Buffy Vs. Phishing: Slaying Cyber Threats Sunnydale Style - Andreea Mihai

Thank you. My name's actually Tasha. >> Thank you. Thank you all for coming. I was really expecting an empty room. So, it's really nice to see everyone. Thanks. And I hope they bore you. So, um, today we're talking about Chrome extensions. We'll be looking at some headlines cuz I'm sure some of you have seen it all in the news about different attacks that have been happening. We'll look at what exactly a Chrome extension is, how they work, operate, and how we can manipulate that. and then we'll see a real life case example of how someone utilized um crowd sension and managed to gain access to several systems. So a little bit about me, I am Tasha

Armstrong Godwin. I work at Electronic Arts game security. I also do um some consultancy work and I've kind of floated around. I've kind of been in the intelligence and cyber security space for about 20 years. So, cyber security bingo. I have got quite a few check marks. I've been really fortunate in my career. Haven't had CEO yet. It's quite well. I'm drinking coffee. So, um if anyone wants a CEO position for me, that's great. Speak to me office. Um looking at news stories then. So, there are thousands of different views of um Chrome extensions in the news. But when you actually take a look at it and you filter it down, there's two aspects to the news stories. There's one which

is a malicious extension has been uploaded and people are downloading it thinking it has a genuine use. So like a Trojan and then you have some legitimate extensions with legitimate businesses behind them and they've been compromised. Where do you download a Chrome extension for? So I spoke to some people earlier and they haven't actually used any. So hands if you do use Chrome extensions because I thought it's quite ubiquitous thing you all know what I'm talking about. It's great. So, we've got the Chrome web store if you wanted. This is Chrome extensions. Um, you can also go to different websites where you can download them from. You can also get them delivered through malware, which

I'll give an example of later. And also, businesses push them through GPO in June because they want um people to use different variations for your day-to-day jobs because it does make things easier like password managers and things. So, how common are they? Well, these were updated yesterday. So, these are all new stats from GR stats. Um, you can see there's quite a lot of pros. Now, there's not millions cuz like some people expected millions of downloads and millions being available, but if this number was my bank account, I'd be really happy. So, I think there's a good amount there. And also, it just needs one extension to be installed to cause a lot of impact to your business or you

personally. So, finding that one malicious one and a huge number is going to be quite hard. Um, it's not just Chrome extensions that are available. We also have Edge add-ons which are the equivalents and then we have Firebots which is there again they call an add-on. So how do you install them? Well, according to the developer page of Chrome, you can install them through your registry, but you can um these are the locations as well if you're going to install it via JSON, which is another recommended way that people can install them. And then you can also download them in the Chrome web store. If you have DRX file, is just dick or add it in through

that way. Excuse me. They're located in these main paths. These are the main directories that you can have a look at them. Um different variations again according to your OS. And these are the ID so you can find out how they're installed. Um sorry again. So yes, remember here this is the ID for the Chrome extension. This is something I will be looking at later because each Chrome extension has a different ID. Um, you can search for these using IDs in the Chrome web store online as well. There's several hits where you identify this OC, especially if you know this is a bad extension. That's your ID that you're looking out for. So, they're quite useful to look at. Um, you can see

them on the web store. You can see them in your extension in your browser in a little jigsaw which I'll come later. It's popping up. I'm so sorry. And then you can >> an extension.

>> Right. So we'll address the extension. What is an extension composed of? So an extension is a piece of programming software that helps you with your experience interact with your operating systems. It's trying to make your life a little bit easier. It consists of mainly four components. You have your popup that we saw earlier. Um you also have your manifest which is like a declaration of all the components of um your extension. You have your background tasks and you have your content scripts. These are normally JavaScript files um that you can have a look at and play around with. You want to see it in action. You load up your web page and you right click um to view

source or F12. Hit inspect and um enter sources. You will see your different extensions in you'll see the script running that I'll show you. It's easier to show. Oh, ignore that. Sorry.

So go to inspect sources.

You go. There's dash links for my extensions and see the scripts working here. So you can have a look through the scripts and see how they operate. You can also check them if you wanted to. This extension is being a bit naughty. Oh, go away. Does everyone see that? Cool.

That's like

Thank you for holding.

You did say download it. >> I did. >> I said no. The in fine

>> cut this out the recording, please.

Just touch up.

Can you still see? We'll just talk about like this. I don't want to bore you. Anyway, like I was talking about, you do have Chrome extensions available um through your websites or your browser that you can view. So you can see here I've got Chrome extensions by just

I have done this tour before. It worked well last time. Here you can see all of the extensions that I have installed here. There's password measures. Um there's one I'll come to later and efficiency like you might like you having Google and things attached to right all of you almost all of you put your hands up when you said that you use Chrome extensions when you downloaded them installed them did you check your permissions >> yeah brilliant cool so these are some of the key permissions that can be really invasive to your machine So you guys obviously know about this, but just for those that don't, um, there are different permissions across which your extensions will pull to be able to run

on your machine. Some people don't actually use them. Sometimes they're needed according to the extension. So like password, they will need to interact with each page that you use. Others won't. So is a good indicator when you're downloading your extensions to see does this use purpose of my extension match what it's requesting permissions cuz if it's over permissive then that's something suspicious and maybe I should be a bit cautious when I download it now I would like some volunteers put hands up yeah want to stand up any volunteers yeah stand Cool. Thank you. >> Oh, no. >> Yeah. >> Don't look. I have hot spots. Don't know why it's not.

And it was all working before I came on.

I'm on full signal. Why is it not working? >> You want to do the presentation? I'll do the tech bit. >> Yeah, I'll do. >> Well, I need to hide some. So, we're going to keep going. You're going to look at different permissions that your essential use and I want you to guess percentage. How many of these download are downloaded using these and see if you can guess in the right key points and I'll try this if you get it working. >> I'm so sorry it was working.

Yeah.

>> Well, you can ask the question >> um the Christmas tab. So, this permission gives you Don't cheat. This permission gives you access to read everything on your tab you're currently open. What's your percent guess? >> Do we think it's high in 20? >> Yeah. All right. Some guesses then think it is >> 75. Any other takers? 85 >> 85. Any others? >> 65. >> It was 60%. We've got one point. Well done. >> Right. >> You can get Sorry. So, we're going to look at storage permissions, which is where they um the data will persist between sessions. So, again, give me a percentage. >> 70. >> 70. Like your confidence there. Thank you. 55

>> 55 >> 45 98. >> Who was the highest? Is that you? >> Yeah. Well done. Point to you. >> Right. Web request and web request blocking. So this intercepts all the traffic. >> What do you think? >> 100%. >> What do you think? I go 90 >> 90%. >> Oh, okay. >> 15 to 20%. Well done. >> Oh, two points. Well done. Right. Right. Clipboard reading. So, copying all your clipboard data. >> 40.

>> Just cuz instructions. Tell me >> also >> 10

>> 40 >> 10 60 40 Well done points you >> postmission. So this can access all your websites, all your all your URLs, right?

20

>> 100

lo I like it less than 50 did you get >> 50 okay so point each then >> right so how many points did you three >> three. Thank you for paying and merry Christmas. >> Thank you for one. >> So being mindful some of those numbers were really really high. really over permissive permissions. So just be careful when you're using them at work. Sometimes if you think this will be really handy with making my life easier, maybe it's making your life easier for a reason it's being deceptive. So just have a look at the permissions. Right, we've talked about extensions. We've said about where they come from, how to use them. We talk about building

our extension. So we know it's got four components to them. First place any D goes to when they're looking how to build something is get seen someone's done it already right because we rebuild the wheel and luckily Google Chrome have templates that you can use so here again you can see the four components we need for our web expansion push button sorry here you go you can see it's all tight now I am not a coder but I can jazz code I'm sure some of guys learning how to j code. So if we put in our prompts in our llms and say I really want to write some JavaScript that can do something for me

whatever I can think of it prints out and then we can deploy it to our Chrome extension and it will run maybe needs a little bit of tweaking testing but some of the stuff that I was doing actually worked first time which was really scary. Please explore it though because it's really interesting how easy it is to do. And just to prove that I was doing some Chrome extensions, I go into my Chrome extension tab. I have a look at the Chrome extension available. And you can see I

So what an adversary do they've got access to the heads? I can show you how to write extensions. Well, there's loads of different things they could do. So, we've already discussed at the very start that there are two types of Chrome extensions that could be a problem to you. There could be a legitimate one that has been compromised or it can be an afarious one that's available on the web. Now, there are multitude of different ways that you can have a Chrome extension that might be enticing to someone. Really popular ones are emojis because everyone's got hint, right? Everyone wants to express it. So they're really really popular. There's thousands of them on the web store. Um

there's different ways you could look at your file drives. There can be password managers. Anything that you can think of you could craft using LLMs and the GitHub repository to make a extension that will help you or help you get into something that you want. Um we discussed how you can over permission the extension to try and get access to all of the bits that you want from your victim machine. Um, oh, there's also I didn't talk about hiding the extension. So, there are ways that you can deploy it through an email to say, "Hey, I really want to share this file with you. Send out a fish. Say, download this extension and help you access the file

that you need to have do your work." Here is a really good um piece of tool kit I really want you to have a look at. Here's a file. Do you know your boss has done something really naughty? Check this out. and then it gets hit. So are people actually using these militia successions are actually taking over not we've seen the news stories so we know that's happening but what are they doing? How are they doing it? I want to give you an example of last Christmas because this is Chromalone Christmas themed. Last Christmas Cyber Haven had a really unfortunate Christmas. Now I did give this talk a bside. So apologies if you've seen it

and I have changed this talk since then because interestingly enough there were actually people from Cyber the Haven that were there and they'd actually worked on it and they gave me an inside scoop. So I've edited this based on their feedback and it was really interesting some of the things they were coming back with. So this is a timeline. And I don't know if some of you saw the talks earlier and they were talking about how some of these attacks that they've seen and they were talking about in the wild stemmed from a black hat or a defcon tour and this is no different. This started off with a death tour of all this last year and then we started

seeing all these graph sites pop up that would later go into these extension takeovers compromises. Um, like any good old attack before clip bits, it was a good old fish. And this is the email that was sent in December on your Christmas holiday to say there was a problem. We need you to fix this. And of course, it's Christmas, so you're not really paying much attention cuz you're thinking, I want to go back my holiday, but this is this looks urgent. I'll quickly rush through it. It was made directly from the Chrome web store. When you click on the policy, it took you to a legitimate Google site. Admin puts in their password. Password wasn't compromised. This was a

legitimate process from Google. But by entering one of these credentials, they were actually allowing the adversary to have access to their system without realizing it. So it's a different style of technique. So what happens? Well, once the bver had access to go into their systems, they went into their systems, had a new round, had a look, find out that they had access to the Chrome extension that they were deploying to all of their customers. So, even if you're not aware, they offer support to various different customers and they had a Chrome extension to help them do it. And so, they looked at the Chrome extension, they uploaded two JavaScripts, and this is an example of one of them.

And you can see here that they are asking um the customer or the victim now to talk to CNC server. And you saw Ben's talk this morning. He did a really good presentation about how CNC servers work. So if you didn't see that, it's a good talk. So they edited the Java scripts, pushed out, even changed the version so it looked like it was legitimate cyber haven. and they pushed it out and um the way this system was sent out there was nmatic updates that got pushed to all of the victims. So the victims all they saw all the traffic was a legitimate upgrade of their extension. They didn't realize it was not in nature because it

was something they had a um customer vendor relationship. This was almost unexpected behavior. Talk about permissions played the game. You can see that permissions were updated with all the URLs and that JavaScript was updated and that document start was there. So every time you started a session started a page I'm trying not to b you. Okay. Um this this would run. We can see here that they're actually doing some credential harvesting and this is all on on a report. They did a really good report. So, if you wanted to see the report of the attack, I'll send you the link. It was really nice that they they wrote it up so nicely. We can also see that not only they stealing

your credentials, they're stealing your cookies, too. Cuz what's great about cookies? Well, it's pre-authenticated, isn't it? So, most people, they look for a malicious login. But if you stole in a cookie and you access the system, there is no malicious login or anonymous login or unlo you don't get that. So it's quite a subtle way to add this victim system. We also see that over QR codes. Sometimes people will have QR codes displayed as your authentication or to help in your authentication process. And we see the C2 was set up through Facebook. Talk this morning was using Telegram, but it was similar technique this time. It was using Facebook. And this is actually a capture of the

traffic. Um it's all basically for coded. So this is what they collected up off the victim and then they sent it to Facebook C2. So there are different threat groups that we've seen like using these malicious inventions. Um these are some of the attack stars and some of the names that we've given to them. and the wet bands in. So that was a legitimate extension that had been taken and compromised. These are the malicious extensions. Now here, this was a really big one that got published a couple of weeks ago. Um I've given the idea here. There was loads of news press when it was 25 of them extensions um were known to be bad. And

again, you can see permissions, all URLs. So it's trying to capture all of your traffic. This was another credential hosting one. Um, it made the news like I said lots of people were affected. Unfortunately, it was millions. Unfortunately, so these are all in the Chrome Web Store. You all download them from the Chrome web store. You would think Google has impressive measures, right? >> Loads. >> This is Google. Yeah. So, they don't actually, from what I can say, they don't actually publish much about security parameters. I do know people that work in Google and I was talking to them and this is what I could gain from them. So when they do a submission to

the website they run a quick script around it and they check like basic things like who the person was like the URL um sorry the email of submission. They also check if there's any privacy policies. They check the permissions and they just do a quick general review and that's done under two hours. Um sometimes if it's like a dodgy email that they've seen um if it's not affiliated to a known legitimate business they'll do another check on there which is like around 24 hours that they do that it gets reported or again there's something raised concern they'll do a deeper one and you can see it kind of escalates from there and they get a load

of submissions. So, it's not every single one is properly done. We've also seen with the previous extension that the attackers uploaded the code and then they sent out an update. So, if you want it to be really naughy, you could do a genuine extension. It gets submitted to the Google store, passes all of your Google security checks. So, brilliant. Start getting your customers. Great. Got really good reputation. Now I send my updates. Bypass all of the security. And now I've got my little ignore

checks after they've done their initials. Unless of course it starts getting reported, but by then I've already got trust with you and the damage is done. It's a bit too late. Then some big enterprises think it's fine. I don't need to worry about Google Censions cuz I've got an EDR. I've got antivirus. Well, not all of the EDR actually look at the Chrome extensions. Some of them are based on behavior. Some of them look at the processes and unfortunately due to the way that the extension is called in the browser, it get hidden. So, it still looks like a legitimate process. Still looks good. Some of EDRs won't detect it. Some of the EDRs won't even acknowledge

that you've got an extension on your system. So remember when I showed you in the very beginning with the um extension ID and the file path, you actually look for that in example to extension one and you can't find it because it's it's part of your browser. It's not not very scanners like black and can it but again you need to able to know what it is that you're looking for. So you already need to know that malicious ID to find it. So, still a bit of a gap. Still a bit of a gap, but there are some really good tools out there to identify malicious Chrome extensions and um things like layer, they do the extension analysis for you.

There's um Spin.ai and Pockman as well because it looks at all of the different behaviors of what the extension is doing. Chrome actually did an update yesterday and it looks really, really good. They've got um an API that you can pull down. They've done all of the um research around the extensions and so you can pull it into a sim and you can do little checks against the extensions that you have on your system against what they've looked at and it will give you an indicator whether or not you need to do this. So it's really good. I recommend you have a look at it. So defenses, how are we going to defend against these Chrome extensions? ODR

might not spot it. We haven't got promise that's checking in on our systems yet. Maybe we can can't pay the API. We don't know what you could do if you're a big enterprise. If you don't need it, don't have it. You can put blocks on your system to say I don't need this extension. Block all extensions. But I will allow you Google or as your or whatever it is you need for your business dayto-day. you can um have approval workflows to say if you do need an extension build business case as to why you need it. So you can again double check and audit what extensions you have. I've been to one company in a it's not EA the is

consultant. I went to one company and they didn't know what extensions they were having, what was being used. They have no idea. So it's always good to know your risk footprint and identify what you are not using. Again, educate your staff, educate your team, explain why these permissions are something that you need to be aware of, why you need to check. Sometimes, I know sometimes people think the security. They're just here to ruin my day. They don't understand actually. We're here to tell them we're not the fun police. We don't mean to be the fun police. We are here just to help you, help you work. And every time you have an idea like maybe

you should be doing this, there is a reason. So, explain that reason. Educate the staff. Verify publishers as well. Don't rely on email addresses. Some people say, "Oh, it's from the company. Must be really important. Must be legitimate. Check out that company." Sometimes people have verification processes where they look at the privacy policy. Look, I've been to this company. I've seen the privacy policy. Yeah, it all looks legit. And then you double check the domain. Well, it's been there 2 weeks. You look at the privacy policy and you think the company is 2 weeks old and it's really what I need. Are they lying to me in this privacy policy? And you look further into this

companies, it's a shell of an AP don't trust privacy policies and if legal department say no it's bankers privacy policy. That's always true. People lie. People are horrible. Not all people but some people are horrible. Um and check cons as well. If you are expecting to go to certain domains, certain countries, and suddenly going somewhere exotic, some are really nice that you don't really expect traffic to be going to, start exploring as well cuz maybe that's your assumption with a C2 cuz some people don't consider extensions as a possible attack source. So when they're checking where compromises come from, why am I sending all this data to the Philippines? they don't consider could be from this Chrome

extension that I've downloaded and it's nice all my data. So summary, we looked at different ways that you can store your Chrome extension, the four components of a Chrome extension, how how it all works with JavaScript files, how permissions can be win prizes, but unfortunately the prizes go to the web bandits or characters. Um, but there's two main attack vectors. There's the good extensions that can be compromised or there's the right malicious ones that tend to be your best friend. And then I've shown you how you can look at what codes what the code is, how to look at the code and expect what the code is doing, see if it matches up to your

expectations. And I've also hopefully tried to explain different ways that you can defend against it. Any questions? I'm so sorry about the full presentation. Next month I'll download I promise I learned my lesson. >> So I Google Chrome extension. Um and one thing I want to include in your next talk is how I'm a target as a developer. >> Yeah. I get offish emails saying we want to promote your app you want to make your app more um user focused and say give us your code and want me to change my code for them. That's one measure and also Google should be strict with everything now. So I'm a dyslexic right. So I had to upload my Google Chrome

extension like five times in the last two months because I missed full stop. If I miss a full stop in the description, I have to go through the process. >> You put that code there. That's what you >> go through the process all over again. My last one took two weeks for them to read everything. It was exactly the same code. It was the description. >> Why did you submit if you didn't ask? >> Um, all too much. And every permission you make, you have, you have to have a justification as to why. >> Yes. My my Google Chrome extension needs every permission available to keep it safe for life. I have to justify the permission. Now my

Google Chrome extension will if the child's going on a pornographic website, right, it will block it. But it doesn't actually block it. Makes overlay because I said block, not overlay. I had to resubmit everything again because they they determined that I wasn't blocking. It was overlay. I had to re resubmit everything again and say no okay it's not locking it's an overlay right so they have got very strict with like rules in the and I understand why I do understand why cuz people like my fault for the email go ahead and change and do the wrong code so they have a lock with their with security and it's >> so this a first submission sorry

>> is it a first submission or is this an update that you're doing >> so if it's a first submission That's that's that's my first submission. Um took two weeks because the mission's available right now. I had to resubmit because I made a typo error in the description. I didn't change the code. It's just the description. Right. And I had to wait like 48 hours for them to read the description to make sure it matches permission. So that they are kind of like really on the ball now. So it's really tricky. I understand why they think it's cool. I do think I do think it's cool but I would say yeah just look into look into how like as a

developer your job is because >> yes >> it does like it's all automated you have to give an email as well and your email your email as a developer account you have to have a wallet of money that aren't attached to your account stop your identity >> you understand why but that makes us as developers as well so yeah bear that in mind that's another way of doing fishing your actual development. >> Thank you for sharing. Thank you. >> Um >> um thanks for your talk. I feel like you cover that in your just don't know if you missed that. >> Um amazing talk is have you found so if you tra is there a lazy option like then go is

that my mine lazily cuz I'm addicted and I can't have too many. It literally says my mouth. >> So is there a switch option? Is there a message >> there? So they're all the same thing basically. But I like your question. Thank you. It gives me an opportunity actually to go into stars for you. So part of the update that they did which is yesterday was They have a um where was it? One one of my bug bears with Google Chrome is if you download a milit extension and it's been flagged to them and they do the work the identify as being bad they'll just pull it from the website and they won't tell you and I

think that's really irresponsible of them. I think they should notify you. Chrome stats also agree with me and yesterday they put out a list where any extension that's they monitor it and any extension that's pulled they will notify you. I did find it last night. Do you mean if you have it downloaded by users? >> If if it's been pulled from the web store, >> they will then publish it on their website and then with their API, you can then pull that data and then compare it against yours cuz there's going to be an ongoing risk as you're using because they are really useful. I'm not telling you don't use them. I'm just saying use

them responsibly. And it's hard to know when it's legitimate and it's been compromised. You just don't know. So you you kind of rely on the punity as it were or you can even I guess identify if it's been updated and then check the update before you you implement it. But sorry I was updating everything late last night and I can't find it but is in here somewhere. There you go. Recently removed. So if this is just free that I'm viewing this in, but there are APIs that you can pull and do this automatically. I don't want to tell you. So if anything, just have a look at this website, please see what you think cuz I

I'm not a shareholder or anything and that I just need to read the Oh, did I see you? Sorry. >> Yeah. Um the the one example you said is use a legitimate um extension and and then basically changes and I wasn't quite understanding how it works because it's I'm assuming the updates come through to the Google store. So the >> no it goes between so I'm your customer and you have your extension and then you say you've updated it. will then push it to me directly because it's it's a partnership between us. Yeah. Is um just coincidence that you can access it through >> through the app store >> and I'm assuming from the app store the

code we signed check it's only checked on download update and it's stored on my machine. >> Sorry. >> So I was assuming the code would be signed when it comes in the Google store. So it will be signed because you're the developer, but it will be you. So when I was saying earlier, there's different ways that you can get a Chrome extension. >> Majority of companies will publish on the web store, but if I'm a paying customer for your extension, it can be direct relationship. So it'll even still be signed because >> we've got that relationship. It's just that they've tweaked by >> Okay. So So I still have to get the developer to resign and

I think he's asking

No, no, no. Sorry. Thank you.

>> Yes, that was the one I >> Oh, was it? >> Sorry. Yeah. We went through using Microsoft

getting the ID kind of see what the IDs were in search

and we found we use these Google Chrome extens and vice versa. So we had to explore the ideas and then look in both stores. Yeah. >> Yeah. Because the technology is the same. >> Yeah. >> Thank you. But yeah, cost associated with submitting to manual reviews. No, >> not a lot. We use like excavate. I think >> that's not available anymore. >> It's been a while since I used that to be honest with you. >> How would you if you don't have those? How would you like to guess do I check it? >> Chrome. >> Chrome. >> Yeah. If you go to some of the

um

here >> I've just clicked on any any extension here you can see the permissions. You can see all of the data that's been submitted around it. You can see some user reviews. It's like the next best thing cuz I love seeator >> and it hasn't been available for a year. I've been most upset. >> Yes.

>> Sorry. >> Oh, sorry. When you install Yeah.

>> Oh, >> no. No. >> I know him. It's He's naughty.

>> Yeah. Are there any other edrs you recommend that can give you some visibility? >> EDR I'm not too sure but there were some browser based ones that were really good like layer layer cuz they sit in your browser and they have an extension that monitors all the extensions. So we cross

Okay, thank you folks.