Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
skip to main content
research-article
Open access

Characterizing Cryptocurrency-themed Malicious Browser Extensions

Published: 08 December 2022 Publication History

Abstract

Due to the surging popularity of various cryptocurrencies in recent years, a large number of browser extensions have been developed as portals to access relevant services, such as cryptocurrency exchanges and wallets. This has stimulated a wild growth of cryptocurrency themed malicious extensions that cause heavy financial losses to the users and legitimate service providers. They have shown their capability of evading the stringent vetting processes of the extension stores, highlighting a lack of understanding of this emerging type of malware in our community. In this work, we conduct the first systematic study to identify and characterize cryptocurrency-themed malicious extensions. We monitor seven official and third-party extension distribution venues for 18 months (December 2020 to June 2022) and have collected around 3600 unique cryptocurrency-themed extensions. Leveraging a hybrid analysis, we have identified 186 malicious extensions that belong to five categories. We then characterize those extensions from various perspectives including their distribution channels, life cycles, developers, illicit behaviors, and illegal gains. Our work unveils the status quo of the cryptocurrency-themed malicious extensions and reveals their disguises and programmatic features on which detection techniques can be based. Our work serves as a warning to extension users, and an appeal to extension store operators to enact dedicated countermeasures. To facilitate future research in this area, we release our dataset of the identified malicious extensions and open-source our analyzer.

References

[1]
AdBlock. 2009. https://getadblock.com. (2009).
[2]
Add-on Policies. Visited in July 2022. https://extensionworkshop.com/documentation/publish/add-on-policies. ( Visited in July 2022).
[3]
Address Checker. Visited in July 2022. http://addresschecker.eu. ( Visited in July 2022).
[4]
Alternative Extension Distribution Options. Visited in July 2022. https://developer.chrome.com/docs/extensions/mv3/external_extensions. ( Visited in July 2022).
[5]
AST Explorer. Visited in July 2022. https://astexplorer.net. ( Visited in July 2022).
[6]
Atzei, Nicola and Bartoletti, Massimo and Cimoli, Tiziana. 2017. A Survey of Attacks on Ethereum Smart Contracts SoK. In POST. 164--186.
[7]
Sruthi Bandhakavi, Nandit Tiku, Wyatt Pittman, Samuel T. King, P. Madhusudan, and Marianne Winslett. 2011. Vetting Browser Extensions for Security Vulnerabilities with VEX. Commun. ACM, Vol. 54, 9 (2011), 91--99.
[8]
Barrera, David and Kayacik, H. Günecs and van Oorschot, Paul C. and Somayaji, Anil. 2010. A Methodology for Empirical Analysis of Permission-Based Security Models and Its Application to Android. In CCS. 73--84.
[9]
Bitcoin Abuse Database. Visited in July 2022. https://www.bitcoinabuse.com. ( Visited in July 2022).
[10]
BlockCypher. Visited in July 2022. https://www.blockcypher.com. ( Visited in July 2022).
[11]
Browser Market Share Worldwide. Visited in July 2022. https://gs.statcounter.com/browser-market-share. ( Visited in July 2022).
[12]
Maurantonio Caprolu, Simone Raponi, Gabriele Oligeri, and Roberto Di Pietro. 2021. Cryptomining makes noise: Detecting cryptojacking via Machine Learning. Computer Communications, Vol. 171 (2021), 126--139.
[13]
Chen, Ting and Li, Zihao and Zhu, Yuxiao and Chen, Jiachi and Luo, Xiapu and Lui, John Chi-Shing and Lin, Xiaodong and Zhang, Xiaosong. 2020. Understanding Ethereum via Graph Analysis. ACM Trans. Internet Technol., Vol. 20 (2020).
[14]
Chen, Ting and Zhu, Yuxiao and Li, Zihao and Chen, Jiachi and Li, Xiaoqi and Luo, Xiapu and Lin, Xiaodong and Zhange, Xiaosong. 2018. Understanding Ethereum via Graph Analysis. In IEEE INFOCOM. 1484--1492.
[15]
Chen, Weili and Wu, Jun and Zheng, Zibin and Chen, Chuan and Zhou, Yuren. 2019. Market Manipulation of Bitcoin: Evidence from Mining the Mt. Gox Transaction Network. In IEEE INFOCOM. 964--972.
[16]
Chen, Weili and Xu, YueJin and Zheng, Zibin and Zhou, Yuren and Yang, Jianxun Eileen and Bian, Jing. 2019. Detecting "Pump Dump Schemes" on Cryptocurrency Market Using An Improved Apriori Algorithm. In SOSE. 293--2935.
[17]
Chen, Weili and Zheng, Zibin and Cui, Jiahui and Ngai, Edith and Zheng, Peilin and Zhou, Yuren. 2018. Detecting Ponzi Schemes on Ethereum: Towards Healthier Blockchain Technology. In WWW. 1409--1418.
[18]
CipherTrace. 2020. Cryptocurrency Crime and Anti-Money Laundering Report. https://ciphertrace.com/2020-year-end-cryptocurrency-crime-and-anti-money-laundering-report. (2020).
[19]
Coin98 Wallet. Visited in July 2022. https://chrome.google.com/webstore/detail/coin98-wallet/aeachknmefphepccionboohckonoeemg. ( Visited in July 2022).
[20]
Coinbase. 2021. Coinbase Wallet introduces new browser extension. https://blog.coinbase.com/coinbase-wallet-introduces-new-browser-extension-dd067403b86. (2021).
[21]
Coinbase Exchange Extension. Visited in July 2022. https://chrome.google.com/webstore/detail/coinbase-wallet-extension/hnfanknocfeofbddgcijnmhnfnkdnaad. ( Visited in July 2022).
[22]
Coinbase Wallet extension. Visited in July 2022. https://chrome.google.com/webstore/detail/coinbase-wallet-extension/hnfanknocfeofbddgcijnmhnfnkdnaad. ( Visited in July 2022).
[23]
CoinMarketCap. Visited in July 2022a. https://coinmarketcap.com/rankings/exchanges. ( Visited in July 2022).
[24]
CoinMarketCap. Visited in July 2022b. https://coinmarketcap.com. ( Visited in July 2022).
[25]
Compare cryptocurrency wallets. Visited in July 2022. https://www.finder.com.au/view-cryptocurrency-wallets. ( Visited in July 2022).
[26]
Crx4Chrome. Visited in July 2022. https://www.crx4chrome.com. ( Visited in July 2022).
[27]
Crypto Price Tracker. Visited in July 2022. https://chrome.google.com/webstore/detail/crypto-price-tracker/fpkhlnacfhciopipcjpcjmkpldbogaeo. ( Visited in July 2022).
[28]
CryptoScamDB. Visited in July 2022. https://cryptoscamdb.org. ( Visited in July 2022).
[29]
Hamid Darabian, Sajad Homayounoot, Ali Dehghantanha, Sattar Hashemi, Hadis Karimipour, Reza M Parizi, and Kim-Kwang Raymond Choo. 2020. Detecting cryptomining malware: a deep learning approach for static and dynamic analysis. Journal of Grid Computing, Vol. 18, 2 (2020), 293--303.
[30]
Louis F. DeKoven, Stefan Savage, Geoffrey M. Voelker, and Nektarios Leontiadis. 2017. Malicious Browser Extensions at Scale: Bridging the Observability Gap between Web Site and Browser. In CSET.
[31]
Alberto Falk Delgado, Gregory Garretson, and Anna Falk Delgado. 2019. The language of peer review reports on articles published in the BMJ, 2014--2017: an observational study. Scientometrics (2019), 1225--1235.
[32]
Developer Program Policies. Visited in July 2022. https://developer.chrome.com/docs/webstore/program_policies. ( Visited in July 2022).
[33]
Domain State. Visited in July 2022. https://www.domainstate.com. ( Visited in July 2022).
[34]
Kun Du, Hao Yang, Zhou Li, Haixin Duan, and Kehuan Zhang. 2016. The Ever-Changing Labyrinth: A Large-Scale Analysis of Wildcard DNS Powered Blackhat SEO. In USENIX Security. 245--262.
[35]
EQUAL Wallet. Visited in July 2022. https://chrome.google.com/webstore/detail/equal-wallet/blnieiiffboillknjnepogjhkgnoapac. ( Visited in July 2022).
[36]
Esprima. Visited in July 2022. https://esprima.org. ( Visited in July 2022).
[37]
Etherscan. Visited in July 2022. https://etherscan.io. ( Visited in July 2022).
[38]
Europol Spotlight - Cryptocurrencies - Tracing the evolution of criminal finances. 2021. https://www.europol.europa.eu/media-press/newsroom/news/digital-gold-rush-debunking-common-myths-criminal-use-of-cryptocurrencies. (2021).
[39]
ExtAnalysis. 2019. https://github.com/Tuhinshubhra/ExtAnalysis. (2019).
[40]
Extension Dataset. Visited in July 2022. https://github.com/browserExtension057/Cryptocurrency-extensions. ( Visited in July 2022).
[41]
Extension Deltas. Visited in July 2022. https://github.com/wspr-ncsu/extensiondeltas. ( Visited in July 2022).
[42]
Fake Ledger Chrome Extension Crypto Scam May Have Stolen Up to $2.5M. 2020. https://www.financemagnates.com/cryptocurrency/news/fake-ledger-chrome-extension-crypto-scam-may-have-stolen-up-to-2--5m. (2020).
[43]
Adrienne Porter Felt, Kate Greenwood, and David Wagner. 2011. The Effectiveness of Application Permissions. In USENIX WebApps. 7.
[44]
George Bissias and Brian Neil Levine and A. Pinar Ozisik and Gavin Andresen and Amir Houmansadr. 2016. An Analysis of Attacks on Blockchain Consensus. CoRR (2016).
[45]
Google is banning all cryptomining extensions from its Chrome Web Store. 2020. https://techcrunch.com/2018/04/02/google-is-banning-all-cryptomining-extensions-from-its-chrome-web-store. (2020).
[46]
Google Removes 49 Phishing Extensions That Steal Cryptocurrency Data. 2020. https://cointelegraph.com/news/google-removes-49-phishing-extensions-that-steal-cryptocurrency-data. (2020).
[47]
Guge App. Visited in July 2022. https://www.gugeapps.net. ( Visited in July 2022).
[48]
Guha, Arjun and Fredrikson, Matthew and Livshits, Benjamin and Swamy, Nikhil. 2011. Verified Security for Browser Extensions. In IEEE S&P. 115--130.
[49]
Haoyong. Visited in July 2022. https://www.chrome666.com. ( Visited in July 2022).
[50]
Harry. Visited in July 2022. https://medium.com/mycrypto/discovering-fake-browser-extensions-that-target-users-of-ledger-trezor-mew-metamask-and-more-e281a2b80ff9. ( Visited in July 2022).
[51]
Huobi Market. Visited in July 2022. https://chrome.google.com/webstore/detail/lgeilhhjnhcjlmlohhlpedhgddddgebh. ( Visited in July 2022).
[52]
Alexandros Kapravelos, Chris Grier, Neha Chachra, Christopher Kruegel, Giovanni Vigna, and Vern Paxson. 2014. Hulk: Eliciting Malicious Behavior in Browser Extensions. In USENIX Security 14. 641--654.
[53]
keraf. Visited in July 2022. : https://github.com/keraf/NoCoin/blob/master/src/blacklist.txt. ( Visited in July 2022).
[54]
KuCoin:Bitcoin,Dogecoin Price Market. Visited in July 2022. https://chrome.google.com/webstore/detail/kucoinbitcoindogecoin-pri/nalaeminfbmmidadoaegigajbapfajgi. ( Visited in July 2022).
[55]
LastPass. 2008. https://www.lastpass.com. (2008).
[56]
Seunghyeon Lee, Changhoon Yoon, Heedo Kang, Yeonkeun Kim, Yongdae Kim, Dongsu Han, Sooel Son, and Seungwon Shin. 2019. Cybercriminal minds: an investigative study of cryptocurrency abuses in the dark web. In NDSS. 1--15.
[57]
Yuxi Ling, Kailong Wang, Guangdong Bai, Haoyu Wang, and Jin Song Dong. 2022. Are They Toeing the Line? Diagnosing Privacy Compliance Violations among Browser Extensions. In ASE.
[58]
Malware and unwanted software. Visited in July 2022. https://developers.google.com/search/docs/advanced/security/malware. ( Visited in July 2022).
[59]
Massimo Bartoletti and Barbara Pes and Sergio Serusi. 2018. Data mining for detecting Bitcoin Ponzi schemes. CVCBT (2018).
[60]
Metamask. Visited in July 2022. https://chrome.google.com/webstore/detail/metamask/nkbihfbeogaeaoehlefnkodbefgpgknn. ( Visited in July 2022).
[61]
minerBlock. Visited in July 2022. https://chrome.google.com/webstore/detail/minerblock/emikbbbebcdfohonlaifafnoanocnebl. ( Visited in July 2022).
[62]
mitmproxy. Visited in July 2022. https://mitmproxy.org. ( Visited in July 2022).
[63]
MonkeyLearn. Visited in July 2022. https://monkeylearn.com/sentiment-analysis. ( Visited in July 2022).
[64]
Nami Wallet. Visited in July 2022. https://chrome.google.com/webstore/detail/nami-wallet/lpfcbjknijpeeillifnkikgncikgfhdo. ( Visited in July 2022).
[65]
Nav Jagpal and Eric Dingle and Jean-Philippe Gravel and Panayiotis Mavrommatis and Niels Provos and Moheeb Abu Rajab and Kurt Thomas. 2015. Trends and Lessons from Three Years Fighting Malicious Extensions. In USENIX Security. 579--593.
[66]
Neil Gandal and JT Hamrick and Tyler Moore and Tali Oberman. 2018. Price manipulation in the Bitcoin ecosystem. Journal of Monetary Economics, Vol. 95 (2018), 86--96.
[67]
Kaan Onarlioglu, Mustafa Battal, William Robertson, and Engin Kirda. 2013. Securing Legacy Firefox Extensions with SENTINEL (DIMVA ). 122--138.
[68]
One-vs-the-rest (OvR) Multiclass Strategy. Visited in July 2022. https://scikit-learn.org/stable/modules/generated/sklearn.multiclass.OneVsRestClassifier.html. ( Visited in July 2022).
[69]
Nikolaos Pantelaios, Nick Nikiforakis, and Alexandros Kapravelos. 2020. You've Changed: Detecting Malicious Browser Extensions through Their Update Deltas. In CCS. 477--491.
[70]
Ross Phillips and Heidi Wilder. 2020. Tracing Cryptocurrency Scams: Clustering Replicated Advance-Fee and Phishing Websites. CoRR (2020).
[71]
Shahriar, Hossain and Weldemariam, Komminist and Zulkernine, Mohammad and Lutellier, Thibaud. 2014. Effective Detection of Vulnerable and Malicious Browser Extensions. Comput. Secur., Vol. 47 (2014), 66--84.
[72]
Share of respondents who indicated they either owned or used cryptocurrencies in 55 countries worldwide in 2020. Visited in July 2022. https://www.statista.com/statistics/1202468/global-cryptocurrency-ownership. ( Visited in July 2022).
[73]
Dolière Francis Somé. 2019. EmPoWeb: Empowering Web Applications with Browser Extensions. In IEEE S&P. 227--245.
[74]
Stargazer Wallet. Visited in July 2022. https://chrome.google.com/webstore/detail/stargazer-wallet/pgiaagfkgcbnmiiolekcfmljdagdhlcm. ( Visited in July 2022).
[75]
Stefan Heule and Devon Rifkin and Alejandro Russo and Deian Stefan. 2015. The Most Dangerous Code in the Browser. In HotOS XV. USENIX Association.
[76]
Magdalena Szumilas. 2010. Explaining odds ratios. Journal of the Canadian academy of child and adolescent psychiatry, Vol. 19, 3 (2010), 227.
[77]
Tab Wrangler. 2010. https://github.com/tabwrangler/tabwrangler. (2010).
[78]
Ted Knutson. 2022. Crypto Increasingly Used In Human/Drug Trafficking Says GAO. https://www.forbes.com/sites/tedknutson/2022/01/10/crypto-increasingly-used-in-humandrug-trafficking-says-gao/'sh=7043c1c4637e. (2022).
[79]
Ege Tekiner, Abbas Acar, A. Selcuk Uluagac, Engin Kirda, and Ali Aydin Selcuk. 2021. SoK: Cryptojacking Malware. In 2021 IEEE EuroS&P). 120--139.
[80]
Mike Ter Louw, Jin Soon Lim, and V. N. Venkatakrishnan. 2007. Extensible Web Browser Security (DIMVA). 1--19.
[81]
The Selenium Project. Visited in July 2022. https://www.selenium.dev. ( Visited in July 2022).
[82]
Kurt Thomas, Elie Bursztein, Chris Grier, Grant Ho, Nav Jagpal, Alexandros Kapravelos, Damon Mccoy, Antonio Nappa, Vern Paxson, Paul Pearce, Niels Provos, and Moheeb Abu Rajab. 2015. Ad Injection at Scale: Assessing Deceptive Advertisement Modifications. In IEEE S&P. 151--167.
[83]
Victor, Friedhelm and Weintraud, Andrea Marie. 2021. Detecting and Quantifying Wash Trading on Decentralized Cryptocurrency Exchanges. In WWW. 23--32.
[84]
VirusTotal. Visited in July 2022. https://www.virustotal.com/gui/home. ( Visited in July 2022).
[85]
WalletExplorer. Visited in July 2022a. https://www.walletexplorer.com. ( Visited in July 2022).
[86]
WalletExplorer. Visited in July 2022b. https://oxt.me. ( Visited in July 2022).
[87]
Yao Wang, Wandong Cai, Pin Lyu, and Wei Shao. 2018. A combined static and dynamic analysis approach to detect malicious browser extensions. Security and Communication Networks (2018).
[88]
Wu, Jiajing and Yuan, Qi and Lin, Dan and You, Wei and Chen, Weili and Chen, Chuan and Zheng, Zibin. 2020. Who Are the Phishers? Phishing Scam Detection on Ethereum via Network Embedding. IEEE SMC (2020), 1--11.
[89]
xd4rker. Visited in July 2022. https://github.com/xd4rker/MinerBlock/blob/master/assets/filters.txt. ( Visited in July 2022).
[90]
Pengcheng Xia, Haoyu Wang, Bingyu Gao, Weihang Su, Zhou Yu, Xiapu Luo, Chao Zhang, Xusheng Xiao, and Guoai Xu. 2021. Trade or Trick? Detecting and Characterizing Scam Tokens on Uniswap Decentralized Exchange. Proc. ACM Meas. Anal. Comput. Syst., Vol. 5, 3 (2021), 26.
[91]
Pengcheng Xia, Haoyu Wang, Xiapu Luo, Lei Wu, Yajin Zhou, Guangdong Bai, Guoai Xu, Gang Huang, and Xuanzhe Liu. 2020a. Don't Fish in Troubled Waters! Characterizing Coronavirus-themed Cryptocurrency Scams. In Symposium on Electronic Crime Research. 1--14.
[92]
Pengcheng Xia, Haoyu Wang, Bowen Zhang, Ru Ji, Bingyu Gao, Lei Wu, Xiapu Luo, and Guoai Xu. 2020b. Characterizing cryptocurrency exchange scams. Computers & Security, Vol. 98 (2020), 101993.
[93]
Xinyu Xing, Wei Meng, Byoungyoung Lee, Udi Weinsberg, Anmol Sheth, Roberto Perdisci, and Wenke Lee. 2015. Understanding Malvertising Through Ad-Injecting Browser Extensions. In WWW. 1286--1295. io

Cited By

View all
  • (2024)Combating Islamophobia: Compromise, Community, and Harmony in Mitigating Harmful Online ContentACM Transactions on Social Computing10.1145/36415107:1(1-32)Online publication date: 27-Apr-2024
  • (2024)Monotonicity and the Precision of Program AnalysisProceedings of the ACM on Programming Languages10.1145/36328978:POPL(1629-1662)Online publication date: 5-Jan-2024
  • (2024)PmTrackProceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies10.1145/36314337:4(1-30)Online publication date: 12-Jan-2024
  • Show More Cited By

Index Terms

  1. Characterizing Cryptocurrency-themed Malicious Browser Extensions

    Recommendations

    Comments

    Information & Contributors

    Information

    Published In

    cover image Proceedings of the ACM on Measurement and Analysis of Computing Systems
    Proceedings of the ACM on Measurement and Analysis of Computing Systems  Volume 6, Issue 3
    POMACS
    December 2022
    534 pages
    EISSN:2476-1249
    DOI:10.1145/3576048
    Issue’s Table of Contents
    This work is licensed under a Creative Commons Attribution International 4.0 License.

    Publisher

    Association for Computing Machinery

    New York, NY, United States

    Publication History

    Published: 08 December 2022
    Published in POMACS Volume 6, Issue 3

    Check for updates

    Author Tags

    1. browser extension
    2. cryptocurrency
    3. malware detection

    Qualifiers

    • Research-article

    Funding Sources

    • Singapore Ministry of Education Academic Research Fund Tier 3

    Contributors

    Other Metrics

    Bibliometrics & Citations

    Bibliometrics

    Article Metrics

    • Downloads (Last 12 months)349
    • Downloads (Last 6 weeks)43
    Reflects downloads up to 30 Aug 2024

    Other Metrics

    Citations

    Cited By

    View all
    • (2024)Combating Islamophobia: Compromise, Community, and Harmony in Mitigating Harmful Online ContentACM Transactions on Social Computing10.1145/36415107:1(1-32)Online publication date: 27-Apr-2024
    • (2024)Monotonicity and the Precision of Program AnalysisProceedings of the ACM on Programming Languages10.1145/36328978:POPL(1629-1662)Online publication date: 5-Jan-2024
    • (2024)PmTrackProceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies10.1145/36314337:4(1-30)Online publication date: 12-Jan-2024
    • (2024)Interface Illusions: Uncovering the Rise of Visual Scams in Cryptocurrency WalletsProceedings of the ACM on Web Conference 202410.1145/3589334.3645348(1585-1595)Online publication date: 13-May-2024
    • (2024)Malware Threats Targeting Cryptocurrency: A Comparative Study2024 2nd International Conference on Cyber Resilience (ICCR)10.1109/ICCR61006.2024.10532846(1-8)Online publication date: 26-Feb-2024
    • (2024)ZunnaKnowledge Science, Engineering and Management10.1007/978-981-97-5489-2_18(203-213)Online publication date: 27-Jul-2024
    • (2023)Characterizing Cryptocurrency-themed Malicious Browser ExtensionsACM SIGMETRICS Performance Evaluation Review10.1145/3606376.359352951:1(91-92)Online publication date: 27-Jun-2023
    • (2023) Anchor: Fast and Precise Value-flow Analysis for Containers via Memory OrientationACM Transactions on Software Engineering and Methodology10.1145/356580032:3(1-39)Online publication date: 26-Apr-2023
    • (2023)Shockvertising, Malware, and a Lack of Accountability: Exploring Consumer Risks of Virtual Reality Advertisements and Marketing ExperiencesIEEE Security and Privacy10.1109/MSEC.2023.333210522:1(43-52)Online publication date: 8-Dec-2023
    • (2023)Android malware detection based on sensitive patternsTelecommunications Systems10.1007/s11235-022-00983-282:4(435-449)Online publication date: 20-Feb-2023
    • Show More Cited By

    View Options

    View options

    PDF

    View or Download as a PDF file.

    PDF

    eReader

    View online with eReader.

    eReader

    Get Access

    Login options

    Full Access

    Media

    Figures

    Other

    Tables

    Share

    Share

    Share this Publication link

    Share on social media