Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
Chrome Chromium Security

eFast Malware Hijacks Browser With Chrome Clone (malwarebytes.org) 183

Posted by timothy from the but-it-looked-right dept.
An anonymous reader writes with a report at The Stack that: eFast Browser, a new malicious adware which disguises itself as Google Chrome, has hijacked internet users' systems in an apparent effort to serve its own ads and harvest user activity to sell to third-party advertisers. It is able to mirror the aesthetics of Chrome as it uses the same source code, available across the open-source project Chromium. Once installed, eFast places ads across existing web pages, linking to third-party e-commerce sites or other malicious platforms.
This discussion has been archived. No new comments can be posted.

eFast Malware Hijacks Browser With Chrome Clone More

eFast Malware Hijacks Browser With Chrome Clone

Comments Filter:

  • Mirrors the aesthetics of Chome? It's Firefox?!? (Score:3, Funny)

    by Anonymous Coward on Tuesday October 20, 2015 @09:02AM (#50764817)

    Hmmm, "disguises itself as Google Chrome" and "mirror[s] the aesthetics of Chrome".

    Sounds like Firefox!

  • Windows only (Score:4, Informative)

    by Crowd Computing ( 4269575 ) on Tuesday October 20, 2015 @09:06AM (#50764837)
    The program appears to be available only for Windows.
    • Comment removed based on user account deletion

  • LOL, w00t? (Score:5, Insightful)

    by gstoddart ( 321705 ) on Tuesday October 20, 2015 @09:17AM (#50764913) Homepage

    It is unclear whether the browser adheres to a privacy policy

    LOL, WTF??? So, malware which rips out your browser, puts itself in its place, and then serves you ads and whatever the hell else it does ... and they're asking if it adheres to a damned privacy policy?

    Anything which installs itself like that can safely be assumed to not give a flying crap about your damned privacy.

    Why the hell they even ponder if something like this follows a privacy policy? It's malware. No, it isn't going to have a privacy policy.

    • what does privacy policy even do? The privacy policy could consist of solely "fuck you we'll do what we want" and still be a policy.

    • Kind of like the mugger that just took your wallet probably wasn't wearing a condom when he robbed you.

      And yes, I know exactly what I did there, and it was intentional, so before you complain, think about it. If you still don't get it, don't bother, you probably never will.

  • is it hosted at sourceforge?

  • eFast Bad - Google Good?!? (Score:3, Interesting)

    by Anonymous Coward on Tuesday October 20, 2015 @09:20AM (#50764931)

    Wait, eFast is using the open source Chromium code to build a browser to serve ads and collect user PII, and that is wrong, but when Google uses the same open source code base to build a browser to serve ads and collect user PII that's great?!?

    WTF?!?

    • Re: (Score:3)

      by Rob Y. ( 110975 )

      There's just the minor side issue of fraud, asshole. If they want to provide a browser (yes, and even base it off of Chromium) and use some unique feature of it to convince people to let them serve you ads, I suppose that would be marginally okay - except the bit about hijacking websites and siphoning off their revenue streams, which seems at best unethical.

      But let's not miss out on yet another opportunity to bash Google for the business model that provides you with search, email, youtube and the Chromium

  • lesson learned? (Score:4, Informative)

    by lkcl ( 517947 ) <lkcl@lkcl.net> on Tuesday October 20, 2015 @09:26AM (#50764961) Homepage

    windows and macosx users, listen up. GNU/Linux Distributions have a digitally-signed audit trail that goes all the way back to multiply personally-verified GPG key signatures. *NO* malware gets through that process - absolutely none. and the reason why is very simple: anyone who dares to install malware would, by virtue of the GPG-signed audit chain, be tracked back and their reputation so publicly destroyed - forever - that they would never work in the software industry ever again.

    not even microsoft or apple, no matter how they try, can replicate this audit trail, because their software installation is (a) not transparent (i.e. not trustworthy) and (b) as those corporations set themselves up as the "single choke-point" they simply don't have the time, the resources or the financial incentive to support *YOU*, the user, when *YOU* want to install some random piece of third party software.

    in short, i am sorry to have to inform you that if you run the windows or the macosx operating systems, *despite* the fact that you are perfectly entitled to install 3rd party software [for now, anyway: it's getting harder to do], despite the fact that if you choose not to install 3rd party software your computer would be completely useless - despite all these things being true and perfectly valid, i am sorry to have to inform you that *if* you choose to install 3rd party software, you get everything that you deserve.

    people who install GNU/Linux OSes don't do it "because it's fun" or "because they want a challenge of running command-line tools", they do it because they *know* and trust the digital audit trail based on the publicly-verifiable reputation of the 1000+ developers behind each distribution, and, because that trail exists, they can feel that they're safe from malware and spyware when they follow the install procedures that come with their OS.

    of course, there are those people - GNU/Linux users - who bypass that process, and perform manual installation of random unverified online packages. such people it has to be said _also_ get what they deserve.

    now, we can indeed track the MD5 checksums, and manually check the digital signatures, or even manually build the software ourselves (regardless of the OS), but the inconvenience and complexity of doing so is beyond most people - often myself included: i just cannot be bothered to compile software from source these days unless it's absolutely essential. ... but why put yourself through that?? why are you risking yourself to exposure to privacy violations and data violatinos? i genuinely don't understand why you would do that to yourself. perhaps someone could explain it to me.

    • Comment removed (Score:5, Informative)

      by account_deleted ( 4530225 ) on Tuesday October 20, 2015 @09:44AM (#50765089)
      Comment removed based on user account deletion

      • Re: (Score:2)

        by tepples ( 727027 )

        And, obviously, if someone can install software from Google via downloads, they can install other software via downloads, including malware.

        The difference is that on a GNU/Linux distro, one can choose to go without installing software via untrusted binary downloads, and this choice still produces a useful operating environment. For example, one can choose to download not actual Chrome, but Chromium.

      • Re: (Score:3)

        by leiz ( 35205 )

        There is another way to go about it. If you trust Google's Linux software repository, you can install the repo's GPG key first: https://www.google.com/linuxre... [google.com]

        After that, all downloads from Google, e.g. apt-get install google-chrome-stable, gets the same GPG verification as anything from Debian/Ubuntu. Downloads are still over HTTP, just like Debian/Ubuntu, because the GPG verification is there to actually verify the downloads.

      • Thats what checksums are for....

      • Re: (Score:2)

        by lkcl ( 517947 )

        Last time I installed Chrome (not Chromium, but actual Chrome) on Ubuntu I still had to download it from Google trusting Google's process rather than Canonical's. So no, it didn't go through some encryption protected carefully managed central repo. And, obviously, if someone can install software from Google via downloads, they can install other software via downloads, including malware.

        ... and you end up being tracked, and have advertising pushed at you, and your privacy is invaded through data sharing - yes, we know. that's why the Debian GNU/Linux team took the (libre-licensed) source code for the chrome browser, did a full source code audit, *REMOVED* all of the spy-tracking, *REMOVED* all of the privacy-violating code, compiled that and released it through the standard Debian packaging system [which includes the audit trail]

        if the ubuntu team are actually bothering to properly follow

    • Comment removed (Score:5, Interesting)

      by account_deleted ( 4530225 ) on Tuesday October 20, 2015 @09:49AM (#50765131)
      Comment removed based on user account deletion

      • Re: (Score:2)

        by lkcl ( 517947 )

        Red herring. Efast didn't arrive to people's computers via official channels. Linux is just as vulnerable to malware when stuff is being installed via unofficial channels.

        ... which means that you didn't read the full contents of what i wrote before posting. in paragraph (5) i made this exact point. so you not only didn't read what i wrote, but you then detracted from the *actual* point being made, by criticising what was written without proper thought and consideration on your part.

        you then go on to conclude that i must be on a "high horse", but at the point at which you clearly didn't read each and every paragraph, i lost interest in reading further because you clearly de

    • Re:lesson learned? (Score:4, Interesting)

      by ArchieBunker ( 132337 ) on Tuesday October 20, 2015 @09:50AM (#50765139)

      That may be true but the software could be full of security holes. Millions of people compiled OpenSSL while never once reading it. Turned out to be swiss cheese.

    • Re: (Score:2, Insightful)

      by Anonymous Coward

      printf("\v"); [cmu.edu] This was published in August 1984, and credits other work prior to that, including a security critique of an "early version of Multics". It's a 40 year old attack. Your "full trust" argument is bullshit. There are mitigations for this specific trust attack, but they're not practiced widely. And other similar trust attacks aren't mitigated at all.

      If someone writes malware for Linux, there will be malware for Linux. (And it has already happened.) The only thing keeping malware on Linux from be

      • There are mitigations for this specific trust attack, but they're not practiced widely.

        I assume you're referring to David A. Wheeler's "diverse double-compiling" mitigation for the Ken Thompson attack. How are you sure that the major GNU/Linux distributors don't do this on their compile farms?

        And other similar trust attacks aren't mitigated at all.

        To which "similar trust attacks" do you refer, so that we can put them on the wishlist for mitigation?

    • GNU/Linux Distributions have a digitally-signed audit trail that goes all the way back to multiply personally-verified GPG key signatures. *NO* malware gets through that process - absolutely none.

      By "multiply personally-verified GPG key signatures", I assume you're referring to the requirement to attend a key-signing party in person [debian.org] with a Debian Developer. For upstream maintainers who live outside cycling distance of a Debian Developer willing to act as a sponsor for the upstream maintainer's package, this could end up throwing out the baby (a useful application that happens to have been developed by an upstream maintainer living far from the nearest Debian Developer) with the bathwater (malware).

      i just cannot be bothered to compile software from source these days unless it's absolutely essential. ... but why put yourself through that??

      B

    • Well...

      • On the OSX side - if you stick strictly to the App Store (the walled garden), *somebody* had to pay to get that dev license and the app submitted, so while not as excellent as a GPG trail, it does track back to some known entity... and while not perfect, the track record is pretty damned solid.
      • On Linux - unless you strictly limit your downloads from trusted and known YUM/APT/etc repos, you're just as much at risk in Linux as you are on any other OS. The good news is, nearly everything you need can be

    • Re: (Score:2)

      by Tom ( 822 )

      not even microsoft or apple, no matter how they try, can replicate this audit trail,

      Yes, it can. My OS X understands signed installs just like my Debian does. Both will not let me install an unsigned package without me explicitly saying "ok, do it".

      Which is exactly what this and any other malware will do. It will not be signed, it will need a user to click an ok button, and most users will do it, because 10+ years of useless windows popup-windows with pointless "are you sure?" cover-your-ass messages have trained them to hit the green "ok, whatever" button.

      • Yes, it can. My OS X understands signed installs just like my Debian does. Both will not let me install an unsigned package without me explicitly saying "ok, do it".

        I don't think you understand what the word trail means.

        • Re: (Score:3)

          by Tom ( 822 )

          Really? Let me check, certificate-based systems are entirely designed around a chain of signatures. GPG signatures are... uh... well, if it's in your keychain, it will be accepted. The workaround is to sign the package that contains the public keys.

          Don't get me wrong, I like the Debian approach, it's practical and it works. But I think you are being a little too ideological.

    • Re: (Score:2)

      by janoc ( 699997 )

      I am not sure how this post got moderated "Informative".

      Sorry, but you are seriously ignorant about how Linux package repositories work. There is not GPG signature "audit trail". Only the packages uploaded to the repositories are signed. The distros only package the code - do you really believe (and trust) that the person who has compiled and signed the package has actually verified that it is malware free? Or that everyone who posts whatever code to Github or wherever else where the distro gets their softw

    • You'd have more street credit if you didn't refer to it as GNU/Linux.

      gnu is a small and shrinking past of most distros. L

    • Re: (Score:2)

      by spauldo ( 118058 )

      people who install GNU/Linux OSes don't do it "because it's fun" or "because they want a challenge of running command-line tools", they do it because they *know* and trust the digital audit trail based on the publicly-verifiable reputation of the 1000+ developers behind each distribution, and, because that trail exists, they can feel that they're safe from malware and spyware when they follow the install procedures that come with their OS.

      I install Linux because it's fun and I enjoy running command line tools.

      I did so back in the days when your only option for installing software was to download the source code and compile it.

      I have been doing so since before GPG existed (PGP was around, but people didn't sign packages with it).

      I have been doing so since before Debian started signing their repositories.

      I've watched Red Hat users install RPMs downloaded from third party sites because they had no recourse - Red Hat did not have the comprehensi

  • Follow the money (Score:4, Insightful)

    by QuietLagoon ( 813062 ) on Tuesday October 20, 2015 @09:29AM (#50764975)
    Instead of going after those who plant the malware (in this case, the Chrome clone), why not go after those "third party advertisers" and those who place the ads on the hijacked browser?

    • Re: (Score:2)

      by wbr1 ( 2538558 )
      Because they claim innocence. They thought the ads were being served on regular web pages, and had no idea that it was malware spewing it out and collecting the clickthrus,
      • And they may very well be innocent. Just because some developer has found a way to milk their advertising for personal profit does not mean that they were behind the malware, just that they are a bunch of douches serving adverts. To be honest, would they even care? They want their adverts to be seen regardless of how it's done.

  • Yeah well.. (Score:2, Flamebait)

    by jafiwam ( 310805 )
    If they fixed all the rampant memory leaks in Chrome in the process I wouldn't mind much.

  • Possible eFast Suspect (Score:4, Informative)

    by Khyber ( 864651 ) <techkitsune@gmail.com> on Tuesday October 20, 2015 @10:06AM (#50765277) Homepage Journal

    Going through the SF repository for eFast, I have a name of one Mr. Isarith Mahappu K, of No: 15, Chapel Terrace, Stafford, ST163AH.

    Last time I can see that property for sale on the market was 14 Dec, 2007. Odds are it is still owned, probably by this same person.

  • Burning Question... (Score:5, Funny)

    by avandesande ( 143899 ) on Tuesday October 20, 2015 @10:13AM (#50765321) Journal

    Can I install the Ask toolbar on it?

  • They should have called this thing Cymothoa Exigua [google.ca] instead.

  • How is that different than Chrome itself? Isn't that the point of Google's browser; to serve 3rd party ads to me and track my usage?

  • How does this malicious adware get installed onto the system and does it run on Apple OS X, Android or Linux?

Slashdot Top Deals

Our business in life is not to succeed but to continue to fail in high spirits. -- Robert Louis Stevenson

Close