“In the case reported here, the Chrome extension creators had specifically made extensions that obfuscated the underlying advertising functionality from users,” Kaya and Duo Security researcher Jacob Rickerd wrote in a report. “This was done in order to connect the browser clients to a command and control architecture, exfiltrate private browsing data without the users’ knowledge, expose the user to risk of exploit through advertising streams, and attempt to evade the Chrome Web Store’s fraud detection mechanisms.”A Maze of Redirects, Malware, and More
The extensions were mostly presented as tools that provided various promotion- and advertising-as-a service utilities. In fact, they engaged in ad fraud and malvertising by shuffling infected browsers through a maze of sketchy domains. Each plugin first connected to a domain that used the same name as the plugin (e.g.: Mapstrek[.]com or ArcadeYum[.]com) to check for instructions on whether to uninstall themselves.
The plugins then redirected browsers to one of a handful of hard-coded control servers to receive additional instructions, locations to upload data, advertisement feed lists, and domains for future redirects. Infected browsers then uploaded user data, updated plugin configurations, and flowed through a stream of site redirections.
Thursday’s report continued:
The user regularly receives new redirector domains, as they are created in batches, with multiple of the earlier domains being created on the same day and hour. They all operate in the same way, receiving the signal from the host and then sending them to a series of ad streams, and subsequently to legitimate and illegitimate ads. Some of these are listed in the “End domains” section of the IOCs, though they are too numerous to list.
Many of the redirections led to benign ads for products from Macy’s, Dell, and Best Buy. What made the scheme malicious and fraudulent was (a) the large volume of ad content (as many as 30 redirects in some cases), (b) the deliberate concealment of most ads from end users, and (c) the use of the ad redirect streams to send infected browsers to malware and phishing sites. Two malware samples tied to the plugin sites were:
- ARCADEYUMGAMES.exe, which reads terminal service related keys and accesses potentially sensitive information from local browsers, and
- MapsTrek.exe, which has the ability to open the clipboard
All but one of the sites used in the scheme weren’t previously categorized as malicious or fraudulent by threat intelligence services. The exception was the state of Missouri, which listed DTSINCE[.]com, one of the handful of hard-coded control servers, as a phishing site.
Advertisers say that Google makes it far too easy to accidentally run ads in countries under US sanctions like Iran, North Korea, or Syria. And yet, Google still serves ads in these places, which means advertisers can inadvertently spend money reaching people in countries where they’re largely barred from doing business.