Google Chrome sync feature can be abused for C&C and data exfiltration

[silversurfer]

Content source

https://www.zdnet.com/article/google-chrome-syncing-features-can-be-abused-for-c-c-and-data-exfiltration/

Bojan Zdrnja, a Croatian security researcher, said on Thursday that during a recent incident response, he discovered that a malicious Chrome extension was abusing the Chrome sync feature as a way to communicate with a remote command and control (C&C) server and as a way to exfiltrate data from infected browsers.

Zdrnja said that in the incident he investigated, attackers gained access to a victim's computer, but because the data they wanted to steal was inside an employee's portal, they downloaded a Chrome extension on the user's computer and loaded it via the browser's Developer Mode.

The extension, which posed as a security add-on from security firm Forcepoint, contained malicious code that abused the Chrome sync feature as a way to allow attackers to control the infected browser.

Image: Bojan Zdrnja​

Zdrnja said the goal of this particular attacker was to use the extension to "manipulate data in an internal web application that the victim had access to."

"While they also wanted to extend their access, they actually limited activities on this workstation to those related to web applications, which explains why they dropped only the malicious Chrome extension, and not any other binaries," Zdrnja said in a report published on Thursday.

Google Chrome sync feature can be abused for C&C and data exfiltration

A security researcher has found a malicious Chrome extension in the wild abusing the Chrome Sync process.

www.zdnet.com

 

[Gandalf_The_Grey]

Google Chrome sync feature can be abused for C&C and data exfiltration

A security researcher has found a malicious Chrome extension in the wild abusing the Chrome Sync process.

www.zdnet.com

Again an extension... so, the old advice of limiting your extension to a few well-known ones is golden
An adblocker, a security extension (if installed through your av) and a password manager should be all you need.
Don't know if password managers will survive now Google and Microsoft are improving password handling in their browsers...

 

[ForgottenSeer 85179]

Don't know if password managers will survive now Google and Microsoft are improving password handling in their browsers...

I even never use any password manager browser extension and always wonder why such is used.
With KeePass i can already use auto complete via button in KeePass or shortcut. Guess such is only needed for cloud password manager