{"id":85878,"date":"2020-06-20T01:42:41","date_gmt":"2020-06-19T23:42:41","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/111-chrome-dopolnenij-zagruzhennyh-32-mln-raz-ulicheny-v-zagruzke-konfidenczialnyh-dannyh"},"modified":"2020-06-20T01:42:41","modified_gmt":"2020-06-19T23:42:41","slug":"111-chrome-dopolnenij-zagruzhennyh-32-mln-raz-ulicheny-v-zagruzke-konfidenczialnyh-dannyh","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/111-chrome-dopolnenij-zagruzhennyh-32-mln-raz-ulicheny-v-zagruzke-konfidenczialnyh-dannyh","title":{"rendered":"111 de extensii Chrome, desc\u0103rcate de 32 de milioane de ori, au fost acuzate de \u00eenc\u0103rcarea datelor confiden\u021biale","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Compania Awake Security a declarat<\/a><\/noindex> despre identificarea 111 extensii<\/a><\/noindex> pentru Google Chrome care trimiteau datele confiden\u021biale ale utilizatorilor c\u0103tre servere externe. Aceste extensii aveau acces la realizarea de capturi de ecran, citirea con\u021binutului din clipboard, analizarea prezen\u021bei token-urilor de acces \u00een Cookie \u0219i interceptarea introducerii \u00een formularele web. \u00cen total, extensiile malware identificate au acumulat 32,9 milioane de desc\u0103rc\u0103ri \u00een Chrome Web Store, iar cea mai popular\u0103 (Search Manager) a fost desc\u0103rcat\u0103 de 10 milioane de ori \u0219i include 22.000 de recenzii.<\/p>\n

Se presupune c\u0103 toate extensiile analizate au fost preg\u0103tite de o singur\u0103 echip\u0103 de infractori, deoarece toate a fost utilizat\u0103<\/a><\/noindex> urmeaz\u0103 o schem\u0103 tipic\u0103 de distribu\u021bie \u0219i organizare a capt\u0103rii datelor confiden\u021biale, av\u00e2nd \u00een acela\u0219i timp elemente comune de design \u0219i cod repetitiv. 79 de extensii<\/a><\/noindex> cu cod mali\u021bios au fost plasate \u00een catalogul Chrome Store \u0219i au fost deja eliminate dup\u0103 trimiterea unei notific\u0103ri de activitate mali\u021bioas\u0103. Multe extensii mali\u021bioase copiau func\u021bionalitatea diverse extensii populare, inclusiv cele destinate \u00eembun\u0103t\u0103\u021birii securit\u0103\u021bii browser-ului, cre\u0219terii confiden\u021bialit\u0103\u021bii \u00een c\u0103utare, conversiei PDF \u0219i conversiei formatelor.<\/p>\n

\"111<\/a><\/noindex><\/center><\/p>\n

Dezvoltatorii de extensii mai puneau ini\u021bial o versiune curat\u0103 \u00een Chrome Store, f\u0103r\u0103 cod mali\u021bios, treceau printr-o recenzare, iar apoi, \u00een una dintre actualiz\u0103ri, ad\u0103ugau modific\u0103ri care \u00eenc\u0103rcau cod mali\u021bios dup\u0103 instalare. Pentru a ascunde urmele activit\u0103\u021bii mali\u021bioase se utiliza, de asemenea, tehnica r\u0103spunsurilor selective \u2014 la prima solicitare se oferea un fi\u0219ier mali\u021bios, iar la cele ulterioare date care nu ridicau suspiciuni. <\/p>\n

\"111<\/a><\/noindex><\/center><\/p>\n

Cauzele principale de r\u0103sp\u00e2ndire a extensiilor mali\u021bioase includ promovarea site-urilor care arat\u0103 profesionist (a\u0219a cum este exemplificat mai jos) \u0219i publicarea \u00een Chrome Web Store, ocolind mecanismele de verificare pentru a desc\u0103rca ulterior codul de pe site-uri externe. Pentru a ocoli restric\u021biile de instalare a extensiilor doar din Chrome Web Store, atacatorii au distribuit versiuni separate ale Chromium cu extensii preinstalate, precum \u0219i s-a realizat instalarea prin aplica\u021bii publicitare (Adware) deja prezente \u00een sistem. Cercet\u0103torii au analizat 100 de re\u021bele din domeniul financiar, media, medical, farmaceutic, petrolier \u0219i comercial, precum \u0219i institu\u021bii educa\u021bionale \u0219i de stat, iar aproape \u00een toate au fost identificate urme ale extensiilor mali\u021bioase discutate. <\/p>\n

\"111<\/a><\/noindex><\/center><\/p>\n

\u00cen timpul campaniei de r\u0103sp\u00e2ndire a extensiilor mali\u021bioase, au fost \u00eenregistrate peste 15 mii de domenii<\/a><\/noindex>, intersect\u00e2ndu-se cu site-uri populare (de exemplu, gmaille.com, youtubeunblocked.net etc.) sau \u00eenregistrate dup\u0103 expirarea termenului de re\u00eennoire a domeniilor existente. Aceste domenii au fost, de asemenea, utilizate \u00een infrastructura de gestionare a activit\u0103\u021bii mali\u021bioase \u0219i pentru desc\u0103rcarea inser\u021biilor JavaScript mali\u021bioase, executate \u00een contextul paginilor deschise de utilizatori.<\/p>\n

Cercet\u0103torii au suspicios de coluziune cu registrul de domenii Galcomm, care a \u00eenregistrat 15 mii de domenii pentru activit\u0103\u021bi mali\u021bioase (60% din toate domeniile emise de acest registrator), dar reprezentan\u021bii Galcomm au respins<\/a><\/noindex> aceste suspiciuni \u0219i au indicat c\u0103 25% dintre domeniile enumerate sunt deja \u0219terse sau nu au fost emise de Galcomm, iar celelalte aproape toate sunt domenii inactive parcate. Reprezentan\u021bii Galcomm au mai declarat c\u0103, p\u00e2n\u0103 la divulgarea public\u0103 a raportului, nimeni nu s-a adresat lor, \u0219i c\u0103 au primit lista domeniilor utilizate \u00een scopuri mali\u021bioase de la o ter\u021b\u0103 parte \u0219i acum efectueaz\u0103 propria analiz\u0103.<\/p>\n

Cercet\u0103torii care au identificat problema compar\u0103 extensiile mali\u021bioase cu un nou rootkit \u2014 activitatea principal\u0103 a multor utilizatori se desf\u0103\u0219oar\u0103 prin intermediul browserului, prin care se acceseaz\u0103 stoc\u0103rile comune de documente, sistemele de informa\u021bii corporative \u0219i serviciile financiare. \u00cen aceste condi\u021bii, infractorilor nu le-ar folosi s\u0103 caute modalit\u0103\u021bi de compromitere total\u0103 a sistemului de operare pentru a instala un rootkit complet, \u2014 mult mai simplu este s\u0103 ob\u021bin\u0103 instalarea unei extensii mali\u021bioase pentru browser \u0219i s\u0103 controleze prin intermediul acesteia fluxurile de date confiden\u021biale. \u00cen plus fa\u021b\u0103 de controlul asupra datelor tranzitorii, extensia poate solicita permisiuni pentru accesul la datele locale, la webcam, la loca\u021bie. A\u0219a cum arat\u0103 practica, majoritatea utilizatorilor nu acord\u0103 aten\u021bie permisiunilor solicitate, iar 80% din cele 1000 de extensii populare solicit\u0103 acces la datele tuturor paginilor procesate. <\/p>\n

<\/a><\/noindex><\/p>\n

Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Awake Security \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 111 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0439 \u043a Google Chrome, \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0445 \u043d\u0430 \u0432\u043d\u0435\u0448\u043d\u0438\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u0412 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0438\u043c\u0435\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044e \u0441\u043a\u0440\u0438\u043d\u0448\u043e\u0442\u043e\u0432, \u0447\u0442\u0435\u043d\u0438\u044e \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430 \u043e\u0431\u043c\u0435\u043d\u0430, \u0430\u043d\u0430\u043b\u0438\u0437\u0443 \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u0442\u043e\u043a\u0435\u043d\u043e\u0432 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0432 Cookie \u0438 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0443 \u0432\u0432\u043e\u0434\u0430 \u0432 web-\u0444\u043e\u0440\u043c\u0430\u0445. \u0412 \u0441\u0443\u043c\u043c\u0435 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u043b\u0438 32.9 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 Chrome Web Store, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":85879,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-85878","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47111 de extensii Chrome, desc\u0103rcate de 32 de milioane de ori, acuzate de desc\u0103rcarea de date confiden\u021biale | ProHoster","description":"Compania Awake Security a anun\u021bat identificarea","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/111-chrome-dopolnenij-zagruzhennyh-32-mln-raz-ulicheny-v-zagruzke-konfidenczialnyh-dannyh","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47111 Chrome-\u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0439, \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 32 \u043c\u043b\u043d \u0440\u0430\u0437, \u0443\u043b\u0438\u0447\u0435\u043d\u044b \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0435 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Awake Security \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/111-chrome-dopolnenij-zagruzhennyh-32-mln-raz-ulicheny-v-zagruzke-konfidenczialnyh-dannyh","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-19T23:42:41+00:00","article:modified_time":"2020-06-19T23:42:41+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"85878","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:28:23","updated":"2022-09-27 16:37:49","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/85878","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=85878"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/85878\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/85879"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=85878"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=85878"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=85878"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}