Full Report
Some browser extension permissions are too broad, and owners can quickly repurpose pre-approved capabilities for malicious intent, a security researcher told CyberScoop. The post Browser extension sales, updates pose hidden threat to enterprises appeared first on CyberScoop.
Analysis Summary
# Tool/Technique: Repurposed Browser Extensions (via Ownership Transfer and Silent Updates)
## Overview
This describes a threat vector where legitimate, pre-approved browser extensions are purchased by malicious actors, who then silently update the extension's code to perform malicious actions, capitalizing on broad permissions already granted by the user and the limited oversight of the platform (Chrome Web Store).
## Technical Details
- Type: Technique / Attack Procedure
- Platform: Web Browsers (specifically demonstrated on Chrome/Chrome Web Store)
- Capabilities: Execution of redirected traffic, potential data exfiltration (screenshots, cookies, authentication data) under existing permissions.
- First Seen: The article describes a recent demonstration by John Tuckner, implying this is a current, repeatable tactic.
## MITRE ATT&CK Mapping
Given this is a supply chain technique involving platform abuse:
- TA0006 - Credential Access
- T1001 - Data Obfuscation (The update process is designed to be silent/hidden)
- TA0003 - Persistence
- T1189 - Drive-by Compromise (Leveraging automatic updates on existing installation)
- TA0001 - Initial Access
- T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain (Abusing the extension distribution pipeline)
## Functionality
### Core Capabilities
- **Acquisition:** Purchasing existing, legitimate browser extensions (Example: "Website Blocker" purchased for $50 + $5 transfer fee).
- **Code Update:** Submitting and pushing malicious code updates to the Chrome Web Store.
- **Silent Execution:** Updates are applied automatically and silently to users' browsers, often without user notification unless new permissions are requested.
### Advanced Features
- **Permission Abuse:** Exploiting existing, broad permissions (like `declarativeNetRequest` or `tabs`) to conduct activities beyond the extension's original stated purpose, such as traffic redirection or data theft (e.g., capturing sensitive login information via phishing redirection or taking screenshots).
- **Phishing Redirection:** Using existing `declarativeNetRequest` permissions to redirect legitimate traffic (e.g., Office 365 login portals) to attacker-controlled phishing portals.
- **Data/Authentication Theft:** Using permissions like `tabs` to take screenshots of sensitive data or `cookies` permission to access authentication tokens.
## Indicators of Compromise
The indicators are highly dynamic as they depend on the specific purchased and repurposed extension.
- File Hashes: N/A (No specific hash provided as this is a general technique).
- File Names: N/A (Relies on the original extension's assets).
- Registry Keys: N/A (Browser extension persistence mechanism).
- Network Indicators:
- Redirect targets (e.g., attacker-controlled phishing login portals).
- Exfiltration endpoints used by the new malicious payload (To be identified during analysis of the updated code).
- Behavioral Indicators:
- Unexplained, silent update to a previously installed browser extension.
- Unexpected traffic redirection initiated by a browser extension.
- Network communication from the extension process to unfamiliar external domains, especially following an update.
## Associated Threat Actors
- Malicious software developers or financially motivated cybercriminals who exploit the developer ecosystem economics for distribution.
- The technique was demonstrated by John Tuckner (Secure Annex).
## Detection Methods
- Signature-based detection: Difficult for the new payload if it relies only on API calls already approved for the extension.
- Behavioral detection: Monitoring for deviations in network behavior from trusted extensions immediately following an update. Monitoring for unexpected use of broad APIs (e.g., high-frequency screenshot capture or redirected network requests).
- YARA rules: Potentially useful for static analysis of new extension packages if they share common malicious code patterns.
## Mitigation Strategies
- **Vendor Review Improvement:** Relying on platform reviews (like Google’s) is insufficient due to high volume and the nature of code repurposing.
- **Reduced Trust Surface:** Organizations should audit and strictly control which extensions are permitted, favoring those from verified or well-known enterprise vendors.
- **Permission Scrutiny:** Organizations must thoroughly review the permissions requested by *all* installed extensions, even if previously approved, paying close attention to broad permissions like `tabs`, `cookies`, and `declarativeNetRequest`.
- **Update Monitoring:** Implement security policies that flag or block automatic updates for non-critical, high-privilege browser extensions if the extension developer identity has recently changed.
## Related Tools/Techniques
- General Supply Chain Compromise (e.g., dependency confusion, malicious third-party libraries).
- Malicious use of legitimate software/platforms for C2 or deployment.