arbitrary code in the extension context which can't be code-reviewed by reading the source files. EDIT: "User-Agent Switcher for Google Chrome" confirmed to have a 'unsafe-eval' in its manifest. "Block site" does not declare 'unsafe-eval' in its manifest. It does however add many "script-src" directives in its manifest, including one for ".wips.com", which means the extension can pull javascript resources not bundled with the extension from its own web site (hence outside of the Chrome store review process if any), and thus the behavior of the extension is subject to change at any time as far as its permissions allow. So I guess the suspicion should be extended to any extension declaring a "content_security_policy" key in its manifest. === [1] https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/content_security_policy https://developer.mozilla.org/en-US/Add-ons/WebExtensions/ma...

occultist_throw 9y ago
So how does unsafe-eval and loading scripts dynamically pass any sort of "google security scan"? It would seem obvious that the moment a script tries to load arbitrary code outside of the package, it should fail.
- horsawlarway 9y ago
  Because unfortunately many, many libraries and templating engines rely on evaling code. Generated code is code that's outside of the package. There are also a few (keyword: FEW) valid reasons for using eval in situations where it's beneficial to pull updates and modules from a known and trusted location. In those cases though, if you're not signing server side and validating signatures in the extension with a pre-shared cert, you've still got problems (single MITM attack can compromise your extension going forward). Long story short, eval is still a very useful feature. It needs to be used properly, and it should be used rarely, but it's incredibly powerful, and lots of things you don't really think about suddenly stop working if it goes away.

milankragujevic 9y ago

I am mortified. I had this extension installed for 2 years... What info did they get and what can they do to me? Please help... (I uninstalled it, talking about User-Agent Switcher)

coverband 9y ago
Are you sure it's "User-Agent Switcher for Google Chrome", not just "User-Agent Switcher"? See my other comment that refers to the difference.
krackers 9y ago
I had the same concern when I found out. I narrowed it to see that it was probably only within the last ~5 months that it was updated to include the badware. I don't have the skills to decode it fully (since it was obfuscated quite heavily) but I know at the very least that it sends browsing history and injects ads. I'm not sure if extensions also have the capability to capture the https body info, but I erred on the safe side and also changed passwords.

mustacheemperor 9y ago

Wow, I went to try and add a 1-star review to each to warn users (since both have extremely high ratings) and you need to install the malware-ridden extension to leave a review. So we have a web store that that average Chrome users think is "safe," especially when apps have high review scores, and no meaningful ability to report malware to Google or to the users. Nice.

binaryblitz 9y ago
There is literally a 'Report Abuse' button about two inches below the download button. That's what you use in this case. Being able to leave a review of something you haven't tried would just be silly.

QAPereo 9y ago

Are there any known problems with Random User Agent?

coverband 9y ago

Beware: I also have a User Agent Switcher extension installed and was surprised to hear about this malware. Looks like the one I've been using safely is called "User-Agent Switcher" (https://chrome.google.com/webstore/detail/user-agent-switcher/lkmofgnohbedopheiphabfhfjgkhfcgf https://chrome.google.com/webstore/detail/user-agent-switche...) and is only 23KB (whereas the "... for Google Chrome" is at 350KB).

coverband 9y ago
For reference, on Windows the Chrome extensions are stored in a path ~similar~ to this one I have: C:\Users\<login.name>\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkmofgnohbedopheiphabfhfjgkhfcgf\2.0_0 "lkmofgnohbedopheiphabfhfjgkhfcgf" is the identifier for the user-agent extension I've been using for a while, and looking at the code, it's very straightforward and not spying on anything. It has not been updated since 2013 (and the website listed for the dev, www.toolshack.com, is not online), so I'm guessing a lot of users just go with other extensions that have received updates. BTW, Google itself offers a similar extension at 120KB called "User-Agent Switcher for Chrome" (not "... for Google Chrome") here: https://chrome.google.com/webstore/detail/user-agent-switcher-for-c/djflhoibgkdhkhhcedjiklpkjnoahfmg https://chrome.google.com/webstore/detail/user-agent-switche...