wordpress blog stats
Connect with us

Hi, what are you looking for?

Google has removed 49 malicious Chrome extensions posing as crypto-wallets: Report

Google has removed 49 Chrome extensions from the Web Store that were posing as legitimate cryptocurrency wallets, but contained code that stole crypto-wallet private keys and other private information, reports ZDNet. The extensions posed as well-known existing crypto-wallets such as Ledger, Trezor, Jaxx, Electrum, MyEtherWallet, MetaMask, Exodus, and KeepKey.

The extensions were discovered by Harry Denley, security director at MyCrypto, who said that all 49 extenions seemingly were put together by the same person/group, believed to be a Russia-based bad actor. Malicious browser extensions have always existed, but the brands targeted this time are new, he said in a blog post.

How it worked: Users added the extensions, having no reason to believe that they are not bonafide, to make crypto-wallet transactions. The extensions phished for the user’s personal information, such as mnemonic phrases (a group of words to recover your crypto wallet), private keys, and keystore files. Once the user enters their data to the extension, the data is send to the actor’s backend, or to a Google Form, where the bad actors receive the secrets and empty the accounts. After sending your data to the backend, the extension sends the user back to default mode, Denley explained. This results in the user getting frustrated and submitting secrets again, or the user uninstalling the extensions, even though their wallet may be drained of funds eventually.

However, thefts don’t happen immediately. Denley entered the credentials of a test account into one of the extensions, but the funds were not immediately stolen. He told ZDNet that the threat actor may want to steal funds only from high-value accounts, or hasn’t figured out a way to automate the thefts and thus has to access each account manually.

But they are happening. Denley has tied at least three publicly reported incidents (herehere, and here) of funds theft to one of the 49 extensions. The highest targeted brand of the crypto-wallets was Ledger (57% of extensions), followed by MyEtherWallet (22%).

Extensions had fake reviews on Web Store: Some of the extensions had a network of fake users rating the app 5 stars and giving simplistic positive reviews, such as “good,” “helpful app,” or “legit extension.”

One extension did stand out by having the same “copypasta” around 8 times, authored by different users, sharing an introduction into what Bitcoin is and explaining why the [malicious] MyEtherWallet was their preferred browser extension

When the extensions became active: The extensions began to show up on the Web Store in February 2020 and increasingly released in March 2020, and then increased them even further in April. 63% of the extensions were published in the first 14 days of April.

You May Also Like

News

Loon, Google parent Alphabet’s ambitious project to provide internet access to underserved areas through balloons carrying radio equipment, has been shuttered, the company announced...

News

Google has signed a deal with news publishers in France to pay them for content appearing as preview snippets in search results, the company...

News

Hyperlocal e-commerce company Dunzo has raised $40 million from new and existing investors including Google, Lightbox, Evolvence, Hana Financial Investment, LGT Lightstone Aspada, and...

News

You’re reading it here first: After several months of deliberation, India’s leading crypto-currency exchanges have finalised a code of conduct policy to be followed...

MediaNama is the premier source of information and analysis on Technology Policy in India. More about MediaNama, and contact information, here.

© 2008-2018 Mixed Bag Media Pvt. Ltd. Developed By PixelVJ

Subscribe to Daily Newsletter

    © 2008-2018 Mixed Bag Media Pvt. Ltd. Developed By PixelVJ