Feeds

'Looming menace' of evil browser extensions to be demo'd this week

The way you'll get pwned next

SANS - Survey on application security programs

A security researcher has developed a proof-of-concept browser botnet extension to illustrate the perils of what he describes as a "looming menace".

Zoltan Balazs of Deloitte Hungary developed the code to illustrate the risk from malicious browser add-ons, which he argues anti-virus vendors are ill-equipped to defend against.

The proof-of-concept Chrome, Safari and Firefox extension offers a command-and-control control panel, rootkit capabilities, the ability to steal cookies and passwords, execute JavaScript, upload and download files, and more.

Balazs is due to demonstrate how the technology works on both PCs and Android phones at the Hacker Halted conference in Miami, Florida later this week.

Balazs is also expected to demonstrate how the proof-of-concept code might be used to bypass Google's two-step verification process.

Malicious extensions can potentially pose as browser add-ons necessary to view Flash files, or use similar tricks. Conventional Trojans are often distributed using this technique (and offer the same range of potential capabilities) but hooking malware onto browsers offers a number of advantages from the perspective of a cyber-crook, as Balazs explains.

There are a lot of advantages of malicious browser extensions against traditional native malware. The command and control channel can be easily set up between the browser and the client, because the firewalls usually allow HTTPS communication between the internet and the web proxy, and the browser uses the transparent built-in authentication to the proxy.

Desktop firewalls and application white-listing won't block the traffic, because these only detect that the browser is communicating with the internet, what is usually allowed. Even if executables are blocked via web filtering, the user is able to add new extensions to the browser. The extension is cross-platform, I tested my Firefox extension on Windows 7, OSX Snow Leopard, Ubuntu 12.04, Android Gingerbread (2.3.7).

Because of the man-in-the-browser attack the passwords are readable before SSL encryption and even before any JavaScript obfuscation is done.

Virus writers have yet to develop powerful malicious extensions. The best example seen so far is the malicious Chrome add-on that posed as the Bad Piggies game but actually spammed users with dodgy ads. More than 80,000 users of the Google Chrome browser fell victim to the counterfeit Bad Piggies game, according to a post-attack analysis by security researchers from Barracuda Labs. Malicious browser extensions have also been used in isolated cases as a means to spread scams on Facebook.

It's "very possible for virus writers" to develop malicious browser extensions that pack a far more powerful punch, Balazs told El Reg. Worse still "defensive techniques are in the Stone Age," he warned.

Malicious browser extensions are easily capable of bypassing anti-virus and other defences before stealing personal and business data or monitoring online activities.

Some mitigation procedures are already in place while others need further development, according to Balazs. Browser developers should adopt an App Store-style model and deny the installation of browser add-ons obtained from outside this ecosystem by default, he says. Balazs wants to see the creation of a blacklist of rogue extensions, as an additional security defence.

Anti-virus firms need to develop a deeper insight into browser extensions. Safety-conscious surfers should avoid applying any extensions to the browser they use for their online banking transactions, as a precaution, he added. ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
prev story

Whitepapers

Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.