Millions of Chrome Users Have Installed Malware Posing as Ad Blockers (vice.com) 42
Kaleigh Rogers, writing for Motherboard: Andrey Meshkov, the cofounder of ad-blocker AdGuard, recently got curious about the number of knock-off ad blocking extensions available for Google's popular browser Chrome. These extensions were deliberately styled to look like legitimate, well-known ad blockers, but Meshkov wondered why they existed at all, so he downloaded one and took a look at the code. "Basically I downloaded it and checked what requests the extension was making," Meshkov told me over the phone. "Some strange requests caught my attention."
Meshkov discovered that the AdRemover extension for Chrome -- which had over 10 million users -- had code hidden inside an image that was loaded from the remote command server, giving the extension creator the ability to change its functions without updating. This alone is against Google's policy, and after Meshkov wrote about a few examples on AdGuard's blog, many of which had millions of downloads, Chrome removed the extensions from the store. I reached out to Google, and a spokesperson confirmed that these extensions had been removed.
Meshkov discovered that the AdRemover extension for Chrome -- which had over 10 million users -- had code hidden inside an image that was loaded from the remote command server, giving the extension creator the ability to change its functions without updating. This alone is against Google's policy, and after Meshkov wrote about a few examples on AdGuard's blog, many of which had millions of downloads, Chrome removed the extensions from the store. I reached out to Google, and a spokesperson confirmed that these extensions had been removed.
The wise... (Score:1)
...verify the legitimacy of the source.
The sort of logical mindset that one needs to keep one's self safe on the Internet is not universal. Many people are born without it. They may have other skills that are valuable, but the days in which they could thrive without logical clarity are vanishing into the past.
There will be pain....but ultimately those with keen minds will have enough of a survival advantage over the rest, that natural selection will get us where we need to be.
Eventually.
Re: (Score:1)
Keeps the Slashdot Spam in check. (TM)
Re:The wise... (Score:5, Funny)
Hallowed are the Ori.
Re: (Score:2)
Purge the ads in holy fire? I can get behind that.
2018, people are still dumb (Score:2)
Most of these extensions have nothing but an anonymous internet email behind them and yet people and computer geeks install them and literally give admin access to their computer to strangers
Re:2018, people are still dumb (Score:5, Insightful)
This has been in my Sig for years now.
Laws of computer stupidity
1) 99% of computer users do not know what they are doing.
2) Computer users do not read.
3) If a computer user can click on it, they will. If they need to click on it, they won't
4) You can patch software, but you can't (legally) patch stupid.
And It will still be relevant decades from now, Especially since I can do a search for adblock plus right now on the chrome web store and pick out 20+ fake apps in 5 seconds.
Irony (Score:3)
So people get Chrome because its "fast and safe". They trust this company who loves to siphon all the public's data. That same public then wants to avoid the obnoxious advertisements pushed by Google, and get malware... from a site managed by Google.
You'd think Google would get the picture and provide some sort of built-in ad management/protection in Chrome. With millions of downloads it's pretty obvious what people want. So why haven't they done a built-in ad-block?
Re:Irony (Score:5, Insightful)
You'd think Google would get the picture and provide some sort of built-in ad management/protection in Chrome.
An advertising company blocking competing ads would likely attract plenty of attention from anti-trust authorities.
Re: (Score:2)
You'd think Google would get the picture and provide some sort of built-in ad management/protection in Chrome.
An advertising company blocking competing ads would likely attract plenty of attention from anti-trust authorities.
Yes.
But more importantly, Google is NOT a tech company. Google is an advertising company.
google should know better (Score:3)
Re: (Score:2)
Re: (Score:2)
Please don't retire into Forrest Gump. He deserves better!
Re: (Score:2)
Re: (Score:2)
they should keep a close eye on all the extensions and plugins and themes and whatever else third party things go in to not only chrome, but also google play store, they should all be audited as they are upload and before allowed downloading by the general public, things like this malicious extension is a BIG BLACK EYE for google
You think Google has time to audit every line of source code for an application that goes into the app store, even if they could? They have a policy, they look out for gross violations but trojans hide their shit and try not to trigger flags in review processes, to anti-virus, when running in sandboxes etc. so of course crap will get through. I think you have an unrealistic standard that an app store will insulate you from all outside malice. Heck, even in open source somebody can manage to slip in some und
Re: (Score:1)
>You think Google has time to audit every line of source code for an application that goes into the app store, even if they could?
Sure. Google sponsors Project Zero, whose team of security experts find zero days exploits in products that they don't even have the source code for. A number of other "googlers" have discovered vulnerabilities in many non-google products as well https://www.google.com/about/appsecurity/research/ [google.com]. Why not hire some devs to do some testing of extensions that they offering throu
Re: (Score:2)
>You think Google has time to audit every line of source code for an application that goes into the app store, even if they could?
Sure. Google sponsors Project Zero, whose team of security experts find zero days exploits in products that they don't even have the source code for. A number of other "googlers" have discovered vulnerabilities in many non-google products as well https://www.google.com/about/appsecurity/research/ [google.com]. Why not hire some devs to do some testing of extensions that they offering through their store? Google can afford it.
Exactly.
Google has the resources. There is ZERO excuse for malware or any mis-behaving programs making it into an official Google-run app sore. Zero Excuses.
Re: (Score:2)
You install an extension that was provided by a third party. That's a risk you choose to take. If Google has to choose between vetting every extension or getting rid of third party extensions which do you think will happen?
Re: (Score:2)
Re: (Score:2)
And I'll bet it was re-uploaded under a slightly different name 5 minutes later.
"Google -- Because Fuck You, that's why."
Reached out? (Score:4, Insightful)
This kind of corporate jargon gets right up my nose. She didn't reach out to google, she contacted them. Reached out is such an over emotively laden phrase for "Emailed" or "Phoned" or "Visited reception and was escorted out the building".
Stop using it!