Customer Success Testimonial: Recovery is Everything

A security researcher has developed a proof-of-concept browser botnet extension to illustrate the perils of what he describes as a "looming menace".

Zoltan Balazs of Deloitte Hungary developed the code to illustrate the risk from malicious browser add-ons, which he argues anti-virus vendors are ill-equipped to defend against.

Balazs is due to demonstrate how the technology works on both PCs and Android phones at the Hacker Halted conference in Miami, Florida later this week.

Balazs is also expected to demonstrate how the proof-of-concept code might be used to bypass Google's two-step verification process.

Malicious extensions can potentially pose as browser add-ons necessary to view Flash files, or use similar tricks. Conventional Trojans are often distributed using this technique (and offer the same range of potential capabilities) but hooking malware onto browsers offers a number of advantages from the perspective of a cyber-crook, as Balazs explains.

There are a lot of advantages of malicious browser extensions against traditional native malware. The command and control channel can be easily set up between the browser and the client, because the firewalls usually allow HTTPS communication between the internet and the web proxy, and the browser uses the transparent built-in authentication to the proxy.

Desktop firewalls and application white-listing won't block the traffic, because these only detect that the browser is communicating with the internet, what is usually allowed. Even if executables are blocked via web filtering, the user is able to add new extensions to the browser. The extension is cross-platform, I tested my Firefox extension on Windows 7, OSX Snow Leopard, Ubuntu 12.04, Android Gingerbread (2.3.7).

Because of the man-in-the-browser attack the passwords are readable before SSL encryption and even before any JavaScript obfuscation is done.

Virus writers have yet to develop powerful malicious extensions. The best example seen so far is the malicious Chrome add-on that posed as the Bad Piggies game but actually spammed users with dodgy ads. More than 80,000 users of the Google Chrome browser fell victim to the counterfeit Bad Piggies game, according to a post-attack analysis by security researchers from Barracuda Labs. Malicious browser extensions have also been used in isolated cases as a means to spread scams on Facebook.

It's "very possible for virus writers" to develop malicious browser extensions that pack a far more powerful punch, Balazs told El Reg. Worse still "defensive techniques are in the Stone Age," he warned.

Malicious browser extensions are easily capable of bypassing anti-virus and other defences before stealing personal and business data or monitoring online activities.

Some mitigation procedures are already in place while others need further development, according to Balazs. Browser developers should adopt an App Store-style model and deny the installation of browser add-ons obtained from outside this ecosystem by default, he says. Balazs wants to see the creation of a blacklist of rogue extensions, as an additional security defence.

Anti-virus firms need to develop a deeper insight into browser extensions. Safety-conscious surfers should avoid applying any extensions to the browser they use for their online banking transactions, as a precaution, he added. ®

Ensure Ease of Recovery with Asigra’s Agentless Software