Full Report
Extensions analyzed expose information such as browsing domains, machine IDs, OS details, usage analytics, and more.
Analysis Summary
# Vulnerability: Multiple Chrome Extensions Transmitting Sensitive Data Over Plain HTTP
This summary covers findings regarding several popular Chrome extensions that transmit sensitive user and configuration data over unencrypted HTTP connections, making the data susceptible to Man-in-the-Middle (MITM) interception.
## CVE Details
- **CVE ID:** No specific CVEs were assigned in the provided text. The finding relates to design flaws/implementation errors in extensions.
- **CVSS Score:** Not applicable (N/A) as no formal CVE assessment was provided.
- **CWE:** CWE-319: Cleartext Transmission of Sensitive Information.
## Affected Systems
- **Products:**
- SEMRush Rank (Extension ID: `idbhoeaiokcojcgappfigpifhpkjgmab`)
- PI Rank (Extension ID: `ccgdboldgdlngcgfdoalahmiilojmfndl`)
- Browsec VPN – Free VPN for Chrome (Extension ID: `omghfjlpggmjjaagoclmmobgdodcjboh`)
- MSN New Tab/Homepage (Extension ID: `lklfbkdigihjaaeamncibechhgalldgl`)
- MSN Homepage, Bing Search & News (Extension ID: `midiombanaceofjhodpdibeppmnamfcj`)
- DualSafe Password Manager & Digital Vault (Extension ID: `lgbjhdkjmpgjgcbcdlhkokkckpjmedgc`)
- **Versions:** All vulnerable versions existing prior to vendor remediation.
- **Configurations:** Any configuration where the extension is active and communicating with its specified endpoints.
## Vulnerability Description
Several popular Chrome extensions are configured to send sensitive user data in plaintext over HTTP instead of secured HTTPS channels. This allows any attacker operating on the same network (e.g., public Wi-Fi) to perform a passive network sniff or an active MITM attack to intercept this unencrypted data.
**Data Leaks Include:**
1. **SEMRush Rank & PI Rank:** Browsing domains (visited URLs) are sent unencrypted via query parameters to `rank.trellian.com`.
2. **Browsec VPN:** Sends uninstall telemetry, including usage statistics and a unique user ID (`userId`), via an unencrypted `uninstallURL` endpoint. Furthermore, its manifest allows outbound connections (`connect-src`) to numerous HTTP domains (e.g., `http://trafcfy.com`).
3. **MSN New Tab/Homepage:** Transmits a stable, unique MachineID (`MI`), Operating System details (`OS`), and extension version (`LV`) via HTTP requests using the `SendPingDetails` function, facilitating user profiling.
4. **DualSafe Password Manager:** Sends extension version, browser language, and usage statistics over HTTP to `stats.itopupdate.com`.
## Exploitation
- **Status:** PoC available (The article details the exact network calls used, serving as proof-of-concept demonstration of the flaw).
- **Complexity:** Low (Requires only network access and passive sniffing tools or active MITM setup).
- **Attack Vector:** Network.
## Impact
- **Confidentiality:** High (Browsing domains, machine identifiers, OS details, usage history are exposed).
- **Integrity:** Medium (Attackers on the same network could potentially modify the unencrypted data in transit, leading to targeted attacks).
- **Availability:** Low (No direct impact on service availability).
## Remediation
### Patches
The article strongly implies that the developers were notified. Users must check the official Chrome Web Store pages or vendor advisories for updated versions that enforce HTTPS for all network communications.
### Workarounds
1. **Immediate Removal:** Users relying on these extensions for privacy or security should **uninstall them immediately** until fixes are confirmed.
2. **Network Security:** Avoid using these extensions while connected to untrusted or public Wi-Fi networks.
3. **General Security Checks:** Verify that extension permissions are strictly necessary and that developers adhere to HTTPS standards.
## Detection
- **Indicators of Compromise:** Look for outbound network traffic matching the plaintext URLs mentioned, particularly those containing user-specific data elements like domains or Machine IDs appended to HTTP requests.
- **Detection Methods and Tools:** Network traffic analysis tools (e.g., Wireshark, Burp Suite) configured to inspect unencrypted HTTP traffic destined for the known associated domains.
## References
- Vendor advisories for the specific extensions (check the Web Store for updates).
- Relevant links - defanged: Symantec Protection Bulletin (check the vendor's site for the specific bulletin mentioned).