Feeds

'Looming menace' of evil browser extensions to be demo'd this week

The way you'll get pwned next

Secure remote control for conventional and virtual desktops

A security researcher has developed a proof-of-concept browser botnet extension to illustrate the perils of what he describes as a "looming menace".

Zoltan Balazs of Deloitte Hungary developed the code to illustrate the risk from malicious browser add-ons, which he argues anti-virus vendors are ill-equipped to defend against.

The proof-of-concept Chrome, Safari and Firefox extension offers a command-and-control control panel, rootkit capabilities, the ability to steal cookies and passwords, execute JavaScript, upload and download files, and more.

Balazs is due to demonstrate how the technology works on both PCs and Android phones at the Hacker Halted conference in Miami, Florida later this week.

Balazs is also expected to demonstrate how the proof-of-concept code might be used to bypass Google's two-step verification process.

Malicious extensions can potentially pose as browser add-ons necessary to view Flash files, or use similar tricks. Conventional Trojans are often distributed using this technique (and offer the same range of potential capabilities) but hooking malware onto browsers offers a number of advantages from the perspective of a cyber-crook, as Balazs explains.

There are a lot of advantages of malicious browser extensions against traditional native malware. The command and control channel can be easily set up between the browser and the client, because the firewalls usually allow HTTPS communication between the internet and the web proxy, and the browser uses the transparent built-in authentication to the proxy.

Desktop firewalls and application white-listing won't block the traffic, because these only detect that the browser is communicating with the internet, what is usually allowed. Even if executables are blocked via web filtering, the user is able to add new extensions to the browser. The extension is cross-platform, I tested my Firefox extension on Windows 7, OSX Snow Leopard, Ubuntu 12.04, Android Gingerbread (2.3.7).

Because of the man-in-the-browser attack the passwords are readable before SSL encryption and even before any JavaScript obfuscation is done.

Virus writers have yet to develop powerful malicious extensions. The best example seen so far is the malicious Chrome add-on that posed as the Bad Piggies game but actually spammed users with dodgy ads. More than 80,000 users of the Google Chrome browser fell victim to the counterfeit Bad Piggies game, according to a post-attack analysis by security researchers from Barracuda Labs. Malicious browser extensions have also been used in isolated cases as a means to spread scams on Facebook.

It's "very possible for virus writers" to develop malicious browser extensions that pack a far more powerful punch, Balazs told El Reg. Worse still "defensive techniques are in the Stone Age," he warned.

Malicious browser extensions are easily capable of bypassing anti-virus and other defences before stealing personal and business data or monitoring online activities.

Some mitigation procedures are already in place while others need further development, according to Balazs. Browser developers should adopt an App Store-style model and deny the installation of browser add-ons obtained from outside this ecosystem by default, he says. Balazs wants to see the creation of a blacklist of rogue extensions, as an additional security defence.

Anti-virus firms need to develop a deeper insight into browser extensions. Safety-conscious surfers should avoid applying any extensions to the browser they use for their online banking transactions, as a precaution, he added. ®

Intelligent flash storage arrays

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Home Office: Fancy flogging us some SECRET SPY GEAR?
If you do, tell NOBODY what it's for or how it works
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Syrian Electronic Army in news site 'hack' POP-UP MAYHEM
Gigya redirect exploit blamed for pop-rageous ploy
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
prev story

Whitepapers

Free virtual appliance for wire data analytics
The ExtraHop Discovery Edition is a free virtual appliance will help you to discover the performance of your applications across the network, web, VDI, database, and storage tiers.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Business security measures using SSL
Examines the major types of threats to information security that businesses face today and the techniques for mitigating those threats.