2 days ago
Delete All Google Chrome Extensions That Are On This List
Delete this threat immediately.
NurPhoto via Getty Images
Chrome warnings are again in the news this week, with Google confirming active attacks and issuing an emergency update for 3 billion users. The company also confirmed it had mitigated this threat by silently pushing out a config change to all users last week.
Now a new warning from the team at LayerX has outed a silent threat of a very different kind. A 'network of malicious sleeper agent extensions" that seem 'to have all been developed by the same person or group, waiting for their 'marching order' to execute malicious code on unsuspecting users' computers.'
LayerX joined the dots and flagged these specific extensions based on common code patterns, the same remote code execution to frustrate detection, and leveraging known malicious domains to carry out attacks. 'Capabilities that do not appear to have any legitimate use in relation to the supposed function of the extensions.'
Thus far, four extensions have made this new naughty list — all of which 'seem to be focused on in-browser sound management' and all of which 'try to demonstrate legitimate functionality.' Critically, LayerX also warns that it is 'currently investigating several additional extensions that appear to be linked to this campaign.'
This is the initial list of extensions to delete:
As with other extension warnings seen in recent months, all those flagged by LayerX 'are still currently available on the Chrome Store.' I have reached out to Google for its view on these extensions and whether they will remain available on its store.
It seems at least some of the extensions should have been removed already — clearly a requirement for tighter restrictions before extensions are made available to users. 'The extension 'Examine source code of Volume Max — Ultimate Sound Booster', with over one million downloads, has already been flagged by several [security] vendors. However, it was not removed from the Chrome Web Store.'
While you should delete these extensions, they have been dubbed 'sleepers' because no malicious activity is yet underway. This is the threat potential given commonalities despite seemingly different developers, and those links to malicious domains.
'This type of 'sleeper' extension network,' LayerX warns, 'can serve as a substitute for traditional botnets. While building up botnets (usually on exposed IoT devices) can be slow, technically complex, and cumbersome, developing a network of malicious browser extensions is much simpler, and can provide direct access to key user identity information such as cookies, passwords, browsing data, and browsing content.'
As users have been warned multiple times recently, extensions are a huge vulnerability when it comes to Chrome. A vast number of its users install at least one extension, both at home and at work, yet 'anyone can upload an extension, and it's virtually impossible to trace back the people behind these extensions.'
