Threat browser extension, or How easy it is to lose your cryptocurrency?

Date:

2019-03-09 00:30:16

Views:

3396

Rating:

1Like 0Dislike

Share:

Threat browser extension, or How easy it is to lose your cryptocurrency? Source:

We periodically remind you how cryptocurrencies don't fall for the tricks and in General not to lose their cherished coins. Methods of fraudsters develop from year to year and now some of them are so cleverly disguised and that even tech-savvy the user is difficult to recognize danger. Today we will study the theme of malicious extensions to browsers. It would seem that they should make life easier, but often make it worse.

Below is the translation of the article user Harry on .

the

install everything

I Recently stumbled upon a project that promises cashback on each transaction, including trade on centralized exchanges. To get back to 5 percent, enough to install a browser extension. If the offer sounds too good to be true, then chances are it is a fraud. At the time of detection, the application of CCB Cash with an ID in Chrome liachincjagnalnmahhaioaogkngbmhf was 181 by the user. Now the app disappeared from the store.

Product that promises a return of 5 percent on all of your blockchain transactions. Too good to be true.

I studied the code and found it to be malicious behavior. Malicious extension is interested only in the following coins: , , , , , and .

the

What permissions requests an extension?

After installation, the extension requests a write access to a variety of domains, including Github, Exmo, Coinbase, Binance, HitBTC, LocalBitcoins, and others. It asks for access to all open tabs and your cookies – these permissions are often misused, stealing your assets from different exchanges and wallets.

the

What does it do?

To summarize in one sentence, the extension steals all your confidential information depending on the domain. For example, on Binance it steals login data, codes two-factor authentication and CSRF tokens, and then tries to automatically withdraw the coins.

Look at how this is happening.

Step 1. Theft of login information

The Extension contains code that is triggered when you tap the button and steals enter the mail and password by storing them in LocalStorage and sending it to your server without disrupting the normal process of entering the exchange.

Code that steals login information on Binance

Step 2. Theft codes, two-factor authentication

When you sign into the extension monitors the input two-factor authentication and waits until the form is sent. Then it translates the code entered on your server along with stored in LocalStorage mail and password from the first step.

Code, stealing code two-factor authentication at login

After entering the extension every 5 minutes to request a code from Google Authenticator that will be sent to the server. This gives malicious users more attempts, if they will try to log in to your account and pass code that was sent when you log in.

code Request two-factor authentication on Google Binance

Step 3. Stealing CSRF-token and output

When you're browsing on Binance your balance, increase steals your cookie CSRF token and sends it to your server. Then it makes a POST request to seize the balance of coins, and trying them out.

The Extension steals CSRF tokens to execute on them the function md5() to make POST request /exchange/private/yserAssetTransferBtc to seize your balance. After this extension sorts the coins by value and trying to bring them.

If the extension finds a coin with a balance of more than 0.01 BTC, which can be displayed, it will take you to the page output the coin with the highest value will automatically populate the request and click to automatically withdraw. It will also smear the screen Binance, inserting into the body of the document, the div element, moving it to the foreground and changing the text confirmation code two-factor authentication. It is necessary to convince you that you got out of the site. All this happens very quickly, and you don't even notice that you were redirected from the page.

the User believes that his session is complete

The user enters code two-factor authentication to "restore" the session (not knowing that he is confirming the withdrawal of coins to the address of the attacker), and then asked him to check the mail. Of course, the user will only receive a letter of confirmation of conclusion, but if he will not read the contents of the letter and just click the link, it will confirm the withdrawal and start the process. The same thing happens in Coinbase: periodic code requests two-factor authentication and the theft of cookies and data entry.

an Example of embedded browser extension forms enter the code two-factor authentication on Coinbase

If you view the account, the extension will calculate the asset with the highest cost, as well as sending the value of all your assets to your server, and try to withdraw money. It looks like this.

Extension changes the structure of the output window to force the user to enter the data (MD5 hash value – while testing I changed it to that control). During testing I had 100 pounds, so you leave 3 percent.

This occurs each time a page loads with your accounts, sothe user may accidentally start the output. Tricky. Therefore, the extension steals your login information to the exchange and tries to get you to confirm the transfer of funds to fraudsters.

the

Where do you send the funds?

Attackers have the following addresses:

the
    the
  • – 16EegrNMdZ9Rxku6Za5neEFjMW57wkQr1s;
  • the
  • – 0x03b70dc31abf9cf6c1cf80bfeeb322e8d3dbb4ca;
  • the
  • – 1PCh7w6LdcEv1sWd5wtvkELHcWe5HumUi3;
  • the
  • – LRPChoyN8qLWENjo1dUjk2bESZjE7bQ6sp;
  • the
  • – 0x03B70DC31abF9cF6C1cf80bfEEB322e8d3dbb4ca;
  • the
  • – rGmdGrMjvxt6S3VjF4M78U2YMLPR6XLPsn;
  • the
  • – 0x4F53C9882Ba87d2D7c525dF2aEF2540efb6e32e5.

Since the launch of the extension in the Chrome store 3 Dec 2018 attackers stole 23,23550279 BTC. Information will be true, assuming that these addresses are used only for this expansion, and through them were only stolen funds).

the

What are the secrets we discovered?

the
    the
  • addresses of the attackers.
  • the
  • servers and domains;
  • the
  • code comments in Russian – it is very likely that these are Russian.

We also covered the domain of the remote server, so those who have the extension will not become victims. But we still encourage you to remove the extension from browser and change email and password in all cryptoservice used.

The Extension was performed malicious actions on the following platforms: Exmo, Coinbase, Hbg / Huobi, HitBTC, Binance, LocalBitcoins, Blockchain .

How to protect yourself?

the
    the
  • do Not install unknown programs that annoying request access rights;
  • the
  • if you suspect something, perhaps it is;
  • the
  • periodically analyze the extensions that are installed in your browser, and delete unused;
  • the
  • if the browser extension you use, look for the version of/alternative to open source or disable automatic updates Chrome store. Check the code or find a reliable person who can do it.

More data to search for .

Recommended

CRYPTOMACH / Maximum exchange rate of Bitcoin in the future, the output of the crypts on the map, Ycash and the Board of Finance

CRYPTOMACH / Maximum exchange rate of Bitcoin in the future, the output of the crypts on the map, Ycash and the Board of Finance

the long-awaited summer. Niche cryptocurrency supported the event and gave unusually hot week. During the last seven days, we learned about the new line of graphics cards from AMD, the mining in TON and hard forks . In addition dealt with the profita...

Rally Bitcoin — deception. Well-known economist advises to invest in gold

Rally Bitcoin — deception. Well-known economist advises to invest in gold

Director of Euro Pacific Asset Peter Schiff does not see anything supernatural in growth . Recall that the main cryptocurrency has already risen by 179 percent since the beginning of 2019 and is now trading at the level of $ 8540. According to Schiff...

May 2Miners: run pools Aeternity, the debut 2CryptoCalc and software upgrades

May 2Miners: run pools Aeternity, the debut 2CryptoCalc and software upgrades

the Last month of spring proved to work. The team started working on launching (AE), the addition of which the majority voted representatives of the community. Calculator profitability of mining Alexei Rubin moved to the domain and now will develop e...

Comments (0)

This article has no comment, be the first!

Add comment

Related News

Co-owner Bitcoin.org Coinbase Pro ridiculed and called a stock exchange Scam

Co-owner Bitcoin.org Coinbase Pro ridiculed and called a stock exchange Scam

co-Owner Bitcoin.org and most popular forum about cryptocurrency Bitcointalk.org Cobra called Coinbase Scam Pro trading platform American crypto currency exchange Coinbase. In his tweet he wrote «if you read Coinbase Pro back...

The Ethereum is a cryptocurrency Scam. A new report Chainalysis

The Ethereum is a cryptocurrency Scam. A new report Chainalysis

When people learned how to create a new cryptocurrency and began to build their infrastructure like marketplaces, in the field began to appear and fraud. According to blockchain auditor Chainalysis for the past two years, fraud in...

VEB and the Grozny mayor's office transferred the housing sector on the blockchain

VEB and the Grozny mayor's office transferred the housing sector on the blockchain

In February, the first Deputy Chairman of VTB Olga Dergunova positively the prospects of the blockchain. According to her, the technology will improve the speed of transactions and security standards. To move from words to action ...

Hacker 1337. How to hack Etherscan not to cause any harm

Hacker 1337. How to hack Etherscan not to cause any harm

Monday on the website Etherscan.io appeared a pop-up message with the numbers 1337. The visitors began to panic and spread rumors about hacking Explorer. really hacked, but the damage from a hacker attack was zero. About it writes...

Who is a Bitcoin maximalist? Detailed answer

Who is a Bitcoin maximalist? Detailed answer

Criptural is more than the largest markets in terms of capitalization, the graphics and the constant fluctuations. Still at least there are so-called Bitcoin maximalists. Often this name causes a lot of confusion, so it's time to ...

Bitcoin and Nasdaq — not the best Union. The opinion of the head of development of blockchain-based products

Bitcoin and Nasdaq — not the best Union. The opinion of the head of development of blockchain-based products

the second-largest us stock exchange Nasdaq has recently announced the planned optimisation of business processes. According to information in the task list is the implementation of a system cryptopedia, however, about the questio...

Why the whales pose no threat to the stock market

Why the whales pose no threat to the stock market

Yesterday, the analysts Chainalysis had a pretty interesting webinar about the myths of the stock market. According to them, the whales with huge amounts of BTC for their own accounts do not bear almost no threat to the industry. ...

One activation Constantinople for Ethereum a little. What update you need?

One activation Constantinople for Ethereum a little. What update you need?

the Successful Constantinople one step closer to the community for the transition to Proof-of-Stake. Hardwork had to activate it in 2018, so that the event itself took place later than originally planned date. Despite this, the de...

Head Binance defended the procedure of delisting on the stock exchange. Why is it necessary?

Head Binance defended the procedure of delisting on the stock exchange. Why is it necessary?

In February, the largest crypto currency exchange Binance excluded from listing several alternative cryptocurrencies. Then one of the possible reasons there was a discrepancy in the standards of the exchange. Many users began to c...

On the rise: custodial services Fidelity Digital Assets started with a closed group of clients

On the rise: custodial services Fidelity Digital Assets started with a closed group of clients

Custodian service starts working in test mode — reported by the office of the Fidelity of Digital Assets. Now, the platform is «with a closed group of verified customers». Recall that the operation Fidelity is one of the...

Bold statement: Craig Wright allegedly may disclose all transactions in Monero and zcash for

Bold statement: Craig Wright allegedly may disclose all transactions in Monero and zcash for

the Main supporter and the alleged Satoshi Nakamoto recently entered into a verbal altercation with the main developer of Monero Ricardo Spani. Craig Wright first made a few serious attacks to the side and . Spanyi such statements...

Why Bitcoin will become a global currency? Expert's answer

Why Bitcoin will become a global currency? Expert's answer

From the moment of generation of the first unit and to date has gone a long way. Probably, now the cryptocurrency is a even more than the wildest expectations of Satoshi Nakamoto. One of the developers of applications for Network ...

Better late than never: a well-known economist has admitted he was wrong about Bitcoin

Better late than never: a well-known economist has admitted he was wrong about Bitcoin

well-Known economic historian Niall Ferguson admitted he was wrong about . Ferguson has made a huge contribution to the development of his scientific discipline, for which he was recognized as one of the most influential people in...

The crypto Samsung Galaxy S10 was without Bitcoin. The only supported Ethereum

The crypto Samsung Galaxy S10 was without Bitcoin. The only supported Ethereum

the Internet literally blew up when rumors of the output flagship smartphone Samsung Galaxy S10. One of the main topics was the possible support of the cryptocurrency through Blockchain app Keystore. Initially it was about and , b...

Study: Bitcoin will overcome its historical maximum in March 2021

Study: Bitcoin will overcome its historical maximum in March 2021

again, recall that the cryptocurrency ecosystem is fragile and very volatile, so there is no single correct prediction regarding their prices. And yet, numerous experts try to succeed in this difficult craft. one of them is joined...

Seem went off. Tipping in bitcoin

Seem went off. Tipping in bitcoin "lightning" attracted 14 million new users

the New Protocol continues to storm the audience of Twitter. At least one of the application — really shows off the blistering speed of propagation. As told Bitcoin Magazine Creator utility Sergio Abril, he «stunned» int...

Eugene Kaspersky: the world is not yet ready to transition to Bitcoin

Eugene Kaspersky: the world is not yet ready to transition to Bitcoin

the World is not yet ready to cryptocurrency — that's considered one of the top experts on cyber security Eugene Kaspersky. In an interview with Arabian Business CEO of Kaspersky mentioned the benefits of digital asset compared to...

Obstacle course: you need Bitcoins for the new bullrun?

Obstacle course: you need Bitcoins for the new bullrun?

Can not be distracted by short — term jerks- now only $ 4,500 level plays a role. Its break will open the bulls the road to growth asset for the next month. Until that happens, to open long positions on the pair BTC/USD is meaning...

The Russians will be obliged to undergo identification for operations with cryptocurrencies

The Russians will be obliged to undergo identification for operations with cryptocurrencies

the Anonymity of kriptosistem in Russia does not Shine — in the state Duma is preparing an amendment to the digital assets, according to which for operations with cryptocurrencies will first need to pass a special identification. ...

Minimalism: a new hardware crypto fits in the SIM card slot

Minimalism: a new hardware crypto fits in the SIM card slot

American startup VaultTel released tiny cryptocurrency hardware wallet, which you can hide the SIM card tray. According to the company, the wallet combines an app and a map Intellichip for storage of private keys on mobile devices...