Chrome, Firefox browser extensions leaked millions of users' data

Agencies
July 20, 2019

Popular browser extensions like ad blockers have been caught harvesting personal data of millions of consumers who use Chrome and Firefox -- not only their browsing histories but also exposing tax returns, medical records, credit card information and other sensitive data in the public domain.

According to an independent cyber security researcher Sam Jadali, the data has been leaked to a fee-based company called Nacho Analytics that gives unlimited access to any websites analytics data.

The data could be purchased for as little as $10 to $50, said Jadali whose report was first described in Ars Technica late on Friday.

"This non-stop flow of sensitive data over the past seven months has resulted in the publication of links to home and business surveillance videos hosted on Nest and other security services.

"Tax returns, billing invoices, business documents, and presentation slides posted to, or hosted on, Microsoft OneDrive, Intuit.com, and other online services" have been exposed, said the report.

The exposed data via eight browser extensions also include vehicle identification, numbers of recently bought automobiles, along with the names and addresses of the buyers.

Patient details, travel itineraries, Facebook Messenger attachments and Facebook photos, even private, are now available in the public domain.

Browser extensions - also known as plug-ins or add-ons - are apps that consumers can install to run alongside their browser for additional functionality.

The affected extensions were apps used by millions of people, including HoverZoom, SpeakIt!, and FairShare Unlock.

"The extensions have been remotely removed or disabled in consumers' browsers and are no longer available for download," said both Google and Firefox.

People who didn't download the extensions may also be affected.

"Nobody is immune to this. Even if you don't have any harmful extensions, the other people you interact with may have an extension on their computers that could be leaking the data you share with them," Jadali was quoted as saying.

Nacho Analytics, for example, promises to let people "see anyone's analytics account" and to provide "real-time web analytics for any website".

The company charges $49 per month, per domain, to monitor any of the top 5,000 most widely-trafficked websites.

The security expert has suggested users to delete all browser extensions they have installed in the past.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
News Network
March 10,2020

Tehran, Mar 10: Twenty-seven people have died from methanol poisoning in Iran after rumours that drinking alcohol can help cure the novel coronavirus infection, state news agency IRNA reported on Monday. The outbreak of the virus in Islamic republic is one of the deadliest outside of China, where the disease originated.

Twenty have died in the southwestern province of Khuzestan and seven in the northern region of Alborz after consuming bootleg alcohol, IRNA said.

Drinking alcohol is banned in Iran for everyone except some non-Muslim religious minorities. Local media regularly report on lethal cases of poisoning caused by bootleg liquor.

A spokesman for Jundishapur medical university in Ahvaz, the capital of Khuzestan, said 218 people had been hospitalised there after being poisoned.

The poisonings were caused by "rumours that drinking alcohol can be effective in treating coronavirus," Ali Ehsanpour said.

The deputy prosecutor of Alborz, Mohammad Aghayari, told IRNA the dead had drunk methanol after being "misled by content online, thinking they were fighting coronavirus and curing it." If ingested in large quantities, methanol can cause blindness, liver damage and death.

Iran has been scrambling to contain the spread of the COVID-19 illness which has hit all of the country's 31 provinces, killing 237 people and infecting 7,161.

According to IRNA, 16 out of 69 confirmed cases have died of coronavirus infection in Khuzestan as of Sunday.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
News Network
February 19,2020

Washington, Feb 19: Sri Srinivasan, a prominent Indian-American judge, has created history by becoming the first person of South Asian descent to lead a powerful federal circuit court considered next only to the US Supreme Court.

Srinivasan, 52, became the Chief Judge of the United States Court of Appeals for the DC Circuit.

An Obama appointee who has already been considered for a Supreme Court seat twice, donned the mantle of the chief judge of the DC federal court circuit on February 12.

Srinivasan succeeded Judge Merrick Garland, who has been a member of the DC Circuit since 1997 and Chief Judge since 2013. He will remain on the bench, a press release said.

Notably, Garland's nomination to the Supreme Court by the then president Barack Obama was blocked by Senate Republicans in 2016.

Srinivasan, was appointed to the US Court of Appeals for the District of Columbia Circuit in May 2013.

He was the first ever Indian-American to be appointed to the second most powerful court of the US.

Neomi Rao, nominated by President Donald Trump, is the second Indian American on this powerful judiciary bench.

History being made on the DC Court of Appeals. Congratulations, Judge Srinivasan! Senator Mark Warner said.

Congratulations to Judge Sri Srinivasan on becoming the Chief Judge of the U.S. Court of Appeals for the D.C. Circuit! A milestone for the Indian-American/Kansan community (and yet another piece of evidence my family can use that I'm underachieving), US Federal Communications Commission Chair Ajit Pai said.

According to The Washington Post, Srinivasan spoke recently about his path to the bench at an event celebrating women in the law, a field where men still dominate leadership positions.

"Everybody doubts their belonging and worthiness in some measure. I definitely did and still do. This is just going to be a part of the thing when you're looking out in the world in which everyone isn't like you. It's natural to doubt whether you belong and whether you're worthy, he said, "but you do belong and you are worthy.

Born in Chandigarh, and raised in Lawrence, Kansas, he received a B.A. from Stanford University, a J.D. from Stanford Law School, and an M.B.A. from the Stanford Graduate School of Business.

Following graduation, he served as a law clerk to Judge J. Harvie Wilkinson III of the US Court of Appeals for the Fourth Circuit, as a Bristow Fellow in the Office of the US Solicitor General, and as a law clerk to US Supreme Court Justice Sandra Day O'Connor.

From 2011 until his appointment to the US Court of Appeals, Judge Srinivasan served as the Principal Deputy Solicitor General of the United States.

He has argued 25 cases before the US Supreme Court. He has also taught appellate advocacy at Harvard Law School as well as a seminar on civil rights statutes and the Supreme Court at Georgetown University Law Center.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
May 22,2020

Kochi, May 22: During the nationwide COVID-19 lockdown, Kerala recorded the highest number of cyber attacks followed by Punjab and Tamil Nadu, a study by anti-virus software firm K7 Computing said on Thursday.

In a statement issued in Chennai, the company said its K7 Computing's Cyber Threat Report, a comprehensive analysis of cyber attacks during the lockdown has found that Kerala recorded the highest number of cyber attacks during this period. The report analyses various cyber attacks within India during the pandemic and reveals that threat actors targeted the state with COVID-themed attacks aimed at exploiting user trust.

In Kerala, regions like Kottayam, Kannur, Kollam, and Kochi saw the highest hits with 462, 374, 236, and 147 attacks respectively, while the state as a whole saw around 2,000 attacks during the period - the highest thus far in the country.

This was followed by Punjab with 207 attacks and Tamil Nadu with 184 attacks, the company said.

The sudden surge in the frequency of attacks witnessed from February 2020 to mid-April 2020 indicates that scamsters across the world were exploiting the widespread panic around coronavirus at both the individual and corporate level.

These attacks aimed to compromise computers and mobile devices to gain access to users' confidential data, banking details, and cryptocurrency accounts.

The key threats seen during this period ranged from phishing attacks to rogue apps disguised as COVID-19 information apps that targeted users' sensitive data. Phishing attacks were noticed more in Tier-II and Tier-III cities while the metros fared better. Smaller cities saw over 250 attacks being blocked per 10,000 users.

Users from Ghaziabad and Lucknow seem to have faced almost 6 and 4 times the number of attacks as Bengaluru users.

According to the statement, a majority of the recorded attacks were phishing attacks with sophisticated campaigns that could easily snare even the most educated users. These attacks were aimed at heightening users' fears and creating a sense of urgency to take action.

K7 Labs noticed phishing attacks where scamsters posed as representatives of the United States Department of Treasury, the World Health Organization (WHO), and the Centres for Disease Control and Prevention (CDC), the company said.

Users were encouraged to visit links that would automatically download malware on the host computer such as the Agent Tesla keylogger or Lokibot information-stealing malware, infamous banking Trojans such as Trickbot or Zeus Sphinx, and even disastrous ransomware.

Other attacks included infected COVID-19 Android apps like CoronaSafetyMask that scam users with promises of masks for an upfront payment; the spyware app Project Spy; and seemingly genuine apps that are infected with dangerous malware like banking Trojans such as Ginp, Anubis and Cerberus.

"Covid-19 has created an ideal situation for various threat actors to target individuals and enterprises alike. The panic caused by the stringent lockdown measures and rapid spread of this virus has left many people looking for more information on the situation," J. Kesavardhanan, Founder and CEO of K7 Computing was quoted as saying in the statement.

"Threat actors exploit this fear to their advantage and scam users into downloading malicious software and divulging sensitive information like banking codes. The need to be cyber cautious has never been greater. This is more so in the case of corporates who have adopted a work from home policy hurriedly without adequate cyber hygiene. We have seen an increase in attacks on enterprises and SME employees as well," he added.

Such attacks are expected to continue till normalcy returns. Social engineering attacks targeted at winning users' trust will gain momentum.

Healthcare institutions, well-known government offices, and international organisations will continue to be a prime target throughout the pandemic, the statement said.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.