Menu
EN
AdGuard for Windows
AdGuard
for Windows
The most advanced ad blocker that works in all browsers
Reviews 18140 Excellent
By downloading the program you accept the terms of the License agreement
AdGuard for Mac
AdGuard
for Mac
The most advanced ad blocker that works in all browsers
Reviews 18140 Excellent
By downloading the program you accept the terms of the License agreement
AdGuard for Android
AdGuard
for Android
А unique no-root ad blocker for Android
Reviews 18140 Excellent
By downloading the program you accept the terms of the License agreement
AdGuard for iOS
AdGuard
for iOS
The best iOS ad blocker for Safari
Reviews 18140 Excellent
By downloading the program you accept the terms of the License agreement

Over 20,000,000 of Chrome Users are Victims of Fake Ad Blockers

According to the PageFair 2014 report, Google Chrome is a major driver of adblock growth. 20% of users discovered ad blocking by browsing “available browser extensions”. Given how popular ad blocking is, it is quite a lot. This also explains why "cloning" wide-spread ad blockers has become so popular among online crooks. Seven months ago big news broke: 37,000 users were tricked into installing a fake Adblock Plus extension.

What if I told you that thanks to poor Chrome's WebStore moderation the situation is much worse, and in reality over 20,000,000 users are affected and tricked into installing fake malicious ad blockers?

I must say the problem is not new. It's been a while since different "authors" started spamming Chrome WebStore with lazy clones of popular ad blockers (with a few lines of their code on top of them). That's how users could end up installing some "Adguard Hardline" or "Adblock Plus Premium" or something like that. The only way of fighting this stuff is to file a trademark violation abuse to Google, and it takes them a few days to take a clone down.

They got smarter now. Just look at the search results. All the extensions I've highlighted are simple rip-offs with a few lines of code and some analytics code added by the "authors". Instead of using tricky names they now spam keywords in the extension description trying to make to the top search results.

Apparently, being in the top is enough to gain trust of casual users. For instance, take a look at the stats of one of them:

So I've decided to take a deeper look inside of this so-called "AdRemover". The following section is full of technical details and if you are not interested, just skip it to the next section where I'll explain how it works in normal language.

All shades of hiding scripts

There was one file added compared to the original code of the AdBlock extension, the coupons.txt file:

Another thing that caught my eye is that while initializing it was loading a strange image from a third-party domain www.hanstrackr.com:

Okay, that's weird. Let's find out why do they need these files. It appears that both files were loaded by a script hidden inside the modified jQuery library:

jQuery.extend({

	normalize: function(value) {

		return jQuery.xrat+'ob("'+value+'")';
	}
});

This function returns a string: atob("here goes the hidden base64-encoded script") which is then executed. The script itself was also obfuscated. You can take a look at the deobfuscated version of it here.

This hidden script was listening to every request made by your browser and compared md5(url + "%Ujy%BNY0O") with the list of signatures loaded from coupons.txt. When the said signature was hit, it loaded an iframe from the g.qyz.sx domain passing information about the visited page, and then re-initialized the extension. For instance, one of these signatures corresponded to https://www.google.com/.

Now to that weird image. It appears that another script is hidden inside of it, and the extension was decoding and executing it:

    decodeMessage = function(variable_0, variable_1) {
        var variable_2 = [],
            variable_4 = getNumberFromBits(variable_0, variable_2, variable_1);
        if (16 * (variable_4 + 1) > 0.75 * variable_0["length"]) {
            return ""
        };
        if (0 === variable_4) {
            return ""
        };
        for (var variable_3 = [], variable_5 = 0; variable_5 < variable_4; variable_5++) {
            var variable_66 = getNumberFromBits(variable_0, variable_2, variable_1);
            variable_3["push"](String["fromCharCode"](variable_66))
        };
        return variable_3["join"]("")
    }

The default image/script does nothing malicious, but at any moment it can be changed. Note, that this script is executed in the privileged context (extension's background page) and it can do literally anything with your browser.

AdRemover's Summary

Now back to the normal language. Here is a list of what this fake ad blocker does.

  1. It hides malicious code inside a well-known javascript library (jQuery).
  2. This code sends back to their server information about some of the websites you visit.
  3. It receives commands from the command center remote server. In order to avoid detection, these commands are hidden inside a harmless-looking image.
  4. These commands are scripts which are then executed in the privileged context (extension's "background page") and can change your browser behavior in any way.

Basically, this is a botnet composed of browsers infected with the fake adblock extensions. The browser will do whatever the command center server owner orders it to do.

It is not alone

I have scanned other extensions on the WebStore and found four more using the very same approach. By the way, two of them are not fake ad blockers, and nothing pointed to them being malicious until I checked the code.

Here is the full list.

  • AdRemover for Google Chrome™ (10M+ users)
  • uBlock Plus (8M+ users)
  • Adblock Pro (2M+ users)
  • HD for YouTube™ (400K+ users)
  • Webutation (30K+ users)

We have reported these extensions to Google. Hopefully, they will be taken down soon.

How to protect yourself from malicious extensions

With the current state of things, surfing through the Chrome's WebStore is like walking through a minefield. So here's my advice: if you want to install an extension, think twice. And then think twice again.

Ok, I got it, you absolutely need this extension. At least do one thing: check who is the author of this extension. Do not install it if you don't trust the author. Please note, that at some point the extension can be sold to someone else, and who knows what it will become (here's a vivid example).

  • UPD (18.04.2018, 12:48 GMT+3): Google has taken down 4 of 5 extensions. We've reported the last one again.
  • UPD (18.04.2018, 13:17 GMT+3): All five are taken down.
Liked this post?
By downloading the comments you agree the terms and policies

AdGuard
for Windows

AdGuard for Windows is more than an ad blocker. It is a multipurpose tool that blocks ads, controls access to dangerous sites, speeds up page loading, and protects children from inappropriate content.
User Reviews: 18140
4.7 out of 5
By downloading the program you accept the terms of the License agreement
Read more

AdGuard
for Mac

AdGuard for Mac is a unique ad blocker designed with macOS in mind. In addition to protecting you from annoying ads in browsers and apps, it shields you from tracking, phishing, and fraud.
User Reviews: 18140
4.7 out of 5
By downloading the program you accept the terms of the License agreement
Read more

AdGuard
for Android

AdGuard for Android is a perfect solution for Android devices. Unlike most other ad blockers, AdGuard doesn't require root access and provides a wide range of app management options.
User Reviews: 18140
4.7 out of 5
By downloading the program you accept the terms of the License agreement

AdGuard
for iOS

The most advanced ad blocker for Safari: it makes you forget about pop-up ads, speeds up page loading, and protects your personal data. A manual element-blocking tool and highly customizable settings help you tailor the filtering to your exact needs.
User Reviews: 18140
4.7 out of 5
By downloading the program you accept the terms of the License agreement

AdGuard Browser extension

AdGuard is the fastest and most lightweight ad blocking extension that effectively blocks all types of ads on all web pages! Choose AdGuard for the browser you use and get ad-free, fast and safe browsing.
User Reviews: 18140
4.7 out of 5

AdGuard for Safari

Ad blocking extensions for Safari are having hard time since Apple started to force everyone to use the new SDK. AdGuard extension is supposed to bring back the high quality ad blocking back to Safari.
User Reviews: 18140
4.7 out of 5
Available on the
App Store
Download
By downloading the program you accept the terms of the License agreement

AdGuard Home

AdGuard Home is a network-wide software for blocking ads & tracking. After you set it up, it’ll cover ALL your home devices, and you don’t need any client-side software for that. With the rise of Internet-Of-Things and connected devices, it becomes more and more important to be able to control your whole network.
User Reviews: 18140
4.7 out of 5

AdGuard Content Blocker

AdGuard Content Blocker will eliminate all kinds of ads in mobile browsers that support content blocker technology — namely, Samsung Internet and Yandex.Browser. While being more limited than AdGuard for Android, it is free, easy to install and still provides high ad blocking quality.
User Reviews: 18140
4.7 out of 5
By downloading the program you accept the terms of the License agreement
Read more

AdGuard Assistant

A companion browser extension for AdGuard desktop apps. It offers an in-browser access to such features as custom element blocking, allowlisting a website or sending a report.
User Reviews: 18140
4.7 out of 5
Assistant for Chrome Is it your current browser?
Install
By downloading the program you accept the terms of the License agreement
Assistant for Firefox Is it your current browser?
Install
By downloading the program you accept the terms of the License agreement
Assistant for Edge Is it your current browser?
Install
By downloading the program you accept the terms of the License agreement
Assistant for Opera Is it your current browser?
Install
By downloading the program you accept the terms of the License agreement
Assistant for Yandex Is it your current browser?
Install
By downloading the program you accept the terms of the License agreement
Assistant for Safari Is it your current browser?
If you can't find your browser, try the old legacy Assistant version, which you can find in AdGuard extension settings.
Downloading AdGuard To install AdGuard, click the file indicated by the arrow Select "Open" and click "OK", then wait for the file to be downloaded. In the opened window, drag the AdGuard icon to the "Applications" folder. Thank you for choosing AdGuard! Select "Open" and click "OK", then wait for the file to be downloaded. In the opened window, click "Install". Thank you for choosing AdGuard!
Install AdGuard on your mobile device