• Trend Micro
  • About TrendLabs Security Intelligence Blog
Search:
  • Home
  • Categories
    • Ransomware
    • Vulnerabilities
    • Exploits
    • Targeted Attacks
    • Deep Web
    • Mobile
    • Internet of Things
    • Malware
    • Bad Sites
    • Spam
    • Botnets
    • Social
    • Open source
Home   »   Malware   »   Malware Bypasses Chrome Extension Security Feature

Malware Bypasses Chrome Extension Security Feature

  • Posted on:September 4, 2014 at 10:12 am
  • Posted in:Malware
  • Author:
    Sylvia Lascano (Fraud Analyst)
0

Originally created to extend a browser’s functionality, browser extensions have become yet another tool for cybercriminals’ schemes. Earlier this year, Google has addressed the issue of malicious browser extensions by enforcing a policy that only allows installations if the extensions are hosted in the Chrome Web Store.

While this policy can provide more security for users, it hasn’t completely deterred cybercriminals from attempting to bypass such a feature. We recently came across malware that manages to install an extension on Google Chrome.

“Facebook Secrets” on Twitter

We came across one particular post on Twitter that advertises “Facebook Secrets,” along with a shortened link. Clicking the link leads the user to a site that automatically downloads an .EXE file into the user’s system.


Figure 1. Tweet with malicious link

This downloaded file, download-video.exe, is actually a downloader malware, which we detect as TROJ_DLOADE.DND. This starts a chain of downloaded and dropped files into the system. In order to avoid suspicion, these files use legitimate-sounding file names like flash.exe.

Installing Browser Extensions

Aside from the downloaded and dropped files, a browser extension is also installed into the system. It pretends to be a Flash Player extension.


Figure 2. Fake Flash Player extension

In order to bypass Google’s security policy, the malware will create a folder in Google Chrome’s directory where it will be drop browser extension components:

  • manifest.json – contains browser extension description (name, script to load, version, etc.)
  • crx-to-exe-convert.txt– contains the script to be loaded, which can be updated anytime by connecting to a specific URL

For the browser extension to work, the browser will then parse the information in the dropped component manifest.json.


Figure 3. Extension folder before the malware performs its routine


Figure 4. The created folder and dropped extension components

Should the user open Facebook or Twitter, the extension opens a specific site in the background. The site is written in Turkish and phrases such as “bitter words,” “heavy lyrics,” “meaningful lyrics,” “love messages,” and “love lyrics” appear on the page. This routine could be a part of a click fraud or redirection scheme.


Figure 3. Turkish site

Countermeasures

Social media has become a commonly used social engineering lure. However, this type frequency hasn’t made it any less effective. For example, the tweet had been retweeted more than 6,000 times when we came across it. This means that this scheme has been making rounds in Twitter, casting a wide net of potential victims. We advise users to avoid clicking shortened links, especially those advertised in social media. Cybercriminals will do just about anything to convince users to click links.

We also advise users to install browser extensions from official and reputable sources. While Chrome may have some security measures, the same cannot be guaranteed for other browsers.

With additional insights from Rhena Inocencio and Adrian Conferos.

Related posts:

  • FacexWorm Targets Cryptocurrency Trading Platforms, Abuses Facebook Messenger for Propagation
Learn how to protect Enterprises, Small Businesses, and Home Users from ransomware:
ENTERPRISE »
SMALL BUSINESS»
HOME»
Tags: browser extensionFacebooksocial engineeringsocial mediaTwitter

Featured Stories

  • systemd Vulnerability Leads to Denial of Service on Linux
  • qkG Filecoder: Self-Replicating, Document-Encrypting Ransomware
  • Mitigating CVE-2017-5689, an Intel Management Engine Vulnerability
  • A Closer Look at North Korea’s Internet
  • From Cybercrime to Cyberpropaganda

Security Predictions for 2019

  • Our security predictions for 2019 are based on our experts’ analysis of the progress of current and emerging technologies, user behavior, and market trends, and their impact on the threat landscape. We have categorized them according to the main areas that are likely to be affected, given the sprawling nature of the technological and sociopolitical changes under consideration.
    Read our security predictions for 2019.

Business Process Compromise

  • Attackers are starting to invest in long-term operations that target specific processes enterprises rely on. They scout for vulnerable practices, susceptible systems and operational loopholes that they can leverage or abuse. To learn more, read our Security 101: Business Process Compromise.

Recent Posts

  • February Patch Tuesday: Batch Includes 77 Updates That Cover Flaws in Internet Explorer, Exchange Server, and DHCP Server
  • Trickbot Adds Remote Application Credential-Grabbing Capabilities to Its Repertoire
  • Windows App Runs on Mac, Downloads Info Stealer and Adware
  • Linux Coin Miner Copied Scripts From KORKERDS, Removes All Other Malware and Miners
  • Various Google Play ‘Beauty Camera’ Apps Send Users Pornographic Content, Redirect Them to Phishing Websites and Collect Their Pictures

Popular Posts

  • Going In-depth with Emotet: Multilayer Operating Mechanisms
  • February Patch Tuesday: Batch Includes 77 Updates That Cover Flaws in Internet Explorer, Exchange Server, and DHCP Server
  • Various Google Play ‘Beauty Camera’ Apps Send Users Pornographic Content, Redirect Them to Phishing Websites and Collect Their Pictures
  • Linux Coin Miner Copied Scripts From KORKERDS, Removes All Other Malware and Miners
  • Trickbot Adds Remote Application Credential-Grabbing Capabilities to Its Repertoire

Stay Updated

  • Home and Home Office
  • |
  • For Business
  • |
  • Security Intelligence
  • |
  • About Trend Micro
  • Asia Pacific Region (APAC): Australia / New Zealand, 中国, 日本, 대한민국, 台灣
  • Latin America Region (LAR): Brasil, México
  • North America Region (NABU): United States, Canada
  • Europe, Middle East, & Africa Region (EMEA): France, Deutschland / Österreich / Schweiz, Italia, Россия, España, United Kingdom / Ireland
  • Privacy Statement
  • Legal Policies
  • Copyright © Trend Micro Incorporated. All rights reserved.