Adware vendors buy Chrome Extensions to send ad- and malware-filled updates

[Gunzkewl]

 

by  Ron Amadeo 

 

One of the coolest things about Chrome is the silent, automatic updates that always ensure that users are always running the latest version. While Chrome itself is updated automatically by Google, that update process also includes Chrome's extensions, which are updated by the extension owners. This means that it's up to the user to decide if the owner of an extension is trustworthy or not, since you are basically giving them permission to push new code out to your browser whenever they feel like it.

 

To make matters worse, ownership of a Chrome extension can be transferred to another party, and users are never informed when an ownership change happens. Malware and adware vendors have caught wind of this and have started showing up at the doors of extension authors, looking to buy their extensions. Once the deal is done and the ownership of the extension is transferred, the new owners can issue an ad-filled update over Chrome's update service, which sends the adware out to every user of that extension.

 

We ought to clarify here that Google isn't explicitly responsible for such unwanted adware, but vendors are exploiting Google's extension system to create a subpar—and possibly dangerous—browsing experience.

A first-hand account of this, which was first spotted by OMGChrome, was given by Amit Agarwal, developer of the "Add to Feedly" extension. One morning, Agarwal got an e-mail offering "4 figures" for the sale of his Chrome extension. The extension was only about an hour's worth of work, so Agarwal agreed to the deal, the money was sent over PayPal, and he transferred ownership of the extension to another Google account. A month later, the new extension owners released their first (and so far only) update, which injected adware on all webpages and started redirecting links. Chrome's extension auto-update mechanism silently pushed out the update to all 30,000 Add to Feedly users, and the ad revenue likely started rolling in. While Agarwal had no idea what the buyer's intention was when the deal was made, he later learned that he ended up selling his users to the wolves. The buyer was not after the Chrome extension, they were just looking for an easy attack vector in the extension's user base.

 

CONTINUE READING HERE

Source:

http://arstechnica.com/security/2014/01/malware-vendors-buy-chrome-extensions-to-send-adware-filled-updates/ 

 

Here's a link to an AMA of one of the developers of a popular Chrome extension that have been approached by malware companies to buy them. 

http://www.reddit.com/r/IAmA/comments/1vjj51/i_am_one_of_the_developers_of_a_popular_chrome/

 

 

 

[–]gemusan [S]

We were approached by a company that wanted us to replace all Google ads you see with their ads that look just like Google ads. You wouldn't be able to tell the difference. That one's pretty clever.

 

Here is a list of some extensions you should be careful with.

 

• Add to Feedly
• AwesomeNewTabPage
• ChromeReload
• CrxMouse (supposedly anonymized tracking)
• Hola Unblocker
• HoverZoom? (FWIW the author denies it)
• Neat Bookmarks
• ScrollToTopButton
• SmoothGestures
• Smooth Scroll
• Translate Selection
• Tweet This Page
• Webpage Screenshot Capture
• Window Resizer
• Youtube Ratings Preview (Creator said he declined an offer after popular pressure).

 

Source:http://www.reddit.com/r/technology/comments/1vir7a/chrome_extensions_are_being_bought_out_by_malware/

 

 

I had to change Hola unblocker and HoverZoom after reading this. If you know good alternatives for the other extensions please feel free to post it. 

HoverZoom ->> Imagus

Hola Unblocker ->> Proxmate, Zenmate, MediaHint.

 

I know it's hard to monetize on extensions so that's the reason they sell their extensions but It sucks that extensions creators don't give a damn about their users. Until someone comes up with a model to easily monetize on extensions or Google starts to review extensions I don't see a way to fix this ASAP.

 

[Kilerbomb]

Dammit I have like 3 of the extensions listed. Why does EVERYONE have to be a sellout? 

[Yoinkerman]

chrome has extensions?

[Gunzkewl]

chrome has extensions?

Yes sir.

https://chrome.google.com/webstore/category/extensions

[Razarza]

Imagus is awesome, I first changed over when the news about Hoverzoom came out. It has all the options you will ever need and can act pretty much the same as Hoverzoom (without the adware) if you want.

[ThePcMasterRace]

Only 1 extension- ADblock plus and if they become a sellout im going to go commit suicide

[XTankSlayerX]

IE 11 FTW!! But, on topic... This is stupid... Everything has to have a twist to it...

[AlwaysFSX]

Only 1 extension- ADblock plus and if they become a sellout im going to go commit suicide

They did, like 2 months ago?