{"id":85878,"date":"2020-06-20T01:42:41","date_gmt":"2020-06-19T23:42:41","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/111-chrome-dopolnenij-zagruzhennyh-32-mln-raz-ulicheny-v-zagruzke-konfidenczialnyh-dannyh"},"modified":"2020-06-20T01:42:41","modified_gmt":"2020-06-19T23:42:41","slug":"111-chrome-dopolnenij-zagruzhennyh-32-mln-raz-ulicheny-v-zagruzke-konfidenczialnyh-dannyh","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/111-chrome-dopolnenij-zagruzhennyh-32-mln-raz-ulicheny-v-zagruzke-konfidenczialnyh-dannyh","title":{"rendered":"111 Chrome'i laiendit, mis on laaditud 32 miljonit korda, on s\u00fc\u00fcdistatud konfidentsiaalsete andmete laadimises","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Ettev\u00f5te Awake Security teatas<\/a><\/noindex> teatas 111 laiendist<\/a><\/noindex> Google Chrome'ile, mis saadavad kasutaja konfidentsiaalseid andmeid v\u00e4listele serveritele. Nende hulka kuulusid laiendid, millel oli juurdep\u00e4\u00e4s ekraanipiltide tegemisele, l\u00f5ikeplaadi sisu lugemisele, juurdep\u00e4\u00e4sukoodide anal\u00fc\u00fcsimisele k\u00fcpsistes ning veebivormides sisendi pealtkuulamisele. Kokku tuvastatud pahatahtlikud laiendid kogusid Chrome Web Store'is 32,9 miljonit allalaadimist, kusjuures k\u00f5ige populaarsem (S\u0435arch Manager) oli laaditud 10 miljonit korda ja sisaldas 22 000 arvustust.<\/p>\n

Eeldatakse, et k\u00f5ik k\u00e4sitletud laiendid on ette valmistatud \u00fche rikka r\u00fchma poolt, kuna k\u00f5igil on kasutatud<\/a><\/noindex> t\u00fc\u00fcpiline skeem konfidentsiaalsete andmete levitamiseks ja hankimiseks, samuti on olemas \u00fchised disainelemendid ja korduv kood. 79 laiendit<\/a><\/noindex> kahjustava koodiga laiendused olid paigutatud Chrome'i poodi ja eemaldati p\u00e4rast teavitust kahjuliku tegevuse kohta. Paljud kahjulikud laiendused kopeerisid erinevate populaarsete laienduste funktsionaalsust, sealhulgas eesm\u00e4rgiga tagada lisakaitse brauserile, suurem privaatsus otsingutes, PDF-i konverteerimine ja formaadimuudatused.<\/p>\n

\"111<\/a><\/noindex><\/center><\/p>\n

Lisa arendajad avaldasid esialgu Chrome'i poes puhta versiooni ilma pahavara, l\u00e4bisid \u00fclevaatamise ja seej\u00e4rel lisasid \u00fches uuenduses muudatused, mis laadisid installimise j\u00e4rel pahavara. Pahavara tegevuse j\u00e4lgede varjamiseks kasutati ka valikuliselt vastamista, kus esimesel p\u00e4ringul anti pahavara allalaadimine ja hiljem mittekahtlased andmed. <\/p>\n

\"111<\/a><\/noindex><\/center><\/p>\n

Kahjulikku tarkvara levimise peamised viisid h\u00f5lmavad professionaalselt n\u00e4ivate veebisaitide reklaami (nagu alloleval pildil) ja Chrome'i veebipoes kohaletoimetamist, m\u00f6\u00f6da minnes kontrollimehhanismidest v\u00e4liskoodide \u00fcleslaadimiseks. Installimispiirangute \u00fcletamiseks Chrome'i veebipoest jagasid r\u00fcndajad eraldi Chromiumi versioone, kuhu olid eelsalvestatud laiendused, ning installiti neid juba s\u00fcsteemis kohal olevate reklaamirakenduste (Adware) kaudu. Teadlastel \u00f5nnestus anal\u00fc\u00fcsida 100 finants-, meedia-, meditsiini-, farmaatsia-, nafta- ja gaasit\u00f6\u00f6stuse ning kaubandusettev\u00f5ttega tervikuna, lisaks hariduse ja riigiasutustega ning peaaegu igas neist avastati uuritavate kahjulike laienduste j\u00e4lgi. <\/p>\n

\"111<\/a><\/noindex><\/center><\/p>\n

Kahjulike laienduste levitamise kampaania k\u00e4igus registreeriti \u00fcle 15 tuhat domeeni<\/a><\/noindex>, mis k\u00e4tkeb populaarseid saite (nt gmaille.com, youtubeunblocked.net jne) v\u00f5i registreeritud p\u00e4rast olemasolevate domeenide pikendamise t\u00e4htaega. Need domeenid on samuti kasutatud pahatahtliku tegevuse haldamise infrastruktuuris ja kahjulike JavaScripti koodil\u00f5ikude laadimiseks, mis t\u00e4idavad kasutajate avatud lehtede kontekstis.<\/p>\n

Uurijad kahtlustasid koost\u00f6\u00f6s domeeniregistraatoriga Galcomm, mille kaudu registreeriti 15 000 domeeni pahatahtlikuks tegevuseks (60% k\u00f5igist selle registreerija poolt antud domeenidest), kuid Galcomm esindajad \u00fcmber l\u00fckkasid<\/a><\/noindex> need v\u00e4idavad ja m\u00e4rkisid, et 25% loetletud domeenidest on juba kustutatud v\u00f5i ei kuulu Galcomm'ile, ning enamik teisi on peaaegu k\u00f5ik mitteaktiivsed pargitud domeenid. Galcomm esindajad \u00fctlesid ka, et enne avaliku aruande avaldamist ei p\u00f6\u00f6rdunud nende poole keegi ning nad said pahatahtlikeks eesm\u00e4rkideks kasutatavate domeenide nimekirja kolmandalt isikult ja teevad n\u00fc\u00fcd nende osas oma anal\u00fc\u00fcsi.<\/p>\n

Probleemi tuvastanud teadlased v\u00f5rrelevad pahatahtlikke laiendusi uue rootkitiga \u2014 paljude kasutajate peamine tegevus toimub brauseris, mille kaudu p\u00e4\u00e4seb juurde kaasrahastatavatele dokumentide salvestuskohtadele, ettev\u00f5tte infos\u00fcsteemidele ja finantsteenustele. Sellistes tingimustes pole kurjategijatel m\u00f5tet otsida viise, kuidas operatsioonis\u00fcsteemi t\u00e4ielikult kompromiteerida rootkiti installimiseks \u2014 palju lihtsam on saavutada pahatahtliku brauserilaienduse installimine ja juhtida selle kaudu konfidentsiaalsete andmete vooge. Lisaks liiklusandmete kontrollimisele v\u00f5ib laiendus n\u00f5uda \u00f5igusi juurdep\u00e4\u00e4suks kohalikele andmetele, veebikaamerale ja asukohale. Praktika n\u00e4itab, et enamik kasutajaid ei p\u00f6\u00f6rata t\u00e4helepanu n\u00f5utavatele \u00f5igustele, ning 80% 1000 populaarseimast laiendusest k\u00fcsib juurdep\u00e4\u00e4su k\u00f5igi t\u00f6\u00f6deldud lehtede andmetele. <\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Awake Security \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 111 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0439 \u043a Google Chrome, \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0445 \u043d\u0430 \u0432\u043d\u0435\u0448\u043d\u0438\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u0412 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0438\u043c\u0435\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044e \u0441\u043a\u0440\u0438\u043d\u0448\u043e\u0442\u043e\u0432, \u0447\u0442\u0435\u043d\u0438\u044e \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430 \u043e\u0431\u043c\u0435\u043d\u0430, \u0430\u043d\u0430\u043b\u0438\u0437\u0443 \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u0442\u043e\u043a\u0435\u043d\u043e\u0432 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0432 Cookie \u0438 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0443 \u0432\u0432\u043e\u0434\u0430 \u0432 web-\u0444\u043e\u0440\u043c\u0430\u0445. \u0412 \u0441\u0443\u043c\u043c\u0435 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u043b\u0438 32.9 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 Chrome Web Store, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":85879,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-85878","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47111 Chrome'i laiendust, mis on allalaaditud 32 miljonit korda, on s\u00fc\u00fcdistatud konfidentsiaalsete andmete allalaadimises | ProHoster","description":"Ettev\u00f5te Awake Security teatas, et 111 Google Chrome'i laiendust on tuvastatud, mis saadavad kasutaja konfidentsiaalsed andmed v\u00e4listele serveritele. Nende seas oli laiendustel juurdep\u00e4\u00e4s ekraanipiltide loomisele, l\u00f5ikelauasisu lugemiseks, juurdep\u00e4\u00e4sutokenite anal\u00fc\u00fcsimiseks k\u00fcpsistes ja veebivormides sisendi salvestamiseks. Kokku tuvastatud kahjulikud laiendused olid kogunud 32,9 miljonit allalaadimist Chrome'i veebipoes.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/111-chrome-dopolnenij-zagruzhennyh-32-mln-raz-ulicheny-v-zagruzke-konfidenczialnyh-dannyh","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47111 Chrome-\u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0439, \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 32 \u043c\u043b\u043d \u0440\u0430\u0437, \u0443\u043b\u0438\u0447\u0435\u043d\u044b \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0435 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Awake Security \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 111 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0439 \u043a Google Chrome, \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0445 \u043d\u0430 \u0432\u043d\u0435\u0448\u043d\u0438\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u0412 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0438\u043c\u0435\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044e \u0441\u043a\u0440\u0438\u043d\u0448\u043e\u0442\u043e\u0432, \u0447\u0442\u0435\u043d\u0438\u044e \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430 \u043e\u0431\u043c\u0435\u043d\u0430, \u0430\u043d\u0430\u043b\u0438\u0437\u0443 \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u0442\u043e\u043a\u0435\u043d\u043e\u0432 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0432 Cookie \u0438 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0443 \u0432\u0432\u043e\u0434\u0430 \u0432 web-\u0444\u043e\u0440\u043c\u0430\u0445. \u0412 \u0441\u0443\u043c\u043c\u0435 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u043b\u0438 32.9 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 Chrome Web Store,","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/111-chrome-dopolnenij-zagruzhennyh-32-mln-raz-ulicheny-v-zagruzke-konfidenczialnyh-dannyh","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-19T23:42:41+00:00","article:modified_time":"2020-06-19T23:42:41+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"85878","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:28:23","updated":"2022-09-27 16:37:49"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/85878","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=85878"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/85878\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/85879"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=85878"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=85878"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=85878"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}