{"id":85878,"date":"2020-06-20T01:42:41","date_gmt":"2020-06-19T23:42:41","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/111-chrome-dopolnenij-zagruzhennyh-32-mln-raz-ulicheny-v-zagruzke-konfidenczialnyh-dannyh"},"modified":"2020-06-20T01:42:41","modified_gmt":"2020-06-19T23:42:41","slug":"111-chrome-dopolnenij-zagruzhennyh-32-mln-raz-ulicheny-v-zagruzke-konfidenczialnyh-dannyh","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/111-chrome-dopolnenij-zagruzhennyh-32-mln-raz-ulicheny-v-zagruzke-konfidenczialnyh-dannyh","title":{"rendered":"111 Chrome'i laiendit, mida on allalaaditud 32 miljonit korda, on leitud isikuandmete allalaadimises.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Ettev\u00f5te Awake Security teatas<\/a><\/noindex> andmete avastamiseks 111 laiendit<\/a><\/noindex> Google Chrome'ile, mis edastavad kasutaja konfidentsiaalset teavet v\u00e4listele serveritele. Sealhulgas v\u00f5isid laiendid luua ekraanipilte, lugeda l\u00f5ikepuhvri sisu, anal\u00fc\u00fcsida juurdep\u00e4\u00e4sutokeene k\u00fcpsistes ja haarata sisestusi veebivormides. Kokku oli tuvastatud kahjulikud laiendid 32,9 miljoni allalaadimisega Chrome Web Store'is, k\u00f5ige populaarsem (S\u0435arch Manager) oli allalaaditud 10 miljonit korda ja sisaldas 22 tuhat arvustust.<\/p>\n

Eeldatakse, et k\u00f5ik k\u00e4sitletud laiendid on ette valmistanud \u00fcks ja sama k\u00fcberkurjategijate meeskond, kuna k\u00f5ikides kasutati<\/a><\/noindex> t\u00fc\u00fcpilised skeemid konfidentsiaalsete andmete levitamiseks ja haaramiseks, samuti esinevad \u00fchisdisaini elemendid ja korduv kood. 79 kahjuliku koodiga laiendit<\/a><\/noindex> oli paigutatud Chrome Store'i katalooge ja on juba eemaldatud p\u00e4rast teate saatmist kahjuliku tegevuse kohta. Paljud kahjulikud laiendid kopeerisid erinevate populaarsete laiendite funktsionaalsust, sealhulgas, mis keskendusid brauseri t\u00e4iendava kaitse tagamisele, privaatsuse suurendamisele otsingutes, PDF-i konverteerimisele ja failivormingute \u00fcmberkujundamisele.<\/p>\n

\"111<\/a><\/noindex><\/center><\/p>\n

Lisateenuste loojaid jagasid alguses Chrome'i poes puhtaid versioone, mis ei sisaldanud pahavara, l\u00e4bisid \u00fclevaatamise, ja hiljem \u00fches uuenduses lisati muudatusi, mis laadisid pahavara alla p\u00e4rast installimist. Pahatahtliku tegevuse j\u00e4lgede varjamiseks kasutati ka valikuliste vastuste tehnikat \u2014 esimesel p\u00e4ringul anti v\u00e4lja pahavara allalaadimine, kuid j\u00e4rgmistel saadeti andmeid, mis ei tekitanud kahtlusi. <\/p>\n

\"111<\/a><\/noindex><\/center><\/p>\n

Peamisteks meetoditeks pahatahtlike lisandite levitamiseks on professionaalselt n\u00e4gevate veebisaitide tutvustamine (nagu alloleval pildil) ja Chrome'i veebipoes paigutamine, juhtides m\u00f6\u00f6da koodide allalaadimist v\u00e4listelt saitidelt kontrollmehhanisme. Lisandite installimise piirangute \u00fcletamiseks Chrome'i veebipoest jaotavad r\u00fcndajad eraldi Chromiumi kogumid juba eelt installitud lisanditega ning paigaldavad ka juba s\u00fcsteemis olemasolevaid reklaamrakendusi (Adware). Uurijad anal\u00fc\u00fcsisid 100 finants-, meedia-, meditsiini-, farmaatsia-, nafta- ja kaubandussektorite ettev\u00f5tet ning ka hariduse ja avaliku sektori asutusi ning leidis peaaegu k\u00f5igis neist m\u00e4rke uuritavate pahatahtlike lisandite olemasolust. <\/p>\n

\"111<\/a><\/noindex><\/center><\/p>\n

Pahatahtlike lisandite levitamise kampaania k\u00e4igus on registreeritud rohkem kui 15 000 domeeni<\/a><\/noindex>, mis kattuvad populaarsete saitidega (nt gmaille.com, youtubeunblocked.net jne) v\u00f5i on registreeritud p\u00e4rast varem eksisteerinud domeenide t\u00e4htaja l\u00f5ppu. Need domeenid on samuti kasutatud pahatahtliku tegevuse juhtimise infrastruktuuris ja pahatahtlike JavaScripti sisestuste allalaadimiseks, mis t\u00e4idetakse kasutaja avatud lehtede kontekstis.<\/p>\n

Uurijad kahtlustasid koost\u00f6\u00f6d domeeni registreerijaga Galcomm, kus on registreeritud 15 000 domeeni pahatahtlike tegevuste jaoks (60% selle registreerija k\u00f5ikidest v\u00e4lja antud domeenidest), kuid Galcommi esindajad l\u00fckkasid tagasi<\/a><\/noindex> need oletused ja m\u00e4rkisid, et 25% loetletud domeenidest on juba kustutatud v\u00f5i ei ole v\u00e4lja antud Galcommi poolt, samas kui \u00fclej\u00e4\u00e4nud on peaaegu k\u00f5ik passiivsed pargitud domeenid. Galcommi esindajad teatasid ka, et enne avaliku aruande avaldamist ei ole keegi nendega \u00fchendust v\u00f5tnud ning nad said loetelu pahatahtlike eesm\u00e4rkide saavutamiseks kasutatud domeenidest kolmandalt osapoolelt ja n\u00fc\u00fcd viivad nad l\u00e4bi oma uurimise nende osas.<\/p>\n

Probleemi tuvastanud uurijad v\u00f5rdsustavad pahatahtlikke laiendusi uue rootkitiga \u2014 paljude kasutajate peamine tegevus toimub l\u00e4bi brauseri, mille kaudu p\u00e4\u00e4seb ligi jagatud dokumentide ladudele, ettev\u00f5tte teabe s\u00fcsteemidele ja rahandusteenustele. Kurjategijatel pole sellistes tingimustes m\u00f5tet otsida t\u00e4ieliku operatsioonis\u00fcsteemi kompromiteerimise teid, et paigaldada t\u00e4ielik rootkit \u2014 palju lihtsam on saavutada pahatahtliku brauserilaienduse paigaldamine ja kontrollida selle kaudu konfidentsiaalsete andmete vooge. Lisaks andmete transiidi kontrollimisele v\u00f5ib laiendus k\u00fcsida \u00f5igusi kohalike andmete, veebikaamera ja asukoha juurde p\u00e4\u00e4semiseks. Kogemus n\u00e4itab, et enamik kasutajatest ei p\u00f6\u00f6ra t\u00e4helepanu k\u00fcsitavatele \u00f5igustele, ja 80% 1000 populaarseimast laiendusest k\u00fcsib juurdep\u00e4\u00e4su k\u00f5ikidele t\u00f6\u00f6deldud lehtedele. <\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Awake Security \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 111 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0439 \u043a Google Chrome, \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0445 \u043d\u0430 \u0432\u043d\u0435\u0448\u043d\u0438\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u0412 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0438\u043c\u0435\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044e \u0441\u043a\u0440\u0438\u043d\u0448\u043e\u0442\u043e\u0432, \u0447\u0442\u0435\u043d\u0438\u044e \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430 \u043e\u0431\u043c\u0435\u043d\u0430, \u0430\u043d\u0430\u043b\u0438\u0437\u0443 \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u0442\u043e\u043a\u0435\u043d\u043e\u0432 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0432 Cookie \u0438 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0443 \u0432\u0432\u043e\u0434\u0430 \u0432 web-\u0444\u043e\u0440\u043c\u0430\u0445. \u0412 \u0441\u0443\u043c\u043c\u0435 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u043b\u0438 32.9 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 Chrome Web Store, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":85879,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-85878","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47111 Chrome'i laiendust, mida on allalaaditud 32 miljonit korda, on s\u00fc\u00fcdistatud konfidentsiaalsete andmete laadimises | ProHoster","description":"Ettev\u00f5te Awake Security teatas tuvastamisest","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/111-chrome-dopolnenij-zagruzhennyh-32-mln-raz-ulicheny-v-zagruzke-konfidenczialnyh-dannyh","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47111 Chrome-\u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0439, \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 32 \u043c\u043b\u043d \u0440\u0430\u0437, \u0443\u043b\u0438\u0447\u0435\u043d\u044b \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0435 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Awake Security \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/111-chrome-dopolnenij-zagruzhennyh-32-mln-raz-ulicheny-v-zagruzke-konfidenczialnyh-dannyh","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-19T23:42:41+00:00","article:modified_time":"2020-06-19T23:42:41+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"85878","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:28:23","updated":"2022-09-27 16:37:49","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/85878","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=85878"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/85878\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/85879"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=85878"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=85878"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=85878"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}