Chrome: fake accessories injected code in web pages - "TechnoTron"
Index:
Prologue
1 Look around... but you also infect
2 What to do if you downloaded the plug-in?
Since few days ago, in our research lab, we have a growth in the number of detections of the JS/Chromex.Submelius threat. In some countries in the region like Colombia, Peru, Ecuador and Chile, its percentage of detections has been between 30% and 40% of the total of each country.
It's a Trojan, which redirects the browser to a specific URL that contains other types of malicious content. Given the high levels of detection of this threat, which is focused on affecting Chrome, one of the most popular in the present day web browsers, we realized the task of finding the way that this threat is spreading and how auser could fall into this trap.
For those who have ever visited such sites, this behavior should not be strange, since usually open those annoying windows that say "virus detected" or "work from home and make money". However, in this case the browser not redirected to another page with advertising as usual, but that leads to a site that asks you to go to another URL... and even that is do not click "Accept", not to appear the message.
This redirect points to the download of a complement from Chrome Web Store. In the following screenshot is the address bar of the browser until the add-in is installed:
If the user accept the download, appears a space beside the address with the complement icon bar, and if you click on it, goes to a new page with in Chrome Web Store that belongs to another new supplement. In this case, as you can see in the following screenshot, there are some recent comments about how useless that is this application:
Although at this point the playback of the movie has already started, the user's browser has been infected. Try to see the plug-ins installed on it, we find that is initially unloaded and that, with in the permissions you have, is the read and modify data from the visited web sites. This leaves an open window so that when the user visits a web site giving some kind of code on it:
In this way, while the user browses the Internet you can see how suddenly open you new windows with information from your system, taking it to download malicious code, advertising or other content sites. This leads to an infinite loop that ultimately is going to help who is behind the deceptive snap.
Where you've downloaded this malicious plug-in, you must remove it immediately of the Chrome browser. To do this, you can write "chrome://extensions" in the address bar and a time that you find it simply remove it.
As a precaution you should scan your computer with a trusted security solution torule out that you could have downloaded some other type of threat to your computer. In this case we recommend using our free ESET Online Scanner solution thatworks directly from the web browser.
As always, it is very important to be careful before you click and pay attention to web sites which are accessible, especially if they ask to download plug-ins. We've already seen other campaigns associated with Youtube, Facebook and other sites that have similar characteristics.
Therefore, we see that this type of campaigns are not isolated; in fact, there is a whole structure of redirects that will be described in more technical detail in a future article.
Return Above
CHROME, BROWSER, INTERNET, VIRUS, MALWARE
Prologue
1 Look around... but you also infect
2 What to do if you downloaded the plug-in?
Prologue
CHROME, BROWSER, INTERNET, VIRUS, MALWARE
It's a Trojan, which redirects the browser to a specific URL that contains other types of malicious content. Given the high levels of detection of this threat, which is focused on affecting Chrome, one of the most popular in the present day web browsers, we realized the task of finding the way that this threat is spreading and how auser could fall into this trap.
1 Look around... but you also infect
An example of how it is spreading this threat found on a popular site to watch movies online. One of the options to view the contents, once the user wants to start playback opens an additional window in the browser:2 What to do if you downloaded the plug-in?
Where you've downloaded this malicious plug-in, you must remove it immediately of the Chrome browser. To do this, you can write "chrome://extensions" in the address bar and a time that you find it simply remove it.
As a precaution you should scan your computer with a trusted security solution torule out that you could have downloaded some other type of threat to your computer. In this case we recommend using our free ESET Online Scanner solution thatworks directly from the web browser.
As always, it is very important to be careful before you click and pay attention to web sites which are accessible, especially if they ask to download plug-ins. We've already seen other campaigns associated with Youtube, Facebook and other sites that have similar characteristics.
Therefore, we see that this type of campaigns are not isolated; in fact, there is a whole structure of redirects that will be described in more technical detail in a future article.
Return Above
CHROME, BROWSER, INTERNET, VIRUS, MALWARE
Info: ESET
Images of: ©Roger Casas-Alatriste/Flickr
Comments
Post a Comment