The extensions subscribe to events triggered when the user accesses a new URL in a tab, so they can send tracking data to the creator’s server (at ), which checks if the user navigates to a site for which an affiliate ID exists.īased on the response received from the server, the extension can inject into the website a URL as an iframe and a cookie containing the affiliate ID of the extension developer, who receives a commission for any purchase the user makes on the target website.Īccording to McAfee, this mechanism essentially allows the extensions to “add any cookie to any website”, as they had permissions to do so. McAfee’s analysis of the extensions has revealed that the user tracking and code injection behavior resides in a script named ‘b0.js’, which contains many other functions as well. The five malicious extensions help users watch Netflix shows together (Netflix Party and Netflix Party 2, with a combined install base of 1.1 million), enable them to track online prices and coupons (FlipShope – Price Tracker Extension and AutoBuy Flash Sales, with 100,000 installs), and capture screenshots (Full Page Screenshot Capture – Screenshotting, with 200,000 installs).
With a total install base of over 1.4 million, the extensions can modify cookies on ecommerce websites so that their creator receives affiliate payments for the purchased items, without the victim’s knowledge. If you're concerned about your security online while working from home (opens in new tab), enabling Safe Browsing or Enhanced Safe Browsing is quite simple and can be done by opening Chrome's settings and heading to the Security menu.Ndpoint security company McAfee warns of five malicious Chrome extensions designed to track users’ browsing activity and inject code into ecommerce platforms. Google Safe Browsing will then scan the file using static and dynamic analysis classifiers in real time and after a short wait, Chrome will display another warning if Safe Browsing determines the file to be unsafe. For downloads that have been deemed risky but are not unsafe, Enhanced Safe Browsing users will now see a warning and will also be able to send the file to Google (opens in new tab) for additional scanning. When a user downloads a file, Chrome will perform a first level check using metadata about the downloaded file including information on its contents and the source of the file to determine whether it is suspicious.
In addition to protecting users from untrusted extensions, Chrome's Enhanced Safe Browsing feature will also provide them with better protection against risky files.
0 kommentar(er)
