Game of Chromes: Owning the Web with Zombie Chrome Extensions
Compromising Chrome extensions and web stores to create browser botnets through extension vulnerabilities.
Summary
Extension Bot Attacks
In April 2016, malicious bots attacked Wix servers, creating accounts and publishing websites in mass. A malicious Chrome extension on tens of thousands of devices enabled the attack. Distribution via Facebook messaging extended its reach.
Elusive Bot Nature
These extension bots highly elude detection, especially web-based bot-detection systems. Legitimate extensions perform similar actions like sending Facebook messages and creating websites.
XSS in Extensions
Recently, popular Chrome extensions were found vulnerable to XSS. Remarkably, extensions suffer XSS like web applications, but impact is much deadlier. Adobe Acrobat extension's DOM-based XSS allowed control on 30 million devices.
Zombie Extensions
Extension XSS flaws lead to permanent browser control, turning extensions into zombies. Similar techniques to 2016 Wix/Facebook attacks enable efficient malicious payload distribution through social platforms, creating powerful web botnets.
Related talks
Black Hat·37 min
Zuzana Hromcova
Analysts investigate attack surfaces and defenses concerning Anatomy of Native IIS Malware.
Kaspersky·5 min
Industry experts analyze emerging threats surrounding What is Malware?.
Kaspersky·18 min
Industry experts analyze emerging threats surrounding Malware in the industrial world.