Popular Chrome VPN extension caught secretly spying on users — uninstall it right now
As reported by Cybernews, researchers at Koi Security recently put out a report detailing their findings on the extension complete with a timeline that showed how it has shifted to spying on its users instead of protecting their privacy. This was done by taking screenshots of their displays and sending this data back to remote servers. When a webpage is loading, the extension will grab a screenshot in the background and then send it back to a server with additional details like the URL, tab ID number and a unique user identifier.
The report points out how screenshots can include sensitive and personal information like passwords, personal messages and banking details; sending these images to a third-party server is the exact opposite of what a privacy tool like a VPN is supposed to do for its users.
Additionally, the extension now collects and transmits other sensitive information like IP geolocation, device information and sends it encoded in Base64, or via AES-256-GCM encryption with an RSA key which hides the data in transit.
One of the features of the extension is 'Scan with AI Threat Detection' which is intended to upload screenshots and URLs when the user clicks a 'check URL' button, however, there is no indication to the user that the extension has been repeatedly grabbing screenshots in the background even when this feature is not being used.
These suspicious features were added recently and went live on July 17 of this year, which was right before strict age verification rules went into effect in the U.K.; many people in that area would be searching for VPNs after the rules went into place as a workaround.
VPN extensions need some permissions to operate on a user's system – usually proxy and storage permissions. However, FreeVPN.One required suspiciously more access including all URLs, tabs and scripting permissions. The researchers at Koi Security pointed out that this, in addition to the other issues the extension exhibited, opened the door to persistent surveillance of its users.
A developer is not named in either the privacy policy or the Terms of Service on the FreeVPN.One website, and their explanations to the security researchers about their findings do not match. According to the researchers: 'The [developer] explained that the automatic screenshot capture is part of a Background Scanning feature, which should only trigger if a domain appears suspicious. In practice, we saw screenshots being captured on trusted services like Google Sheets and Google Photos, domains that cannot be considered suspicious' and the developer ceased communications when asked to provide proof of legitimacy.
If you've installed this VPN extension, you should uninstall it and run a scan using one of the best antivirus software solutions. Likewise, you're going to want to check your browser extensions to ensure that it's removed and then check your screenshots folder as well.
Follow Tom's Guide on Google News to get our up-to-date news, how-tos, and reviews in your feeds. Make sure to click the Follow button.
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
Engadget
5 hours ago
- Engadget
Nonprofit search engine Ecosia offers $0 for control of Chrome
Germany-based search engine and browser nonprofit Ecosia is the latest party to make an offer for Google's Chrome. Questions about Chrome's fate have been swirling since the news that the Department of Justice would push for Google to sell the browser after the ruling that the company's search engine business constituted a monopoly. Although Google is planning to appeal the decision, that hasn't stopped other big tech businesses from pitching themselves as potential owners of Chrome. Ecosia's proposal is different. Rather than selling off the valuable browser for an upfront windfall, this plan would see Google transforming Chrome into a foundation. Ecosia would assume operational responsibility for the browser for ten years, but Google would retain the ownership and intellectual property rights. Under the arrangement, Ecosia would devote about 60 percent of Chrome's profits toward climate and environmental projects. It wouldn't pay a cent upfront for the stewardship role, but the remaining 40 percent of Chrome's profits would be given back to Google. Considering Ecosia is projecting Chrome to generate $1 trillion over the next decade, that's no small potatoes. On the surface, this idea is pretty far-out. However, going the stewardship route would deepen an existing relationship between Google and Ecosia. Google already powers the environmentally-focused benefit corporation's search engine, and the two parties have an established revenue-sharing agreement. Putting Chrome in the hands of a nonprofit rather than a for-profit rival may actually be a positive for Google, both financially and in public opinion.
Tom's Guide
a day ago
- Tom's Guide
Popular Chrome VPN extension caught secretly spying on users — uninstall it right now
A VPN is a common and recommended privacy tool when going online which is why many people download them as either apps for their computer or smartphone or as extensions for their browser of choice. However, not every VPN is trustworthy or even remains that way. Case in point, is a Chrome extension with 100,000 installs, a 3.8 star rating and even a verified badge. However, several recent updates have changed the status of the extension from safe to very suspicious. As reported by Cybernews, researchers at Koi Security recently put out a report detailing their findings on the extension complete with a timeline that showed how it has shifted to spying on its users instead of protecting their privacy. This was done by taking screenshots of their displays and sending this data back to remote servers. When a webpage is loading, the extension will grab a screenshot in the background and then send it back to a server with additional details like the URL, tab ID number and a unique user identifier. The report points out how screenshots can include sensitive and personal information like passwords, personal messages and banking details; sending these images to a third-party server is the exact opposite of what a privacy tool like a VPN is supposed to do for its users. Additionally, the extension now collects and transmits other sensitive information like IP geolocation, device information and sends it encoded in Base64, or via AES-256-GCM encryption with an RSA key which hides the data in transit. One of the features of the extension is 'Scan with AI Threat Detection' which is intended to upload screenshots and URLs when the user clicks a 'check URL' button, however, there is no indication to the user that the extension has been repeatedly grabbing screenshots in the background even when this feature is not being used. These suspicious features were added recently and went live on July 17 of this year, which was right before strict age verification rules went into effect in the U.K.; many people in that area would be searching for VPNs after the rules went into place as a workaround. VPN extensions need some permissions to operate on a user's system – usually proxy and storage permissions. However, required suspiciously more access including all URLs, tabs and scripting permissions. The researchers at Koi Security pointed out that this, in addition to the other issues the extension exhibited, opened the door to persistent surveillance of its users. A developer is not named in either the privacy policy or the Terms of Service on the website, and their explanations to the security researchers about their findings do not match. According to the researchers: 'The [developer] explained that the automatic screenshot capture is part of a Background Scanning feature, which should only trigger if a domain appears suspicious. In practice, we saw screenshots being captured on trusted services like Google Sheets and Google Photos, domains that cannot be considered suspicious' and the developer ceased communications when asked to provide proof of legitimacy. If you've installed this VPN extension, you should uninstall it and run a scan using one of the best antivirus software solutions. Likewise, you're going to want to check your browser extensions to ensure that it's removed and then check your screenshots folder as well. Follow Tom's Guide on Google News to get our up-to-date news, how-tos, and reviews in your feeds. Make sure to click the Follow button.
Yahoo
a day ago
- Yahoo
New zero-day startup offers $20 million for tools that can hack any smartphone
A new United Arab Emirates-based startup is offering up to $20 million for hacking tools that could help governments break into any smartphone with a text message. Advanced Security Solutions launched this month and is now offering some of the highest prices, at least public ones, in the whole zero-day market. Zero-days are flaws in software that are unknown to the affected developer at the time of their discovery. These tools can be highly valuable for hackers, especially those working for law enforcement and intelligence agencies. Apart from the highest bounty of $20 million, which applies to any mobile operating system, the company also offers bounties for exploits in various software: $15 million for the same type of zero-days for Android devices and for iPhones; $10 million for Windows; $5 million for Chrome; $1 million for Apple's Safari and Microsoft Edge browsers, among others. It's unclear who is behind the company, and its customers. 'We empower government agencies, intelligence services, and law enforcement to operate with precision in the digital battlefield,' reads the company's website. 'We maintain continuous cooperation with over 25 governments and intelligence agencies worldwide. Our clients consistently return for new services, reflecting the trust and strategic value we provide in high-stakes operational contexts, including counterterrorism and narcotics control.' The website also says that while the company is new, 'it is staffed exclusively by professionals with over 20 years of operational experience in elite intelligence units and private military contractors.' Advanced Security Solutions did not respond to a series of questions, including who funds, owns, and runs the company, who the customers are, as well as whether the company has any self-imposed ethical, or legal restrictions on what governments to sell to. Do you have more information about Advanced Security Solutions, or other zero-day providers? From a non-work device, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram and Keybase @lorenzofb, or email. You also can contact TechCrunch via SecureDrop. A security researcher with experience in the world of zero-days told TechCrunch that the prices offered by Advanced Security Solutions are approximately in line with the current market. 'Normally these advertised prices are in the ball park,' the person told TechCrunch on the condition of anonymity to speak candidly about the zero-day industry. The person added that the $20 million bounty 'is low depending on how unscrupulous you are.' The researcher also warned that, personally, he wouldn't deal with a company that doesn't disclose who is behind it, such as in this case. 'I don't think you should sell bugs to anyone who's trying to hide who they are,' he said. The market for zero-days has expanded considerably in the last ten years, both in terms of the number of companies participating in it, as well as the prices offered. In 2015, Zerodium, a broker that much like Advanced Security Solutions also acquires zero-days from researchers and resells them to governments, was among the first-ever companies to publicize their price list. At the time, the company founded by veteran exploit broker Chaouki Bekrar offered up to $1 million for tools to hack iPhones. Then, three years later, came Crowdfense offering $3 million for the same type of zero-days. More recently, the prices of zero-days have skyrocketed, in part because there is higher demand and also because it's getting more difficult to hack modern devices and software, thanks to big tech companies improving their security. Last year, Crowdfense published its new price list, which offered up to $7 million for zero-days to break into iPhones, and $5 million for the same type of exploits for Android. Customers can also buy zero-days for specific apps, especially messaging apps like WhatsApp (up to $8 million), and Telegram (up to $4 million). For its part, Advanced Security Solutions says it offers $2 million for Telegram, Signal, and WhatsApp zero-days. Russian zero-day company Operation Zero was an outlier in the market, offering up to $20 million for the same type of exploits that Advanced Security Solutions is looking for. Operation Zero is in a unique position because it says it works only with the Russian government, and for many researchers in the U.S. and Europe, it's illegal to sell their hacking tools to Russia, which means Operation Zero may have a harder time finding what it looks for. Error in retrieving data Sign in to access your portfolio Error in retrieving data Error in retrieving data Error in retrieving data Error in retrieving data
