27 Aug Are you installing malicious browser extensions?

Browser extensions provide convenient features when used correctly. That’s an ideal scenario, but unfortunately, today’s app markets and plugins house a dangerous number of malicious plugins utilized in numerous phishing and malware schemes.

What are malicious browser extensions?

A malicious plugin’s intent is to steal data, harm a system, and siphon otherwise sensitive information from a target computer/device. This is done by accessing a system’s permissions. A browser extension can “request” access to virtually anything if it’s granted permission. Therein lies the danger: knowing whether said plugin is malicious.

Like a majority of phishing attacks, hackers use trustworthy names or recognizable corporate brands to achieve success. Malicious plugins also ride on the reputation of helpful extensions, those that aid us in our professional or personal activities. From discounts, spelling, image media, and any other convenience you might think of, there’s no doubt a malicious variant of it. In some cases, a seemingly benign browser extension is updated and injected with malware, making it difficult to detect.

Who is threatened by dangerous web plugins?

Everyone.

Malicious browser extensions can impact anyone browsing online, from usage at home to upper management. The problem starts with tech literacy, or rather, the inability to recognize dangerous online mechanisms. People often rely on security pings to alert them to malware or similar online threats.

But browser extensions circumvent this much in the way all social engineering techniques do: by relying on trust in systems or names. Extensions can be found on legitimate online marketplaces before they’re removed, if ever. Therefore, one might assume said extension must be safe because it’s available in a legitimate space.

In other cases, malicious extensions will install from other malware variants. This can happen in multiple ways, such as downloading software with malicious “bloatware,” visiting unsafe web domains or granting permissions to unsafe websites. These days, it’s more common for hackers to take advantage of “desired” utilities, like browsers offering ‘discounts’ or even wallpaper extensions.

Dangerous extensions work because they’re downloaded willingly, filling a specific desire of the user. Again, let’s say a user wants a shopping extension for discounts, or something similar. If they download a malicious extension, they’ve inadvertently injected malware into their system. What the malware executes depends, but normally it’s for information theft, installing keyloggers, spear phishing attacks, and in rare cases ransomware.

Symptoms and problems

Unfortunately, most only realize they have a system infection until after it’s too late. Once infected, a system can suffer a range of different symptoms and errors. Depending on the severity, it can degrade performance, damage files, and even cause hardware failure.

Common Infection Symptoms

A few malicious extension symptoms and behaviors to look for.

Malicious Browser Behavior

Unusual browser behavior is a potential symptom of both malware infection and unsafe browser plugins. For example, are unwanted ads appearing with higher frequency? Do phishing links randomly appear in website text where otherwise they should not?

Symptoms like those and unusual changes in a web browser’s function typically indicate malicious activity. If you notice this after installing a browser extension, said plugin is unsafe.

Significant Slowdowns

Malware and keyloggers hamper performance significantly. Keyloggers track all keystrokes, logging and sending them to malicious actors, thereby making normal processes too slow – if not unusable. Additionally, all routine operations are impacted. Opening programs, writing text, accessing files, and even internet speeds can drag from malware.

Quick Malicious Extension Examples

For fast reference, here are a few examples of dangerous website plugins/addons to avoid:

• Fake security addons/extensions claiming to defend your system
• “Cleaners” for your system or browser/system; performing the “scan” instead injects the system with malware
• Fake file converters, such as documents to PDFs

Removing Malicious Extensions

The more pertinent question is how do you remove a malicious extension? Or, prevent their installation? If it hasn’t had time to execute a malware payload, the process is easy. If the system or network is infected, things get a little more complicated.

The best defense is a proactive one. You want to avoid downloading malicious extensions, rather than reacting to them.

Malicious extensions we have mentioned typically possess these characteristics:

• The browser plugin is requesting unusual permissions, like admin privileges or access to sensitive user files
• The plugin is very new with a small lifespan (2-3 months)
• The extension uses “official” imagery or claims to be associated with a business

If you suspect an adware or malware extension has been installed on your browser, now it’s time to remove it. In the best-case scenario, you simply need to remove it from your list of extensions found in the browser’s settings configuration.

However, nefarious plugins may not be visible. Some install as adware or malware. You can use “task manager” to check for unusual processes you don’t recognize, especially those that absorb large amounts of system resources.

Nefarious forms of malicious extensions need additional resources to remove. You can use your anti-malware software to run a quick check. However, if you can’t remove the plugin with anti-virus, you may need additional software. You can install secure extensions for your browser, ironically, to detect and remove dangerous ones. Ensure that it’s an officially supported one before installing it, otherwise, you’ll end up back where you started.

Third-party support

It’s frustrating when you inadvertently add malicious extensions to your browser. But even when accidental, dangerous extensions can cause numerous issues with your system’s functionality and performance.

In remote work scenarios and business settings, the impact can be catastrophic. It’s important to remain vigilant, limit install permissions, and remove any unusual browser extensions. In larger organizational environments, however, this is indeed challenging, as shadow IT and lack of network visibility can create dangers you are unaware of. In these instances, you should inquire about third-party security support.

For more information, contact Bytagig today.