0
Valid arguments about a possible industrial espionage campaign are being raised surrounding a Google Chrome extension that was caught collecting browsing history, ZDNet has learned from ExtraHop, a real-time IT analytics firm.
The company said today it detected the malicious code hidden inside a Google Chrome extension aimed at web developers. The extension, named Postman, is still available in the Chrome Web Store, despite ExtraHop reporting it to Google more than a month ago.
The extension, which has over 27,000 installs, is a blatant clone of Postman, another popular Chrome extension that can be used for testing and real-time editing of API requests.
Because of its features, the extension is usually found installed on Chrome browsers used by web developers.
An extension collecting browsing history might sound benign, but in a phone call today, the ExtraHop team told ZDNet that this behavior is extremely worrisome when observed in this particular case.
The ExtraHop team raised concerns that developers usually access URLs of internal networks, APIs, and applications, and whoever is collecting this browsing history will gain access to URLs that may reveal details about unreleased products, hidden features, or a company’s intranet or internal network structure. For example, a developer making API calls to something like “/product/beta/car_dashboard/automatic_breaks/engage/pedestrian_detection/” may reveal quite a lot.
In the hands of a determined attacker, such information is both valuable, as it could be sold to unethical competitors, but it could also be used to plan future attacks.
The discovery of this extension comes on the heels of Netscout revealing that North Korean nation-state hackers have used a Chrome extension for the first time in a government-orchestrate cyber-espionage campaign.
ExtraHop told ZDNet that the IP address where Postman collected browsing history data appears to be “clean,” and was not associated with the infrastructure of any other criminal group.
The Postman Chrome extension is also not the first one to be caught collecting user browsing history. Usually, the extensions that engage in such practices have large userbases. The makers of these extensions collect and sell bulk user browsing data to analytics and advertising firms as a way of monetizing user installs.
A Chrome extension like Postman, intended for web developers, doesn’t have the user pool to be monetized in the same way, as, for example, Stylish –another popular extension with millions of installs that did the same thing earlier this year.
Both Google and Mozilla prohibit extension developers from collecting browsing data, which is a mystery why Google has failed to remove this one.
The ExtraHop team has also published a blog post detailing the extension’s technical inner workings. ExtraHop said they detected the Postman extension’s data collection on the workstation of one of its own developers who, ironically, was using it to test the company’s suspicious traffic analysis product –Reveal(x).
More browser coverage:
Google releases Chrome 71 with a focus on security features
Google Chrome 71 will continue crackdown on sites with abusive adsChrome 71 will warn users about websites with shady phone subscription formsGoogle is raiding Firefox for Chrome’s next UI featuresMozilla will match all donations to the Tor ProjectVersion 2.0 brings Vivaldi web browser inline with the competition TechRepublicMozilla gives Firefox Focus a browser brain transplant on Android CNETGoogle launches VisBug, a Chrome extension for point-and-click web design
Related Topics:
Security TV
Data Management
CXO
Data Centers
0