Google removes 200 malicious Chrome add-ons that steal personal information

In Chrome's add-on that provides functionality to ease work when browsing web pages, Google has reported that 200 deleted malicious add-ons steal valuable data such as personal information reported by BBC News in the UK I will.

Google purges bad extensions from Chrome - BBC News
http://www.bbc.com/news/technology-32206511

Chrome extension collects browsing data, uses it for marketing | Ars Technica
http://arstechnica.com/security/2015/04/chrome-extension-collects-browsing-data-uses-it-for-marketing/

Security Alert: Webpage Screenshot Leaks Private Data For 1.2 Million Users - Heimdal Security Blog
https://heimdalsecurity.com/blog/webpage-screenshot-leaks-private-data-million-users/

Various convenient functions are added when using the extended function of the browser, but some malicious things that cause trouble are also included.University of California, Santa BarbaraAlexandros Kapravelos and others in collaboration with Google said that tens of millions of users using Google's search page installed malicious extensions, according to a survey conducted by Google. The findings will be announced at the IEEE Symposium to be held in May 2015.

BySean MacEntee

According to Kapravelos, at least one of 5% of those who are accessing Google every day uses malicious extensions, and about one-third of them install 4 or more malicious extensions I heard he was doing it.

There are descriptions that try to steal login information, personal information, etc. of bit coins and bank accounts in some "malicious extensions" scripts, so it is easy to distinguish themselves. However, it takes time to be recognized as malicious if it is actually a case that what was identified as being a problem-free extension is actually malicious. Also, although the extension function may "appear to be swapping ads" behavior seems to be malicious, it itself realizes browsing without advertisementAdBlockThere are times when the distinction between malignity and not being obvious is not clear as it is similar to the technique of.

One of those judged to be a malicious extension is "Webpage Screenshot" downloaded 1.2 million times. Swedish security companyScrapeSentryAs a result of examination, it had the function of copying the communication of all browsers, and sent the collected data to the US server. Development representatives have just used it to figure out who is using the extension function and who they are, and they have excused that they were not malicious, but they have been deleted from the Chrome Web Store . Likewise, 192 malicious extensions have been removed from the Chrome Web Store, but Kapravelos says that the number of those users has increased to about 14 million.

Kapravelos and others team together with Google developed a tool that automatically finds malicious extensions and tells maintenance staff. I wonder if it will be a little better.