Menu
EN

Over 20,000,000 of Chrome Users are Victims of Fake Ad Blockers

According to the PageFair 2014 report, Google Chrome is a major driver of adblock growth. 20% of users discovered ad blocking by browsing “available browser extensions”. Given how popular ad blocking is, it is quite a lot. This also explains why "cloning" wide-spread ad blockers has become so popular among online crooks. Seven months ago big news broke: 37,000 users were tricked into installing a fake Adblock Plus extension.

What if I told you that thanks to poor Chrome's WebStore moderation the situation is much worse, and in reality over 20,000,000 users are affected and tricked into installing fake malicious ad blockers?

I must say the problem is not new. It's been a while since different "authors" started spamming Chrome WebStore with lazy clones of popular ad blockers (with a few lines of their code on top of them). That's how users could end up installing some "Adguard Hardline" or "Adblock Plus Premium" or something like that. The only way of fighting this stuff is to file a trademark violation abuse to Google, and it takes them a few days to take a clone down.

They got smarter now. Just look at the search results. All the extensions I've highlighted are simple rip-offs with a few lines of code and some analytics code added by the "authors". Instead of using tricky names they now spam keywords in the extension description trying to make to the top search results.

Apparently, being in the top is enough to gain trust of casual users. For instance, take a look at the stats of one of them:

So I've decided to take a deeper look inside of this so-called "AdRemover". The following section is full of technical details and if you are not interested, just skip it to the next section where I'll explain how it works in normal language.

All shades of hiding scripts

There was one file added compared to the original code of the AdBlock extension, the coupons.txt file:

Another thing that caught my eye is that while initializing it was loading a strange image from a third-party domain www.hanstrackr.com:

Okay, that's weird. Let's find out why do they need these files. It appears that both files were loaded by a script hidden inside the modified jQuery library:

jQuery.extend({

	normalize: function(value) {

		return jQuery.xrat+'ob("'+value+'")';
	}
});

This function returns a string: atob("here goes the hidden base64-encoded script") which is then executed. The script itself was also obfuscated. You can take a look at the deobfuscated version of it here.

This hidden script was listening to every request made by your browser and compared md5(url + "%Ujy%BNY0O") with the list of signatures loaded from coupons.txt. When the said signature was hit, it loaded an iframe from the g.qyz.sx domain passing information about the visited page, and then re-initialized the extension. For instance, one of these signatures corresponded to https://www.google.com/.

Now to that weird image. It appears that another script is hidden inside of it, and the extension was decoding and executing it:

    decodeMessage = function(variable_0, variable_1) {
        var variable_2 = [],
            variable_4 = getNumberFromBits(variable_0, variable_2, variable_1);
        if (16 * (variable_4 + 1) > 0.75 * variable_0["length"]) {
            return ""
        };
        if (0 === variable_4) {
            return ""
        };
        for (var variable_3 = [], variable_5 = 0; variable_5 < variable_4; variable_5++) {
            var variable_66 = getNumberFromBits(variable_0, variable_2, variable_1);
            variable_3["push"](String["fromCharCode"](variable_66))
        };
        return variable_3["join"]("")
    }

The default image/script does nothing malicious, but at any moment it can be changed. Note, that this script is executed in the privileged context (extension's background page) and it can do literally anything with your browser.

AdRemover's Summary

Now back to the normal language. Here is a list of what this fake ad blocker does.

  1. It hides malicious code inside a well-known javascript library (jQuery).
  2. This code sends back to their server information about some of the websites you visit.
  3. It receives commands from the command center remote server. In order to avoid detection, these commands are hidden inside a harmless-looking image.
  4. These commands are scripts which are then executed in the privileged context (extension's "background page") and can change your browser behavior in any way.

Basically, this is a botnet composed of browsers infected with the fake adblock extensions. The browser will do whatever the command center server owner orders it to do.

It is not alone

I have scanned other extensions on the WebStore and found four more using the very same approach. By the way, two of them are not fake ad blockers, and nothing pointed to them being malicious until I checked the code.

Here is the full list.

  • AdRemover for Google Chrome™ (10M+ users)
  • uBlock Plus (8M+ users)
  • Adblock Pro (2M+ users)
  • HD for YouTube™ (400K+ users)
  • Webutation (30K+ users)

We have reported these extensions to Google. Hopefully, they will be taken down soon.

How to protect yourself from malicious extensions

With the current state of things, surfing through the Chrome's WebStore is like walking through a minefield. So here's my advice: if you want to install an extension, think twice. And then think twice again.

Ok, I got it, you absolutely need this extension. At least do one thing: check who is the author of this extension. Do not install it if you don't trust the author. Please note, that at some point the extension can be sold to someone else, and who knows what it will become (here's a vivid example).

  • UPD (18.04.2018, 12:48 GMT+3): Google has taken down 4 of 5 extensions. We've reported the last one again.
  • UPD (18.04.2018, 13:17 GMT+3): All five are taken down.
Liked this post?
18,420 18420 user reviews
Excellent!

AdGuard for Windows

AdGuard for Windows is more than an ad blocker. It is a multipurpose tool that blocks ads, controls access to dangerous sites, speeds up page loading, and protects children from inappropriate content.
By downloading the program you accept the terms of the License agreement
Read more
18,420 18420 user reviews
Excellent!

AdGuard for Mac

AdGuard for Mac is a unique ad blocker designed with macOS in mind. In addition to protecting you from annoying ads in browsers and apps, it shields you from tracking, phishing, and fraud.
By downloading the program you accept the terms of the License agreement
Read more
18,420 18420 user reviews
Excellent!

AdGuard for Android

AdGuard for Android is a perfect solution for Android devices. Unlike most other ad blockers, AdGuard doesn't require root access and provides a wide range of app management options.
By downloading the program you accept the terms of the License agreement
Read more
18,420 18420 user reviews
Excellent!

AdGuard for iOS

The best iOS ad blocker for iPhone and iPad. AdGuard eliminates all kinds of ads in Safari, protects your privacy, and speeds up page loading. AdGuard for iOS ad-blocking technology ensures the highest quality filtering and allows you to use multiple filters at the same time
By downloading the program you accept the terms of the License agreement
Read more
18,420 18420 user reviews
Excellent!

AdGuard VPN

74 locations worldwide

Access to any content

Strong encryption

No-logging policy

Fastest connection

24/7 support

Try for free
By downloading the program you accept the terms of the License agreement
Read more
18,420 18420 user reviews
Excellent!

AdGuard Content Blocker

AdGuard Content Blocker will eliminate all kinds of ads in mobile browsers that support content blocker technology — namely, Samsung Internet and Yandex.Browser. While being more limited than AdGuard for Android, it is free, easy to install and still provides high ad blocking quality.
By downloading the program you accept the terms of the License agreement
Read more
18,420 18420 user reviews
Excellent!

AdGuard Browser Extension

AdGuard is the fastest and most lightweight ad blocking extension that effectively blocks all types of ads on all web pages! Choose AdGuard for the browser you use and get ad-free, fast and safe browsing.
18,420 18420 user reviews
Excellent!

AdGuard Assistant

A companion browser extension for AdGuard desktop apps. It offers an in-browser access to such features as custom element blocking, allowlisting a website or sending a report.
18,420 18420 user reviews
Excellent!

AdGuard DNS

AdGuard DNS is a foolproof way to block Internet ads that does not require installing any applications. It is easy to use, absolutely free, easily set up on any device, and provides you with minimal necessary functions to block ads, counters, malicious websites, and adult content.
18,420 18420 user reviews
Excellent!

AdGuard Home

AdGuard Home is a network-wide software for blocking ads & tracking. After you set it up, it’ll cover ALL your home devices, and you don’t need any client-side software for that. With the rise of Internet-Of-Things and connected devices, it becomes more and more important to be able to control your whole network.
18,420 18420 user reviews
Excellent!

AdGuard Pro for iOS

AdGuard Pro has much to offer on top of the excellent iOS ad blocking in Safari already known to the users of the regular version. By providing access to custom DNS settings, the app allows you to block ads, protect your kids from adult content online, and safeguard your personal data from theft.
By downloading the program you accept the terms of the License agreement
Read more
18,420 18420 user reviews
Excellent!

AdGuard for Safari

Ad blocking extensions for Safari are having hard time since Apple started to force everyone to use the new SDK. AdGuard extension is supposed to bring back the high quality ad blocking back to Safari.
18,420 18420 user reviews
Excellent!

AdGuard Temp Mail

A free temporary email address generator that keeps you anonymous and protects your privacy. No spam in your main inbox!
18,420 18420 user reviews
Excellent!

AdGuard for Android TV

AdGuard for Android TV is the only app that blocks ads, guards your privacy, and acts as a firewall for your Smart TV. Get warnings about web threats, use secure DNS, and benefit from encrypted traffic. Relax and dive into your favorite shows with top-notch security and zero ads!
Downloading AdGuard To install AdGuard, click the file indicated by the arrow Select "Open" and click "OK", then wait for the file to be downloaded. In the opened window, drag the AdGuard icon to the "Applications" folder. Thank you for choosing AdGuard! Select "Open" and click "OK", then wait for the file to be downloaded. In the opened window, click "Install". Thank you for choosing AdGuard!
Install AdGuard on your mobile device