6 ms·

37k Chrome users downloaded a fake Adblock Plus extension

152 points by sus_007 9y ago

sengork 9y ago
Extensions are the new "Let's play find the download button on a webpage" that's been around for years. [1] So many users download replicas of uBlock and find it hard to install the original uBlock Origin extension. Countless times have I had to send them direct link to Chrome's extension site just to make sure they're installing the right one. This is the case especially as the genuine extension in this case has no direct author website and instead lists a repo on Github (average users feel this indicates a knockoff and look elsewhere). [1] https://www.pcworld.com/article/2012958/how-to-avoid-fake-download-buttons.html https://www.pcworld.com/article/2012958/how-to-avoid-fake-do...
- krackers 9y ago
  This is especially a problem when you try looking for new extensions. It's not sufficient to just look at the reviews or popularity since often times the users themselves have no idea their browsing history is being captured and sold. Also it seems that Google is in no hurry to fix this issue as even having discovered and reported malicious extensions they remain up (see: https://news.ycombinator.com/item?id=14889619 https://news.ycombinator.com/item?id=14889619). From the client side one mitigation might be to have all extensions denied network access by default and have the user manually whitelist those in a little-snitch like manner. There is an experimental flag for something similar to this called "User consent for extension scripts." From Google's side the best thing would be to run all extensions in a sandbox like they supposedly do for Android apps and monitor its activity to see if it does anything suspicious like record browsing history, redirect pages, or call out to sketchy URLs.
  - 482794793792894 9y ago
    > From the client side one mitigation might be to have all extensions denied network access by default and have the user manually whitelist those in a little-snitch like manner. I don't think, Google has any interest in doing that. You can't either block internet access on a per-app basis on Android, even though this would close tons of information leaks, that the clunky permission system they currently have in place just can't fix. And as for the best thing to do from Google's side, that would probably be what Mozilla is doing. Sit actual human beings down to look at the code of newly submitted extensions and of extension updates. No, this does not scale, can't be automated by some algorithm, but it actually works. And it's not like it needs to scale into the millions.
    - krackers 9y ago
      A good middle ground might be to review only the top 1000 extensions or so and put a trusted checkmark on them. Reflecting back on the automated extension review, I just realized that the problem is more complex that it seems at first glance since extensions can also contain content scripts that inject JS directly into pages themselves, so it's easy to mask the source of a POST by injecting the xhr directly into the webpage.
- PhasmaFelis 9y ago
  As an aside, anyone know why both of the major adblockers have an unrelated adblocker with the same name? (AdBlock/AdBlock Plus, uBlock/uBlock Origin.) Who thought this was a good idea?
  - fwn 9y ago
    Adblock and Adblock Plus were different developers. (Now, I believe, they are both controlled by Eyeo.) The obvious name is shared, the "Plus" were added to indicate a fork of an earlier project. I believe this was far prior to the project getting monetized. uBlock Origin was originally just uBlock, but a rough moderator took it over (or that's somewhat the story) so there's the Origin fork with the original Dev, the uBlock project does not appear to progress anymore.
- bubblethink 9y ago
  >This is the case especially as the genuine extension in this case has no direct author website and instead lists a repo on Github It's the other way round for me. I only install an extension if I find the github (or similar) repo with sufficient activity, stars or whatever. I would even sometimes use google search with the site:github.com string when looking for extensions or android apps. It would be nice if the chrome store and even android play store had a foss tick box.
  - TwelveNights 9y ago
    Ordinarily, people might find seeing the repository straight-up too jarring. For people who aren't in the IT world, I'm not sure that seeing Github will be some definitive proof that an extension is legit.
    - traviscj 9y ago
      Furthermore, it is only definitive until it isn't. If we trained users to look for the github page, we'd have forked projects that point to the compromised extension, fake github clones that look like the project, fraudulent likes, and so forth.
      - tracker1 9y ago
        Or clones that point to the legitimate github repo.
    - emodendroket 9y ago
      Even for people who are that isn't really "definitive proof" of anything.
      - TwelveNights 9y ago
        If a project looks popular, you can at least assume it isn't total rubbish though.
        9y ago
- corobo 9y ago
  I had the exact same problem re: uBlock Origin. I even set up a quick site[1] a couple referrals ago just so I could have a place to easily point someone to. [1] https://getublock.com/ https://getublock.com/
  - artursapek 9y ago
    You could do a little bit of work to automatically select the right browser based on user-agent, and just display one button prominently.
    - corobo 9y ago
      Yeah it does need a bit of love, I whipped it up in about 15 minutes or so when I wanted to link someone to the extension
- 482794793792894 9y ago
  > Extensions are the new "Let's play find the download button on a webpage" that's been around for years. Chrome extensions are that. No other browser has this problem. I think, it's necessary to be pointing fingers here, to get Google to maybe finally do something about it and so that people don't mistakenly limit their use of extensions on other browsers.
- NiveaGeForce 9y ago
  Chrome extension malware is very common * https://www.reddit.com/r/chrome/comments/6fotke/the_great_suspender_extension_gone/dijtvud/ https://www.reddit.com/r/chrome/comments/6fotke/the_great_su... * https://threatpost.com/seven-more-chrome-extensions-compromised/127458/ https://threatpost.com/seven-more-chrome-extensions-compromi... * http://chrispederick.com/blog/web-developer-for-chrome-compromised/ http://chrispederick.com/blog/web-developer-for-chrome-compr... * https://www.reddit.com/r/Windows10/comments/6hvzzt/psa_my_chrome_extension_chrometana_has_been/ https://www.reddit.com/r/Windows10/comments/6hvzzt/psa_my_ch... * https://thehackernews.com/2017/07/chrome-extention-hacking-adware.html https://thehackernews.com/2017/07/chrome-extention-hacking-a... * https://arstechnica.com/security/2017/01/ciscos-webex-chrome-plugin-opens-20-million-users-to-drive-by-attacks/ https://arstechnica.com/security/2017/01/ciscos-webex-chrome... * https://www.bleepingcomputer.com/news/security/coinhive-is-rapidly-becoming-a-favorite-tool-among-malware-devs/ https://www.bleepingcomputer.com/news/security/coinhive-is-r... * https://lifehacker.com/many-browser-extensions-have-become-adware-or-malware-1505117457 https://lifehacker.com/many-browser-extensions-have-become-a...
- Feniks 9y ago
  I always get my addons straight from github. That way I'm running the latest version and bypassing Mozilla. But you have to be an advanced user, it is complex now to install an "unsupported" adon.
topranks 9y ago
What are Google's rules about names? Only difference I can see here is the fake one is called "AdBlock" and the real one "Adblock". Is changing the case of one letter enough to get an extension into the Chrome store? Or even worse are overlapping names allowed?
- sp332 9y ago
  The fake one is in the "Apps" section and the real one is in the "Extensions" section. Since apps aren't as popular overall as extensions, it's easier to game that section to get to the top.
- extrapickles 9y ago
  It’s hard enough to tell someone which is best, telling them the particular capitalization is impossible without giving them a direct link. In addition, preventing duplicate names is fairly hard if you support unicode. Characters like the zero width space, Mongolian vowel separator and many others make it algorithmically different but visually they are the same.
  - myle 9y ago
    That's not really n issue. You can always compared normalized versions of the name.
- styfle 9y ago
  Google should make the extension name case insensitive like domain names. That should help a little bit.
  - marindez 9y ago
    Then people will use cyrillic letters, etc. That approach simply does not work.
    - styfle 9y ago
      Yeah its a problem for domain names too: https://www.xudongz.com/blog/2017/idn-phishing/ https://www.xudongz.com/blog/2017/idn-phishing/
leog7 9y ago
Google in general is poor on security this should have been anticipated
jbverschoor 9y ago
Where's the bashing about Apple's App Store policy?
ocdtrekkie 9y ago
This is, unfortunately, remarkably common. It only received a lot of attention here because it pretended to be a well-known extension: The Web Store is full of extensions which hijack your start page and search provider and have full access to all of your web content. They're often installed via pages through malicious ads which state that you must accept Chrome's install extension request to continue web browsing and use a variety of JavaScript-based tricks to keep you on the page until you do. (The other thing that occasionally gets mentioned: Extensions get bought out so that adware and spyware is automatically pushed down to Chrome users silently.) Many times, I've reported malicious extensions I've found on user's PCs, and months later they are still alive and well on the Web Store. Google has not taken significant steps to vet browser extensions despite the massive amount of access to your personal data they have, particularly if they use permissions like accessing the content of pages you're on. Microsoft appears to only permit Edge extensions on a case-by-case, human-vetted basis. I strongly recommend instructing lay users to use Edge over Chrome, and those who insist on Chrome should have --no-extensions added to their shortcuts to ensure Google's extension interface is wholly disabled. (At the office, I use a group policy to block all extensions on all Chrome installs network-wide. Google provides surprisingly decent tools to do this.) Unfortunately, while Chrome regularly brags about their security measures, it does very little when they permit (and distribute) malicious extensions in their store with permissions to do whatever they want with user data. Their Pwn2Own records, their bug bounties, it's all irrelevant while they don't consider this a serious issue. It is akin to bragging about how good your deadbolt is while leaving the door wide open.
joshfraser 9y ago
I audit every extension before I install it. You should too. https://chrome.google.com/webstore/detail/chrome-extension-source-v/jifpbeccnghkjeaalbbjmodiffmgedin https://chrome.google.com/webstore/detail/chrome-extension-s...
- eatbitseveryday 9y ago
  Catch-22?
- smnrchrds 9y ago
  I am a mechanical engineer not a software developer. Any advice for me?
  - deleted 9y ago
    [deleted]
  - 482794793792894 9y ago
    Run Firefox. Mozilla audits extensions and extension updates before they get published.
  - kibwen 9y ago
    Personal auditing doesn't really solve the problem because extensions update automatically, and there are numerous cases of the authors of popular extensions being approached to sell out their userbase in exchange for cash, providing a motive for formerly-audited extensions to go bad. Here's some basic tips at defending yourself: 1. Minimize the amount of extensions you use to the bare essentials. If you can live without it, uninstall it. If you rarely use it, uninstall it. 2. Prefer extensions from well-known organizations rather than unknown individuals. Example: there are plenty of extensions that force HTTP requests to HTTPS when possible, but I exclusively use the one from the EFF. Organizations have less to gain and more to lose from breaching the trust of their users in this way. 3. Prefer extensions that multiple software developers have recommended personally. This won't itself protect you from malware, but it does increase the likelihood that emergent malware will be discovered promptly and loudly publicized. 4. If you absolutely need an extension and none of the above apply, download the source code of the extension yourself and manually load it into your browser, to keep it from being automatically updated. (Part of me is wary to recommend this, as software that never gets updated is historically prone to being exploited by lingering unpatched flaws, but I'm having a hard time coming up with an attack vector of this sort for browser extensions.)
aurora- 9y ago
The last 5+ years the only malware found on my Windows computers were Chrome extensions. Not found by Avast, but by (my about weekly) manual scan with MBAM free. One of the extensions I remember is Zoom, other two or three I forgot.
jzl 9y ago
Reminiscent of the problem earlier this year where GOOGLE DOCS ITSELF was spoofed with a Google-approved (for a brief window, at least) web app called "Google Docs": https://www.theverge.com/2017/5/3/15534768/google-docs-phishing-attack-share-this-document-with-you-spam https://www.theverge.com/2017/5/3/15534768/google-docs-phish... It's pretty insane that Google keeps tripping over itself on this same issue. Surely they have the means and know-how to prevent it.
shpx 9y ago
It's even worse. 3,878,417 computers have a fake uBlock Origin clone called uBlock Plus (playing on the fact that there's Adblock and Adblock Plus) installed. https://chrome.google.com/webstore/detail/ublock-plus/kjagjnchnnlgiafjjlahaedeagnmhefi https://chrome.google.com/webstore/detail/ublock-plus/kjagjn...

152 points by sus_007 9y ago

Extensions are the new "Let's play find the download button on a webpage" that's been around for years. [1] So many users download replicas of uBlock and find it hard to install the original uBlock Origin extension. Countless times have I had to send them direct link to Chrome's extension site just to make sure they're installing the right one. This is the case especially as the genuine extension in this case has no direct author website and instead lists a repo on Github (average users feel this indicates a knockoff and look elsewhere). [1] https://www.pcworld.com/article/2012958/how-to-avoid-fake-download-buttons.html https://www.pcworld.com/article/2012958/how-to-avoid-fake-do...

krackers 9y ago
This is especially a problem when you try looking for new extensions. It's not sufficient to just look at the reviews or popularity since often times the users themselves have no idea their browsing history is being captured and sold. Also it seems that Google is in no hurry to fix this issue as even having discovered and reported malicious extensions they remain up (see: https://news.ycombinator.com/item?id=14889619 https://news.ycombinator.com/item?id=14889619). From the client side one mitigation might be to have all extensions denied network access by default and have the user manually whitelist those in a little-snitch like manner. There is an experimental flag for something similar to this called "User consent for extension scripts." From Google's side the best thing would be to run all extensions in a sandbox like they supposedly do for Android apps and monitor its activity to see if it does anything suspicious like record browsing history, redirect pages, or call out to sketchy URLs.
- 482794793792894 9y ago
  > From the client side one mitigation might be to have all extensions denied network access by default and have the user manually whitelist those in a little-snitch like manner. I don't think, Google has any interest in doing that. You can't either block internet access on a per-app basis on Android, even though this would close tons of information leaks, that the clunky permission system they currently have in place just can't fix. And as for the best thing to do from Google's side, that would probably be what Mozilla is doing. Sit actual human beings down to look at the code of newly submitted extensions and of extension updates. No, this does not scale, can't be automated by some algorithm, but it actually works. And it's not like it needs to scale into the millions.
  - krackers 9y ago
    A good middle ground might be to review only the top 1000 extensions or so and put a trusted checkmark on them. Reflecting back on the automated extension review, I just realized that the problem is more complex that it seems at first glance since extensions can also contain content scripts that inject JS directly into pages themselves, so it's easy to mask the source of a POST by injecting the xhr directly into the webpage.
PhasmaFelis 9y ago
As an aside, anyone know why both of the major adblockers have an unrelated adblocker with the same name? (AdBlock/AdBlock Plus, uBlock/uBlock Origin.) Who thought this was a good idea?
- fwn 9y ago
  Adblock and Adblock Plus were different developers. (Now, I believe, they are both controlled by Eyeo.) The obvious name is shared, the "Plus" were added to indicate a fork of an earlier project. I believe this was far prior to the project getting monetized. uBlock Origin was originally just uBlock, but a rough moderator took it over (or that's somewhat the story) so there's the Origin fork with the original Dev, the uBlock project does not appear to progress anymore.
bubblethink 9y ago
>This is the case especially as the genuine extension in this case has no direct author website and instead lists a repo on Github It's the other way round for me. I only install an extension if I find the github (or similar) repo with sufficient activity, stars or whatever. I would even sometimes use google search with the site:github.com string when looking for extensions or android apps. It would be nice if the chrome store and even android play store had a foss tick box.
- TwelveNights 9y ago
  Ordinarily, people might find seeing the repository straight-up too jarring. For people who aren't in the IT world, I'm not sure that seeing Github will be some definitive proof that an extension is legit.
  - traviscj 9y ago
    Furthermore, it is only definitive until it isn't. If we trained users to look for the github page, we'd have forked projects that point to the compromised extension, fake github clones that look like the project, fraudulent likes, and so forth.
    - tracker1 9y ago
      Or clones that point to the legitimate github repo.
  - emodendroket 9y ago
    Even for people who are that isn't really "definitive proof" of anything.
    - TwelveNights 9y ago
      If a project looks popular, you can at least assume it isn't total rubbish though.
      - 9y ago
corobo 9y ago
I had the exact same problem re: uBlock Origin. I even set up a quick site[1] a couple referrals ago just so I could have a place to easily point someone to. [1] https://getublock.com/ https://getublock.com/
- artursapek 9y ago
  You could do a little bit of work to automatically select the right browser based on user-agent, and just display one button prominently.
  - corobo 9y ago
    Yeah it does need a bit of love, I whipped it up in about 15 minutes or so when I wanted to link someone to the extension
482794793792894 9y ago
> Extensions are the new "Let's play find the download button on a webpage" that's been around for years. Chrome extensions are that. No other browser has this problem. I think, it's necessary to be pointing fingers here, to get Google to maybe finally do something about it and so that people don't mistakenly limit their use of extensions on other browsers.
NiveaGeForce 9y ago
Chrome extension malware is very common * https://www.reddit.com/r/chrome/comments/6fotke/the_great_suspender_extension_gone/dijtvud/ https://www.reddit.com/r/chrome/comments/6fotke/the_great_su... * https://threatpost.com/seven-more-chrome-extensions-compromised/127458/ https://threatpost.com/seven-more-chrome-extensions-compromi... * http://chrispederick.com/blog/web-developer-for-chrome-compromised/ http://chrispederick.com/blog/web-developer-for-chrome-compr... * https://www.reddit.com/r/Windows10/comments/6hvzzt/psa_my_chrome_extension_chrometana_has_been/ https://www.reddit.com/r/Windows10/comments/6hvzzt/psa_my_ch... * https://thehackernews.com/2017/07/chrome-extention-hacking-adware.html https://thehackernews.com/2017/07/chrome-extention-hacking-a... * https://arstechnica.com/security/2017/01/ciscos-webex-chrome-plugin-opens-20-million-users-to-drive-by-attacks/ https://arstechnica.com/security/2017/01/ciscos-webex-chrome... * https://www.bleepingcomputer.com/news/security/coinhive-is-rapidly-becoming-a-favorite-tool-among-malware-devs/ https://www.bleepingcomputer.com/news/security/coinhive-is-r... * https://lifehacker.com/many-browser-extensions-have-become-adware-or-malware-1505117457 https://lifehacker.com/many-browser-extensions-have-become-a...
Feniks 9y ago
I always get my addons straight from github. That way I'm running the latest version and bypassing Mozilla. But you have to be an advanced user, it is complex now to install an "unsupported" adon.

topranks 9y ago

What are Google's rules about names? Only difference I can see here is the fake one is called "AdBlock" and the real one "Adblock". Is changing the case of one letter enough to get an extension into the Chrome store? Or even worse are overlapping names allowed?

sp332 9y ago
The fake one is in the "Apps" section and the real one is in the "Extensions" section. Since apps aren't as popular overall as extensions, it's easier to game that section to get to the top.
extrapickles 9y ago
It’s hard enough to tell someone which is best, telling them the particular capitalization is impossible without giving them a direct link. In addition, preventing duplicate names is fairly hard if you support unicode. Characters like the zero width space, Mongolian vowel separator and many others make it algorithmically different but visually they are the same.
- myle 9y ago
  That's not really n issue. You can always compared normalized versions of the name.
styfle 9y ago
Google should make the extension name case insensitive like domain names. That should help a little bit.
- marindez 9y ago
  Then people will use cyrillic letters, etc. That approach simply does not work.
  - styfle 9y ago
    Yeah its a problem for domain names too: https://www.xudongz.com/blog/2017/idn-phishing/ https://www.xudongz.com/blog/2017/idn-phishing/

leog7 9y ago

Google in general is poor on security this should have been anticipated

jbverschoor 9y ago

Where's the bashing about Apple's App Store policy?

ocdtrekkie 9y ago

This is, unfortunately, remarkably common. It only received a lot of attention here because it pretended to be a well-known extension: The Web Store is full of extensions which hijack your start page and search provider and have full access to all of your web content. They're often installed via pages through malicious ads which state that you must accept Chrome's install extension request to continue web browsing and use a variety of JavaScript-based tricks to keep you on the page until you do. (The other thing that occasionally gets mentioned: Extensions get bought out so that adware and spyware is automatically pushed down to Chrome users silently.) Many times, I've reported malicious extensions I've found on user's PCs, and months later they are still alive and well on the Web Store. Google has not taken significant steps to vet browser extensions despite the massive amount of access to your personal data they have, particularly if they use permissions like accessing the content of pages you're on. Microsoft appears to only permit Edge extensions on a case-by-case, human-vetted basis. I strongly recommend instructing lay users to use Edge over Chrome, and those who insist on Chrome should have --no-extensions added to their shortcuts to ensure Google's extension interface is wholly disabled. (At the office, I use a group policy to block all extensions on all Chrome installs network-wide. Google provides surprisingly decent tools to do this.) Unfortunately, while Chrome regularly brags about their security measures, it does very little when they permit (and distribute) malicious extensions in their store with permissions to do whatever they want with user data. Their Pwn2Own records, their bug bounties, it's all irrelevant while they don't consider this a serious issue. It is akin to bragging about how good your deadbolt is while leaving the door wide open.

joshfraser 9y ago

I audit every extension before I install it. You should too. https://chrome.google.com/webstore/detail/chrome-extension-source-v/jifpbeccnghkjeaalbbjmodiffmgedin https://chrome.google.com/webstore/detail/chrome-extension-s...

eatbitseveryday 9y ago
Catch-22?
smnrchrds 9y ago
I am a mechanical engineer not a software developer. Any advice for me?
- deleted 9y ago
  [deleted]
- 482794793792894 9y ago
  Run Firefox. Mozilla audits extensions and extension updates before they get published.
- kibwen 9y ago
  Personal auditing doesn't really solve the problem because extensions update automatically, and there are numerous cases of the authors of popular extensions being approached to sell out their userbase in exchange for cash, providing a motive for formerly-audited extensions to go bad. Here's some basic tips at defending yourself: 1. Minimize the amount of extensions you use to the bare essentials. If you can live without it, uninstall it. If you rarely use it, uninstall it. 2. Prefer extensions from well-known organizations rather than unknown individuals. Example: there are plenty of extensions that force HTTP requests to HTTPS when possible, but I exclusively use the one from the EFF. Organizations have less to gain and more to lose from breaching the trust of their users in this way. 3. Prefer extensions that multiple software developers have recommended personally. This won't itself protect you from malware, but it does increase the likelihood that emergent malware will be discovered promptly and loudly publicized. 4. If you absolutely need an extension and none of the above apply, download the source code of the extension yourself and manually load it into your browser, to keep it from being automatically updated. (Part of me is wary to recommend this, as software that never gets updated is historically prone to being exploited by lingering unpatched flaws, but I'm having a hard time coming up with an attack vector of this sort for browser extensions.)

aurora- 9y ago

The last 5+ years the only malware found on my Windows computers were Chrome extensions. Not found by Avast, but by (my about weekly) manual scan with MBAM free. One of the extensions I remember is Zoom, other two or three I forgot.

jzl 9y ago

Reminiscent of the problem earlier this year where GOOGLE DOCS ITSELF was spoofed with a Google-approved (for a brief window, at least) web app called "Google Docs": https://www.theverge.com/2017/5/3/15534768/google-docs-phishing-attack-share-this-document-with-you-spam https://www.theverge.com/2017/5/3/15534768/google-docs-phish... It's pretty insane that Google keeps tripping over itself on this same issue. Surely they have the means and know-how to prevent it.

shpx 9y ago

It's even worse. 3,878,417 computers have a fake uBlock Origin clone called uBlock Plus (playing on the fact that there's Adblock and Adblock Plus) installed. https://chrome.google.com/webstore/detail/ublock-plus/kjagjnchnnlgiafjjlahaedeagnmhefi https://chrome.google.com/webstore/detail/ublock-plus/kjagjn...