Catch up on stories from the past week (and beyond) at the Slashdot story archive


Forgot your password?
Chrome Advertising Google Security

Chrome Extension Developers Under a Barrage of Phishing Attacks ( 40

An anonymous reader quotes Bleeping Computer: Google's security team has sent out warnings via email to Chrome extension developers after many of them have been the targets of phishing attacks, some of which have been successful and resulted in crooks taking over extensions. These phishing attacks have come into the limelight this past week when phishers managed to compromise the developer accounts for two very popular Chrome extensions -- Copyfish and Web Developer. The phishers used access to these developer accounts to insert adware code inside the extensions and push out a malicious update that overlaid ads on top of web pages users were navigating.

According to new information obtained by Bleeping Computer, these attacks started over two months ago and had been silently going on without anyone noticing. All phishing emails contained the same lure -- someone posing as Google was informing extension developers that their add-on broke Chrome Web Store rules and needed to be updated. The extension developer was lured onto a site to view what was the problem and possibly update the extension. Before seeing the alert, the site asked extension developers to log in with their Google developer account, a natural step when accessing a secure backend.

This discussion has been archived. No new comments can be posted.

Chrome Extension Developers Under a Barrage of Phishing Attacks

Comments Filter:
  • Are they saying that even developers just click without looking?

    • by DrYak ( 748999 ) on Saturday August 12, 2017 @11:16AM (#54998483) Homepage

      And maybe someone clueless enough to fall for this kind of tricks (bogus phishing links) wouldn't be the best person to trust with your web security (the web extensions they write are probably full of exploitable bugs and flaws).

    • When I was a kid, I was taught to distrust phone calls from anyone I didn't recognize, even if they claimed they were from a business with which we had a relationship. After all, how do we know it's actually them, and not someone else posing as them to steal credit card info, account codes, or other private information? We'd listen to what they had to say, but unless they verified their identity in some way, we wouldn't give them any information. If we wanted to follow up or act on anything they said, we wo

    • by Solandri ( 704621 ) on Saturday August 12, 2017 @12:01PM (#54998661)
      The problem is the phishers only have to succeed once. I've been using email since 1987. In that time I've identified and deleted hundreds if not thousands of phishing emails. But I fell for one - it was a phishing email claiming to be from eBay about a problem with my recent winning bid. It just so happened that I had won a bid earlier in the day. So I clicked on it and logged into my eBay account.

      I realized what I'd done within 30 seconds. Logged out, logged into eBay in another browser, and immediately changed my password. But it made me realize that even if you're 99.9% successful at avoiding phishing emails, that still means you'll slip up every now and then.

      I understand now why those phishing emails claiming that there's a problem with your FedEx package aren't as stupid as I always thought ("How dumb are these guys - I'm not even expecting a package via FedEx"). They're just spamming it to tens of millions of people. A few hundred thousand of them are expecting a FedEx package, and the phishers are gambling that a few hundred or a few thousand of them will click-through on the phishing email. It's a one-shot variant of the perfect prediction scam [], leveraging the huge scalability of spamming to eliminate the multiple iterations normally needed to run the con. If it's "obvious" the email is a phishing email, it just means you fell into the 99% or so of people who by random chance didn't fall within the parameters to successfully pull off the con.
  • So lately Firefox has been adding support for WebExtensions [] extensions, which is basically Chrome's extension model but for Firefox. As that page says, "Much of the specifics of the new API are similar to the Blink extension API". It's yet another case of Firefox's developers essentially cloning what Chrome did, even if Firefox's users don't want that at all.

    Now we're hearing that Firefox 57 will only support support WebExtensions extensions []. That will likely mean that a lot of extensions will break for a l

    • We dooomed!! Invader Zim's robot Gir []
    • which is basically Chrome's extension model but for Firefox.

      Maybe you should read what the uBlock Origin maintainer thinks [] of the difference between the Chrome and Firefox implementations of WebExtensions. To quote him: "It baffles me that some people think Firefox is becoming a 'Chrome clone', it’s just not the case, it’s just plain silly to make such statement."

      So who am I going to believe? An actual extension developer or some anonymous coward on Slashdot? I think I'll go with the developer.

    • Firefox is updating to an add-on model that's more stable, more secure, and not based off a giant hack from the early 90s.

  • (Though after W10 it's not like we need any extra reasons)

  • by simplypeachy ( 706253 ) on Saturday August 12, 2017 @11:26AM (#54998521)
    I have yet to see a single phishing email that, when viewed in plain text mode, is remotely convincing. I still don't understand why people compromise so heavily for prettiness instead of privacy and security.
    • Re:Plain text (Score:4, Interesting)

      by fermion ( 181285 ) on Saturday August 12, 2017 @12:24PM (#54998771) Homepage Journal
      A big problem is that some mobile platforms do not display in plain text, some won't even give the email address used.

      A bigger problem is that due to the need to commercialize the web, it has become standard to push HTML emails, and standard for most email clients to automatically render the HTML. Before this, creating an effective phasing email was harder. It was harder to hide URLs. This is like banks adding interstitials to their log in process. It is good to advertise to a captive audience, it is beyond stupid to add a security vulnerability to what is suppose to be a secure process. At the least all secure emails should be plain text.

      I agree developers should not be so dumb as to click phishing emails. That some would really does speak to the incompetence of the people writing these plugins. On the other hand most people are not as paranoid as those of us who have been doing this for years and have taken our jobs seriously.

      I do think that all the fault lies with the developers. I have had the one time pad turned on for my forward facing google account. I never click trust this computer. I have it set up to receive emails, but not to send emails. It could be that Google should force third factor sign ins, but as they clearly care more about ease of use than even the basic level of modernsecurity, that will not happen.

      • Switching one's software to using secure settings shouldn't be outside the realm of possibility for anyone talented enough to write and publish their own software. If I was using a system which didn't offer an email client that could read in plain text, I would find another email client. It's an important security choice and not one I'd be without.

        I'd be careful calling anyone "dumb" and "incompetent". You'll find that after first time you get phished (or very nearly), you realise just how easy it is, with

        • by fermion ( 181285 )
          Many years ago, when I was first programming on an Windows NT environment, not realizing how the incompetent developers of Windows were, I infected the entire office by opening an email. I also, many years ago, destroyed a window installation by downloading a media player. Fortunately it was on a machine that was easily reformatted and restored.

          Phishing is not new. I get several emails, for Fedex, for my employer, for various social networks, trying to get me to click and give passwords. For young peo

  • [...] push out a malicious update that overlaid ads on top of web pages users were navigating.

    That would explain why the ads on Slashdot are overlaying the content.

  • by Anonymous Coward

    Always use your own bookmarks. Banks and everybody else need to stop sending links in emails.

  • How do they know what email address to send the phishing messages to? Is there a way to determine the author's email address from the Chrome store, or are they using information shared by the authors elsewhere?

  • 2FA (Score:4, Insightful)

    by denbesten ( 63853 ) on Saturday August 12, 2017 @01:03PM (#54998947)
    Google's 2-Step Verification [] should be mandatory for developer accounts. End of discussion.

Bell Labs Unix -- Reach out and grep someone.