Chrome extensions are 'the new rootkit' say researchers linking surveillance campaign to Israeli registrar Galcomm

Researchers at Awake Security have published a report on malicious extensions in the Chrome web store, making both specific claims of over 32 million downloads of one malware family, and general claims of weak security in both domain registration and Google's store. The researchers said they have been tracking a "massive …

[TeeCee]

Maturity.

Once upon a time, all your work was done with applications running on an O/S. Many times it was found that weaknesses in the O/S permitted the underhand installation of nasty things that could compromise your applications. Over many years O/S security was improved until such things became, largely, a thing of the past.

Then we moved all your work into the browser...(!)

Rinse, repeat ad nauseum.

See also: Failing to learn from your own mistakes / Who could possibly have seen that coming? / etc.

[Anonymous Coward]

Re: Maturity.

The quote you wanted: "Only a fool learns from his own mistakes. The wise man learns from the mistakes of others."

[Anonymous Coward]

Re: Maturity.

Then what do you call a person who doesn't learn from ANY mistakes: his own or others?

[JimboSmith]

Re: Maturity.

Then what do you call a person who doesn't learn from ANY mistakes: his own or others?

Trump?

[Charles 9]

Re: Maturity.

Still, it springs to mind the old "give a man a fish" proverb. Problem becomes, how do you teach a man to fish when that man is THAT stupid, as in "teach this man to fish, he'll starve to death on the pier a month later with the rod still in his hands"?

[Anonymous Coward]

Re: Maturity.

A Party

[Potemkine!]

Hegelian World

Hegel told us two centuries ago that "the only thing we learn from History is that we do not learn from History". This is also true for IT

[big_D]

Re: Maturity.

99% of our work is still on local applications.

[Anonymous Coward]

"things like signs of uploads going to rare or known bad destinations"

«The story begins with some heuristic malware detection by Awake, looking for things like signs of uploads going to rare or known bad destinations. This led them to a bunch of malicious browser extensions, 111 in total, which "were found to upload sensitive data or not perform the task they're advertised to perform (generally, they surveil user activity and device properties."»

Hang on, that's just a description of Google Chrome itself… :-P

[Anonymous Coward]

Wot! Someone other than Google spying on Chrome Users?

Shirley... that can't be true.

Good job that Chrome is banned in my home as are some 300+ Google owned domains.

Posting AC for obvious reasons.

[Jurassic Hermit]

Which Extensions?

Does anyone have a list of the 111 extensions? The report only lists an ID number which means nothing to most of us.

Thanks in advance.

[Anonymous Coward]

Random?

I like how the random sponsored link at the end of the article was (for me) "How to Thrive in the Digital Economy". I read it as "how to thieve".

That is all.

[Anonymous Coward]

Typical behaviour from israel

[Anonymous Coward]

Allegedly the best spies in the world.

[NetBlackOps]

Being surrounded by enemies breeds excellant spies, e.g. Poland and a certain Enigma device.

[Tom 7]

Alfred the Great was surrounded by enemies so he made them his friends.

[Anonymous Coward]

parked domains

"From those that are with Galcomm, almost all are parked domains, mostly with the largest domain parking companies worldwide."

Moshe may be on to something here.

Read this article that explains about more malicious toolbars that direct users to parking domains that bypass adblock to run the RIG exploit:

https://threatpost.com/malvertising-ad-blockers-mac-malware/146861/

I am not defending Galcomm here because I know from experience how futile it is when trying to report malious sites.

(Most all the malicious sites I have tracked lead to GoDaddy or NAMECHEAP and ocassionally OVH)

[chivo243]

Timely report

I've been trying to get my shop to manage our users extensions, it has had a bit of push back. However we have found that bad extensions are 99% of the problem with Google Meet and Google apps. I know some colleagues read El Reg, this report will catch their eye. Maybe we can move forward now.

[Roland6]

Re: Timely report

Yandex has been surprisingly quiet about what it has been up to...

Back in 2015 Yandex brought out Agnitum with the intention of integrating the Agnitum security software into the Yandex browser.

[IGotOut]

Phew..

...thank goodness Google would do anything as stupid as trying to hide installed extensions.

[sitta_europea]

I once tried to get both ICANN and Nominet interested enough in the criminal activities which they facilitate to do something about it.

What a waste of time that was.

[USER100]

Stop the press

Surveillance campaign linked to Israelis...

In other news, 'Bears Defecate In Woods', 'Pope is Catholic'

Plus shocking expose: 'Earth Is Not Flat!'

[Michael Habel]

Re: Stop the press

Plus shocking expose: 'Earth Is Not Flat!'

Yeah really, go pull the other one. Next you'll try and, tell us that, they sent men to the Moon some 50 long years ago. When we are still incapable of breakikng free form low earth orbit.

[docogih272]

PiHole Galcomm Blocklist

I made thread. https://www.reddit.com/r/pihole/comments/hbrvx0/galcomm_israeli_isp_spying_blocklist_request/

[YetAnotherJoeBlow]

ahem...

I know some guys that - lets just say they are very flexible on who they work with - tell me that it has never been easier to pwn networks, phones, IOT, or any endpoints for that matter. While I work in embedded and know what a crap shoot it is, if people actually saw what these guys do, they would never bank or pay with a phone. I don;t. Once they have your phone, they are into everything you are into. The sky isn't falling, it already fell.

[amanfromMars 1]

From Acorns do Great Oaks Grow

Rogue access to the browser therefore frequently means rogue access to the 'keys to the kingdom'

Oh please, don't be so diffident. Rogue access to the browser always means rogue access to the 'keys to the kingdom'.

The abiding crushing problem to resolve and address though is what to do better with the information phished once the riches revealed are accessible and vulnerable to disappearance/export and import to elsewhere.

[Potemkine!]

Awake said its threat researchers "made several attempts to contact Galcomm by phone, email (abuse@, security@, and support@), and the contact form on their website

Moreover, Awake have not even asked for our quote or response on that issue before publishing a report. I got the domains in question via a third party who was asking me about this.

So El Reg, who is the liar?

[Dave314159ggggdffsdds]

Hmm, let me see, could it be the 'researchers' spreading old fashioned antisemitic conspiracy theories?

This is some nasty shit for the reg to be publishing.

[amanfromMars 1]

Pot Kettle Black Calling ....

Hmm, let me see, could it be the 'researchers' spreading old fashioned antisemitic conspiracy theories?

This is some nasty shit for the reg to be publishing. ...... Dave314159ggggdffsdds

Crikey, Dave314159ggggdffsdds, that seems more like your forte. Count yourself lucky El Reg don't think it so.

[Dave314159ggggdffsdds]

Re: Pot Kettle Black Calling ....

Have a look at the comments here. The dog whistles were heard by the antisemites, who have piled on.

[wolfetone]

Ah, those Israelis. Up to no good as usual.

[J. R. Hartley]

Scum of the earth a chara

[Anonymous Coward]

Please include Chromium's builtin PDF viewer

I've been having some trouble with my home machine running slowly (mostly it's just old). Chromium especially crawls in certain cases, even with Adblock Plus on and running. Checked Chromium's task manager, and found two entries with the names of advertising sites listed under the PDF viewer! I did have one PDF open, but that shouldn't allow connections to sites that Adblock Plus should be blocking. Disabled the built-in viewer, and that seems to have solved that. (But still slow. Alas.)