We busted a fake Chrome extension that was trying to steal data

Re:We busted a fake Chrome extension that was trying to stea... by tyingq on Friday December 07, 2018 @07:23AM (#18627056)

"It's also not clear how any other tool would have detected the long-lived, persistent outbound connection with relatively low bandwidth"

Perhaps, but this extension could have been stealthier. It was using a plaintext web socket on port 6332. If the extension author had instead gotten a Google analytics account, and exfiltrated data via encrypted https GETS to Google servers, it might have never been spotted. That kind of traffic likely happens 24/7 in a typical corporate environment.

[ Parent | on HN ]

Re:We busted a fake Chrome extension that was trying to stea... by cws on Friday December 07, 2018 @11:37AM (#18629077)

Totally. This extension was trying to be stealthy about exfiltrating data...but it wasn’t trying that hard. As noted in the article, the same developer had at least one other extension using the same code to obfuscate and exfiltrate data. Seems like sort of a spray and pray approach

[ Parent | on HN ]