How browser plugins can leak corporate secrets

[harlan4096]

In July 2019, researcher Sam Jadali discovered several extensions for the Chrome and Firefox browsers that collect browsing history and transfer it to a third party. Moreover, he found a platform where such data is bought and sold.

This may not set off any alarms. So what if someone finds out that one of your employees has visited a contractor’s website or even logged in to a corporate account in a social network? All the attackers get is the address. They can’t access any other information, so who cares? Well, these extensions periodically leak internal company data, and here’s how.

Links that reveal everything about you

The social networks and official websites of your contractors and partners likely do not divulge any secret information. You should be more concerned about “closed” pages, which are accessible only through unique links can be used to leak information. In reality, the only thing protecting these pages is their secrecy: Outsiders do not know their address. Here are several examples of such pages.

Online conferences

Suppose your company makes extensive use of Web conferences where employees from different departments discuss current plans, organize brainstorming sessions or simply receive information from management. Many platforms exist for conducting these types of conferences. For some, you need a key to participate, but small companies often use free or low-cost solutions that require only a link containing a unique meeting identifier that the organizer sends to all interested parties. This is all that is needed to allow a participant to join an event.

Now, imagine that one of the employees who received this link has an extension installed in their browser that siphons off information to outsiders. As soon as he or she joins the conference, this unscrupulous plugin sends its URL to a marketplace. An attacker who is trying to collect information about your company or is just looking for an opportunity purchases your employee’s browser history, from which he can see that one of the accessible meetings is taking place right now.

Nothing prevents the buyer of this link from joining the meeting. Of course, the other participants will receive a notification that someone has joined the event. But if several dozen people are attending and not all of them know each other, then hardly anyone will question who this unknown participant is. As a result, everything that is said during the conference will become known to the outsider.
...

Continue Reading