Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
Chrome Google Privacy Security

Millions of Chrome Users Have Installed Malware Posing as Ad Blockers (vice.com) 42

Kaleigh Rogers, writing for Motherboard: Andrey Meshkov, the cofounder of ad-blocker AdGuard, recently got curious about the number of knock-off ad blocking extensions available for Google's popular browser Chrome. These extensions were deliberately styled to look like legitimate, well-known ad blockers, but Meshkov wondered why they existed at all, so he downloaded one and took a look at the code. "Basically I downloaded it and checked what requests the extension was making," Meshkov told me over the phone. "Some strange requests caught my attention."

Meshkov discovered that the AdRemover extension for Chrome -- which had over 10 million users -- had code hidden inside an image that was loaded from the remote command server, giving the extension creator the ability to change its functions without updating. This alone is against Google's policy, and after Meshkov wrote about a few examples on AdGuard's blog, many of which had millions of downloads, Chrome removed the extensions from the store. I reached out to Google, and a spokesperson confirmed that these extensions had been removed.

This discussion has been archived. No new comments can be posted.

Millions of Chrome Users Have Installed Malware Posing as Ad Blockers

Comments Filter:
  • by Anonymous Coward

    ...verify the legitimacy of the source.

    The sort of logical mindset that one needs to keep one's self safe on the Internet is not universal. Many people are born without it. They may have other skills that are valuable, but the days in which they could thrive without logical clarity are vanishing into the past.

    There will be pain....but ultimately those with keen minds will have enough of a survival advantage over the rest, that natural selection will get us where we need to be.

    Eventually.

  • Most of these extensions have nothing but an anonymous internet email behind them and yet people and computer geeks install them and literally give admin access to their computer to strangers

    • by Deathlizard ( 115856 ) on Thursday April 19, 2018 @05:07PM (#56467623) Homepage Journal

      This has been in my Sig for years now.

      Laws of computer stupidity
      1) 99% of computer users do not know what they are doing.
      2) Computer users do not read.
      3) If a computer user can click on it, they will. If they need to click on it, they won't
      4) You can patch software, but you can't (legally) patch stupid.

      And It will still be relevant decades from now, Especially since I can do a search for adblock plus right now on the chrome web store and pick out 20+ fake apps in 5 seconds.

  • by ausekilis ( 1513635 ) on Thursday April 19, 2018 @04:52PM (#56467503)

    So people get Chrome because its "fast and safe". They trust this company who loves to siphon all the public's data. That same public then wants to avoid the obnoxious advertisements pushed by Google, and get malware... from a site managed by Google.

    You'd think Google would get the picture and provide some sort of built-in ad management/protection in Chrome. With millions of downloads it's pretty obvious what people want. So why haven't they done a built-in ad-block?

    • Re:Irony (Score:5, Insightful)

      by ShanghaiBill ( 739463 ) on Thursday April 19, 2018 @04:59PM (#56467563)

      You'd think Google would get the picture and provide some sort of built-in ad management/protection in Chrome.

      An advertising company blocking competing ads would likely attract plenty of attention from anti-trust authorities.

      • You'd think Google would get the picture and provide some sort of built-in ad management/protection in Chrome.

        An advertising company blocking competing ads would likely attract plenty of attention from anti-trust authorities.

        Yes.

        But more importantly, Google is NOT a tech company. Google is an advertising company.

  • by FudRucker ( 866063 ) on Thursday April 19, 2018 @04:56PM (#56467541)
    they should keep a close eye on all the extensions and plugins and themes and whatever else third party things go in to not only chrome, but also google play store, they should all be audited as they are upload and before allowed downloading by the general public, things like this malicious extension is a BIG BLACK EYE for google and it causes me to lose a little trust in google, if this sort of thing keeps happening i will take a hammer to my phone and tablet and buy a dumb phone that is incapable of getting software from anywhere, and go back to using a browser without any addons because i cant trust them anymore
    • I have a feeling I'm going to retire to the forrest and run into all you fuckers.

    • by Kjella ( 173770 )

      they should keep a close eye on all the extensions and plugins and themes and whatever else third party things go in to not only chrome, but also google play store, they should all be audited as they are upload and before allowed downloading by the general public, things like this malicious extension is a BIG BLACK EYE for google

      You think Google has time to audit every line of source code for an application that goes into the app store, even if they could? They have a policy, they look out for gross violations but trojans hide their shit and try not to trigger flags in review processes, to anti-virus, when running in sandboxes etc. so of course crap will get through. I think you have an unrealistic standard that an app store will insulate you from all outside malice. Heck, even in open source somebody can manage to slip in some und

      • by Anonymous Coward

        >You think Google has time to audit every line of source code for an application that goes into the app store, even if they could?

        Sure. Google sponsors Project Zero, whose team of security experts find zero days exploits in products that they don't even have the source code for. A number of other "googlers" have discovered vulnerabilities in many non-google products as well https://www.google.com/about/appsecurity/research/ [google.com]. Why not hire some devs to do some testing of extensions that they offering throu

        • >You think Google has time to audit every line of source code for an application that goes into the app store, even if they could?

          Sure. Google sponsors Project Zero, whose team of security experts find zero days exploits in products that they don't even have the source code for. A number of other "googlers" have discovered vulnerabilities in many non-google products as well https://www.google.com/about/appsecurity/research/ [google.com]. Why not hire some devs to do some testing of extensions that they offering through their store? Google can afford it.

          Exactly.

          Google has the resources. There is ZERO excuse for malware or any mis-behaving programs making it into an official Google-run app sore. Zero Excuses.

    • by amiga3D ( 567632 )

      You install an extension that was provided by a third party. That's a risk you choose to take. If Google has to choose between vetting every extension or getting rid of third party extensions which do you think will happen?

  • Nothing to see here, everything is OK now....they removed it from the store.

    • And I'll bet it was re-uploaded under a slightly different name 5 minutes later.

      "Google -- Because Fuck You, that's why."

  • Reached out? (Score:4, Insightful)

    by rizole ( 666389 ) <{rizole} {at} {yahoo.com}> on Friday April 20, 2018 @06:52AM (#56470219)

    This kind of corporate jargon gets right up my nose. She didn't reach out to google, she contacted them. Reached out is such an over emotively laden phrase for "Emailed" or "Phoned" or "Visited reception and was escorted out the building".

    Stop using it!

You are in a maze of little twisting passages, all different.

Working...