{"id":85878,"date":"2020-06-20T01:42:41","date_gmt":"2020-06-19T23:42:41","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/111-chrome-dopolnenij-zagruzhennyh-32-mln-raz-ulicheny-v-zagruzke-konfidenczialnyh-dannyh"},"modified":"2020-06-20T01:42:41","modified_gmt":"2020-06-19T23:42:41","slug":"111-chrome-dopolnenij-zagruzhennyh-32-mln-raz-ulicheny-v-zagruzke-konfidenczialnyh-dannyh","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/111-chrome-dopolnenij-zagruzhennyh-32-mln-raz-ulicheny-v-zagruzke-konfidenczialnyh-dannyh","title":{"rendered":"111 Chrome-till\u00e4gg, nedladdade 32 miljoner g\u00e5nger, avsl\u00f6jade f\u00f6r att ladda ner k\u00e4nsliga data","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

F\u00f6retaget Awake Security rapporterade<\/a><\/noindex> om identifiering 111 till\u00e4gg<\/a><\/noindex> till Google Chrome som skickar anv\u00e4ndarens konfidentiella uppgifter till externa servrar. Bland annat hade till\u00e4ggen tillg\u00e5ng till att skapa sk\u00e4rmdumpar, l\u00e4sa inneh\u00e5llet i urklipp, analysera f\u00f6rekomsten av \u00e5tkomsttoken i cookies och f\u00e5nga inmatningar i webbformul\u00e4r. Totalt identifierades skadliga till\u00e4gg med 32,9 miljoner nedladdningar i Chrome Web Store, och det mest popul\u00e4ra (Search Manager) laddades ner 10 miljoner g\u00e5nger och har 22 000 recensioner.<\/p>\n

Det antas att alla granskade till\u00e4gg \u00e4r f\u00f6rberedda av samma lag av illvilliga akt\u00f6rer, eftersom i alla anv\u00e4ndes<\/a><\/noindex> finns en typisk schem f\u00f6r spridning och organisering av konfidentiell datainh\u00e4mtning, samt gemensamma designelement och \u00e5terkommande kod. 79 till\u00e4gg<\/a><\/noindex> med skadlig kod har publicerats i Chrome Store och har redan tagits bort efter att en anm\u00e4lan om skadlig aktivitet skickades. M\u00e5nga skadliga till\u00e4gg kopierade funktionaliteten hos olika popul\u00e4ra till\u00e4gg, inklusive dem som syftade till att ge extra skydd f\u00f6r webbl\u00e4saren, \u00f6ka sekretessen vid s\u00f6kningar, konvertera PDF och omvandla format.<\/p>\n

\"111<\/a><\/noindex><\/center><\/p>\n

Till\u00e4ggsutvecklare lade f\u00f6rst upp rena versioner utan skadlig kod p\u00e5 Chrome Store, genomgick granskning, och lade sedan till \u00e4ndringar i en av uppdateringarna som laddade ner skadlig kod efter installationen. F\u00f6r att d\u00f6lja sp\u00e5ren av skadlig aktivitet anv\u00e4ndes \u00e4ven tekniken f\u00f6r selektiva svar \u2014 vid f\u00f6rsta f\u00f6rfr\u00e5gan gavs en skadlig nedladdning, medan senare f\u00f6rfr\u00e5gningar returnerade oskyldiga data. <\/p>\n

\"111<\/a><\/noindex><\/center><\/p>\n

De fr\u00e4msta s\u00e4tten som skadliga till\u00e4gg sprids \u00e4r genom att marknadsf\u00f6ra professionellt utseende webbplatser (som p\u00e5 bilden nedan) och placering i Chrome Web Store, vilket kringg\u00e5r kontrollmekanismen f\u00f6r att h\u00e4mta kod fr\u00e5n externa webbplatser. F\u00f6r att kringg\u00e5 begr\u00e4nsningarna f\u00f6r att installera till\u00e4gg endast fr\u00e5n Chrome Web Store, spred angriparna s\u00e4rskilda versioner av Chromium med f\u00f6rinstallerade till\u00e4gg, och installationen genomf\u00f6rdes \u00e4ven via redan installerade reklamprogram (Adware) i systemet. Forskare analyserade 100 n\u00e4tverk inom finansiella, medie, medicinska, farmaceutiska, olje- och gasf\u00f6retag samt utbildnings- och statliga institutioner, och n\u00e4stan alla visade tecken p\u00e5 n\u00e4rvaron av de aktuella skadliga till\u00e4ggen. <\/p>\n

\"111<\/a><\/noindex><\/center><\/p>\n

Under kampanjen f\u00f6r spridning av skadliga till\u00e4gg registrerades \u00f6ver 15 000 dom\u00e4ner<\/a><\/noindex>, som \u00f6verlappar med popul\u00e4ra webbplatser (t.ex. gmaille.com, youtubeunblocked.net osv.) eller registrerades efter att de tidigare existerande dom\u00e4nerna g\u00e5tt ut. Dessa dom\u00e4ner anv\u00e4ndes ocks\u00e5 i infrastruktur f\u00f6r att hantera skadlig verksamhet och f\u00f6r att ladda ner skadliga JavaScript-injektioner som k\u00f6rdes i kontexten av sidor \u00f6ppnade av anv\u00e4ndaren.<\/p>\n

Forskare misst\u00e4nkte en samverkan med dom\u00e4nregistratorn Galcomm, hos vilken 15 000 dom\u00e4ner registrerades f\u00f6r skadliga \u00e5tg\u00e4rder (60% av alla dom\u00e4ner utf\u00e4rdade av denna registrator), men representanter f\u00f6r Galcomm f\u00f6rnekade<\/a><\/noindex> denna misstanke och angav att 25% av de n\u00e4mnda dom\u00e4nerna redan har tagits bort eller utf\u00e4rdats av n\u00e5gon annan \u00e4n Galcomm, medan n\u00e4stan alla andra \u00e4r inaktiva parkerade dom\u00e4ner. Representanter f\u00f6r Galcomm rapporterade ocks\u00e5 att ingen hade kontaktat dem f\u00f6re offentligg\u00f6randet av rapporten, och att de f\u00e5tt listan \u00f6ver dom\u00e4ner som anv\u00e4nds f\u00f6r skadliga syften fr\u00e5n en tredje part och nu genomf\u00f6r sin egen analys.<\/p>\n

Forskare som uppt\u00e4ckte problemet j\u00e4mf\u00f6r den skadliga till\u00e4gget med en ny rootkit \u2014 de flesta anv\u00e4ndares aktiviteter bedrivs via webbl\u00e4saren, som ger \u00e5tkomst till gemensamma dokumentf\u00f6rr\u00e5d, f\u00f6retagsinformationssystem och finansiella tj\u00e4nster. F\u00f6r angripare \u00e4r det i s\u00e5dana fall meningsl\u00f6st att leta efter s\u00e4tt att helt komprometterar operativsystemet f\u00f6r att installera en fullst\u00e4ndig rootkit \u2014 det \u00e4r mycket enklare att f\u00e5 installationen av ett skadligt webbl\u00e4sartill\u00e4gg och kontrollera str\u00f6mmar av konfidentiell information genom det. F\u00f6rutom kontrollen av transitdata kan till\u00e4gget beg\u00e4ra beh\u00f6righeter f\u00f6r \u00e5tkomst till lokala data, webbkamera och plats. Som erfarenheten visar, l\u00e4gger de flesta anv\u00e4ndare inte m\u00e4rke till de beg\u00e4rda beh\u00f6righeterna, och 80% av 1000 popul\u00e4ra till\u00e4gg beg\u00e4r \u00e5tkomst till data p\u00e5 alla behandlade sidor. <\/p>\n

<\/a><\/noindex><\/p>\n

K\u00e4lla: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Awake Security \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 111 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0439 \u043a Google Chrome, \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0445 \u043d\u0430 \u0432\u043d\u0435\u0448\u043d\u0438\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u0412 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0438\u043c\u0435\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044e \u0441\u043a\u0440\u0438\u043d\u0448\u043e\u0442\u043e\u0432, \u0447\u0442\u0435\u043d\u0438\u044e \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430 \u043e\u0431\u043c\u0435\u043d\u0430, \u0430\u043d\u0430\u043b\u0438\u0437\u0443 \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u0442\u043e\u043a\u0435\u043d\u043e\u0432 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0432 Cookie \u0438 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0443 \u0432\u0432\u043e\u0434\u0430 \u0432 web-\u0444\u043e\u0440\u043c\u0430\u0445. \u0412 \u0441\u0443\u043c\u043c\u0435 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u043b\u0438 32.9 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 Chrome Web Store, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":85879,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-85878","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47111 Chrome-till\u00e4gg, nedladdade 32 miljoner g\u00e5nger, har avsl\u00f6jats f\u00f6r att ladda ner konfidentiell data | ProHoster","description":"F\u00f6retaget Awake Security rapporterade om uppt\u00e4ckten","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/111-chrome-dopolnenij-zagruzhennyh-32-mln-raz-ulicheny-v-zagruzke-konfidenczialnyh-dannyh","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47111 Chrome-\u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0439, \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 32 \u043c\u043b\u043d \u0440\u0430\u0437, \u0443\u043b\u0438\u0447\u0435\u043d\u044b \u0432 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0435 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Awake Security \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/111-chrome-dopolnenij-zagruzhennyh-32-mln-raz-ulicheny-v-zagruzke-konfidenczialnyh-dannyh","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-19T23:42:41+00:00","article:modified_time":"2020-06-19T23:42:41+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"85878","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:28:23","updated":"2022-09-27 16:37:49","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/85878","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=85878"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/85878\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media\/85879"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=85878"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=85878"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=85878"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}