Feeds

'Looming menace' of evil browser extensions to be demo'd this week

The way you'll get pwned next

Security for virtualized datacentres

A security researcher has developed a proof-of-concept browser botnet extension to illustrate the perils of what he describes as a "looming menace".

Zoltan Balazs of Deloitte Hungary developed the code to illustrate the risk from malicious browser add-ons, which he argues anti-virus vendors are ill-equipped to defend against.

The proof-of-concept Chrome, Safari and Firefox extension offers a command-and-control control panel, rootkit capabilities, the ability to steal cookies and passwords, execute JavaScript, upload and download files, and more.

Balazs is due to demonstrate how the technology works on both PCs and Android phones at the Hacker Halted conference in Miami, Florida later this week.

Balazs is also expected to demonstrate how the proof-of-concept code might be used to bypass Google's two-step verification process.

Malicious extensions can potentially pose as browser add-ons necessary to view Flash files, or use similar tricks. Conventional Trojans are often distributed using this technique (and offer the same range of potential capabilities) but hooking malware onto browsers offers a number of advantages from the perspective of a cyber-crook, as Balazs explains.

There are a lot of advantages of malicious browser extensions against traditional native malware. The command and control channel can be easily set up between the browser and the client, because the firewalls usually allow HTTPS communication between the internet and the web proxy, and the browser uses the transparent built-in authentication to the proxy.

Desktop firewalls and application white-listing won't block the traffic, because these only detect that the browser is communicating with the internet, what is usually allowed. Even if executables are blocked via web filtering, the user is able to add new extensions to the browser. The extension is cross-platform, I tested my Firefox extension on Windows 7, OSX Snow Leopard, Ubuntu 12.04, Android Gingerbread (2.3.7).

Because of the man-in-the-browser attack the passwords are readable before SSL encryption and even before any JavaScript obfuscation is done.

Virus writers have yet to develop powerful malicious extensions. The best example seen so far is the malicious Chrome add-on that posed as the Bad Piggies game but actually spammed users with dodgy ads. More than 80,000 users of the Google Chrome browser fell victim to the counterfeit Bad Piggies game, according to a post-attack analysis by security researchers from Barracuda Labs. Malicious browser extensions have also been used in isolated cases as a means to spread scams on Facebook.

It's "very possible for virus writers" to develop malicious browser extensions that pack a far more powerful punch, Balazs told El Reg. Worse still "defensive techniques are in the Stone Age," he warned.

Malicious browser extensions are easily capable of bypassing anti-virus and other defences before stealing personal and business data or monitoring online activities.

Some mitigation procedures are already in place while others need further development, according to Balazs. Browser developers should adopt an App Store-style model and deny the installation of browser add-ons obtained from outside this ecosystem by default, he says. Balazs wants to see the creation of a blacklist of rogue extensions, as an additional security defence.

Anti-virus firms need to develop a deeper insight into browser extensions. Safety-conscious surfers should avoid applying any extensions to the browser they use for their online banking transactions, as a precaution, he added. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
NASTY SSL 3.0 vuln to be revealed soon – sources (Update: It's POODLE)
So nasty no one's even whispering until patch is out
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
Forget passwords, let's use SELFIES, says Obama's cyber tsar
Michael Daniel wants to kill passwords dead
FBI boss: We don't want a backdoor, we want the front door to phones
Claims it's what the Founding Fathers would have wanted – catching killers and pedos
Kill off SSL 3.0 NOW: HTTPS savaged by vicious POODLE
Pull it out ASAP, it is SWISS CHEESE
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.