00:00:00.292-->00:00:05.292
>>Hi everyone! I am Tomer Cohen.
Eh I work at Wix dot com
currently leading the uh the R&D

00:00:08.000-->00:00:14.333
security team. Eh me and my team
are responsible for all wix's
productions systems, operations,

00:00:14.333-->00:00:20.542
security eh including
infrastructure uh applications
eh practically everything. Um

00:00:20.542-->00:00:25.542
and I am here to eh to talk to
about how to create botnet by
abusing chrome extensions. Or

00:00:29.167-->00:00:34.167
browser extensions in general.
So I'm gonna start with my
personal experience with bots

00:00:36.375-->00:00:41.375
the first challenge that me and
my team had had with bots was on
April 2016. It was a regular day

00:00:44.542-->00:00:49.542
in the office. Uh when suddenly
the Sign-up Graph.. eh eh
[pause] just a second, [pause]

00:00:55.375-->00:01:00.375
yeah okay I'm good. So suddenly
the Sign-up graph which eh eh,
indicates that a lot of users eh

00:01:07.208-->00:01:14.042
new users sign up to wix. It had
a dramatic eh increase now we're
familiar with these with these

00:01:14.042-->00:01:19.625
kind of attacks so we checked
and we saw that the requests are
not originated in one address or

00:01:19.625-->00:01:24.625
one country but in a lot of eh
sources and this is what we call
a bot attack. Now a word about

00:01:26.917-->00:01:31.917
bots. So according to Imperva
bots make, eh bots make the
majority of the traffic eh on

00:01:34.167-->00:01:39.167
the internet today and most of
the bots are bad bots and most
of the bad bots are

00:01:41.500-->00:01:46.500
impersonators. Impersonators are
bots that come to eh
weblications and fake a real and

00:01:49.917-->00:01:54.917
eh f-f-fake the activity of real
humans. Eh this causes a lot of
headaches to eh internet

00:01:57.292-->00:02:03.167
companies cause these eh these
bots they are very hard to
distinguish between these bots

00:02:03.167-->00:02:08.167
and and and and legit traffic.
Yeah we were there. Ok, so.
After, eh after seeing the eh eh

00:02:17.500-->00:02:21.167
the sign that we were under a
bot attack, we started to
investigate and we saw three

00:02:21.167-->00:02:27.750
things. The first thing eh that
we saw was that most of the
increases originated in Latin

00:02:27.750-->00:02:32.750
America eh countries and all
these clients come with chrome
browser. Now this is weird, and

00:02:34.875-->00:02:39.875
we kept investigating. The next
we saw we've noticed is that for
some reason the sign-up requests

00:02:43.750-->00:02:48.750
to our server come from a frame
eh wix eh fr-fr-from that that
loading wix sign-up form, from

00:02:52.958-->00:02:57.750
within facebook. For some reason
we didn't know yet what was the
reason for that - we see in a

00:02:57.750-->00:03:02.750
second. The third thing that
we've noticed is that um now
just a word about wix, wix is a

00:03:05.708-->00:03:12.250
uh uh is a website creation
platform everyone can come and
uh create their own website for

00:03:12.250-->00:03:17.250
free. So what we've noticed is
that these eh eh suspicious
users they've sign-up to wix, to

00:03:17.250-->00:03:22.250
a new account and then only 10
seconds after the sign-up event
we see that they publish a new

00:03:25.458-->00:03:31.250
wix website. Now this is
obviously weird because people
don't tend to design their

00:03:31.250-->00:03:37.750
website in 10 seconds and
publish it. So now we had a
pattern we knew what to look for

00:03:37.750-->00:03:42.750
so we went to one of these eh eh
accounts and saw that the
website that was published and

00:03:44.917-->00:03:49.917
this was the website that was
published in all these accounts.
And here it is in English uh

00:03:51.958-->00:03:56.958
this page says that um if you
want to see who viewed your
profile on facebook, the same

00:03:59.250-->00:04:05.708
old scam, you can eh click on
start and download eh eh
download the chrome extension

00:04:05.708-->00:04:10.708
for doing that. Now if we click
start, we actually get to the
real original google web store

00:04:13.458-->00:04:18.458
and see this extension eh called
Viad30 something. So we we had
we start to understand we

00:04:22.167-->00:04:27.083
understand that there is a
connection between the bot
attack that we're experiencing

00:04:27.083-->00:04:32.208
and this eh this malicious
extension or this extension at
the time. So we start

00:04:32.208-->00:04:36.375
investigating what's inside the
extension it was very hard cause
the code was highly

00:04:36.375-->00:04:40.500
sophisticated, we got help from
other guys including from
[inaudible] it's a bot

00:04:40.500-->00:04:46.292
protection eh eh eh um company
that we work with. And this is
what we found - this is what the

00:04:46.292-->00:04:51.292
extension does. Firstly it
injects code into facebook tabs
now co-extensions with pop up

00:04:54.750-->00:05:01.000
emissions have the ability to
inject javascript code to any
open tab by user and also to

00:05:01.000-->00:05:06.875
control to help create new tabs
and everything and in this case
the attackers used it to inject

00:05:06.875-->00:05:12.000
code into the facebook tab. Why
facebook tab? I guess because
everyone is on it and uh all the

00:05:12.000-->00:05:17.000
reasons that we've seen second.
The next thing eh the extension
does is open a wix iframe inside

00:05:19.250-->00:05:25.458
using the injected code to
facebook inside facebook eh it
opens a frame and loads wix

00:05:25.458-->00:05:30.458
sign-up form from this frame
from within the frame it sends
the sign-up request to our

00:05:33.083-->00:05:39.875
server. Now why, my question
here is why would they need to
open a frame? Why wouldn't they

00:05:39.875-->00:05:44.875
just inject the code and send
the sign-up request to wix? Eh
co-extension are not enforced eh

00:05:47.542-->00:05:53.417
eh with the eh eh same origin
policy they can send a request
from facebook to wix. Now the

00:05:53.417-->00:06:00.333
answer here is that, is that eh
here at wix we do have bot
protection mechanisms eh and it

00:06:00.333-->00:06:05.333
has um eh eh some features, so
if that [inaudible] if we just
send the sign-up form from just

00:06:09.458-->00:06:16.250
any tab this would fail because
you don't have the right
cookies, headers, tokens

00:06:16.250-->00:06:21.542
whatever that you need to fetch
from the signup form before you
send the actual sign-up

00:06:21.542-->00:06:26.542
requests. However if you somehow
eh open eh eh frame with the
sign-up form, like with our

00:06:29.667-->00:06:34.667
case, inside facebook. And you
send the sign-up request from
within this frame it succeeds.

00:06:36.958-->00:06:41.958
So the attackers actually did
that to bypass our bot
protection mechanisms cause they

00:06:44.000-->00:06:49.500
knew that they wouldn't be able
to send a request straight from
other tabs, the open frame. Now

00:06:49.500-->00:06:54.500
I mind you that this frame is
transparent and the victim user
does not notice anything while

00:06:56.583-->00:07:01.583
he signed-up to wix and he
published a new website. Ok
let's go back to the extension

00:07:04.875-->00:07:08.875
course of action eh we already
saw that it injects code into
facebook tab and then it

00:07:08.875-->00:07:13.875
sign-ups eh to wix. Next thing
it does, is like we saw, its it
from the account eh eh created

00:07:16.792-->00:07:22.708
in wix, it publishes a new wix
website now all these websites
lead to the same page, the

00:07:22.708-->00:07:27.708
attack page that we saw earlier.
Um now what it does, it takes
the newly created eh website URL

00:07:30.958-->00:07:37.167
of the wix website that was
created and sends it using
facebook messages to all the

00:07:37.167-->00:07:42.167
victim's friends on facebook.
This is how the malware is
distributed. Lastly these guys

00:07:45.167-->00:07:50.125
were rude enough to grab the
victim's google authorization
token and submit a review in the

00:07:50.125-->00:07:55.125
google chrome exten-en-ension
webstore of 5 stars. [laughter]
So they have really good

00:08:02.458-->00:08:07.458
reputation for their malicious
extension. [pause] Cool. Now my
next question is why would this

00:08:10.583-->00:08:16.125
attacker even need wix on the
way I mean why wouldn't he just
inject the code to facebook and

00:08:16.125-->00:08:22.458
then use facebook messenger to
distribute the URL of his attack
page? I mean he has already an

00:08:22.458-->00:08:27.458
attack page why would he need
wix on the way? So the answer
here is that wix was used um to

00:08:31.542-->00:08:36.542
distribute a bot um it wix wix
was actually here as supplier of
disposable URL's, I mean, um

00:08:40.750-->00:08:45.708
every victim that um is is
infected eh creates a new
website an new attack URL that

00:08:45.708-->00:08:50.708
leads to wix. And then it was
much harder for facebook to
detect this attack because all

00:08:55.375-->00:09:01.958
the URL's were different there
was, there wasn't a common eh eh
popular URL malicious URL that

00:09:01.958-->00:09:07.917
uh was sent in this requests. So
the attacker basically used wix
reputation in order to

00:09:07.917-->00:09:12.917
distribute his malware. And what
we've discussed so far um is
only the infection phase of this

00:09:15.792-->00:09:21.292
attack, of of this
attack.Obviously these bots have
been used for a lot of fake

00:09:21.292-->00:09:26.292
things that they, that they all
eh eh lead to the same result.
Money for the bot masters. So

00:09:29.625-->00:09:34.625
after they infect all these bots
eh using wix or other platforms
they can use them later, these

00:09:36.625-->00:09:41.500
bots, they have a command and
control for these bots we'll see
in a second. They can send add,

00:09:41.500-->00:09:47.875
eh they run these attacks, send
spam um and run other-other
attacks they can also put these

00:09:47.875-->00:09:52.875
bots for rent and then gain
money for the service for these
attacks as a service. [pause] We

00:10:04.125-->00:10:08.875
just saw a campaign infect
infection, a bot infection using
chrome extensions let's see

00:10:08.875-->00:10:15.542
another one. So we at wix
stopped, it took us some time,
but we stopped this attack and 2

00:10:15.542-->00:10:20.542
months later there were news
about a new attack eh and this
is how it looked like. It says

00:10:23.458-->00:10:27.125
'Facebook comment tagging
malware spreading via google
chrome. If you receive a

00:10:27.125-->00:10:32.125
facebook notification regarding
a friend tagging you - be very
cautious about it um now this eh

00:10:35.500-->00:10:41.833
this attack was eh was called
was named tag me if you can by
eh eh conspiracy lab's

00:10:41.833-->00:10:46.833
researcher Ido Naor and when I
read his report, it is a very
detailed report, I knew that it

00:10:49.833-->00:10:55.375
were the same attackers that
attacked wix 2 months before.
How did I know? Let's see how

00:10:55.375-->00:11:00.375
this attack worked. So first, a
victim gets a notification on
facebook saying that eh eh

00:11:03.250-->00:11:09.792
s-some friend of his of him
tagged him in eh in eh comment.
When the victim clicks this

00:11:09.792-->00:11:16.042
notification eh after a small
warning on facebook saying that
you are going out of facebook a

00:11:16.042-->00:11:21.042
JSE file is immediately
downloaded to the victim's
browser. Now J-J-JSE files are

00:11:24.417-->00:11:29.417
eh ex-like executable eh in
windows in all windows machines
so after if the victim clicks on

00:11:32.250-->00:11:37.250
this JSE file a malware is
running causing google chrome to
crash. Then it copies the google

00:11:40.083-->00:11:45.250
chrome process file, the exit
file, and create a new chrome
exit file with a chrome

00:11:45.250-->00:11:47.250
extension installed on it. This
is a malicious extension.
Similar to what we saw before in

00:11:47.250-->00:11:52.250
wix. After the chrome is
reopened the extension is
uploading a new instance of the

00:11:57.792-->00:12:02.792
JSE file to the victim's google
drive. Then it takes the URL of
the newly uploaded eh file and

00:12:09.250-->00:12:14.250
send this URL using fa-facebook
eh [inaudible] a create
notifications of tagging all the

00:12:17.167-->00:12:22.167
friends of the victim. One of
the victim's friends see's a
notification and the whole thing

00:12:25.958-->00:12:30.958
runs again and we've got
exponential growth infection
process. Now how did these guys

00:12:34.292-->00:12:38.625
manage to eh create a
notification on facebook that
lead to a download of a JSE

00:12:38.625-->00:12:42.542
file? That's a good question,
I'm sure you're all asking
yourselves that. Eh but it's

00:12:42.542-->00:12:48.458
too, it's too, it's too long for
for this lecture so you can find
mo-more details in this eh talks

00:12:48.458-->00:12:53.458
white paper or in Ido Naor's eh
eh report about tag me if you
can attack. Now this um I knew

00:12:57.625-->00:13:02.417
that this were sh the same
attackers because there's eh eh
eh a very small pattern here in

00:13:02.417-->00:13:07.792
this bot attacks eh and this is
the pattern, it always starts
with the user clicking on

00:13:07.792-->00:13:12.583
facebook on something. Next
thing that happens is that
somehow an extension is

00:13:12.583-->00:13:18.583
installed on his browser in the
wix attack it was from the
google webstore [cough] [clears

00:13:18.583-->00:13:24.750
throat] sorry - in the facebook
attack it was using as an
executable JSE file. After the

00:13:24.750-->00:13:30.750
extension is-is installed,
somehow a new payload of the
mali eh eh a new malic a new

00:13:30.750-->00:13:35.542
instance of the malicious
payload is is created it can be
a wix website leading to the

00:13:35.542-->00:13:40.542
attack page or just a JSE file
that was uploaded uploaded to
the google drive. Unless the

00:13:43.000-->00:13:48.083
extension takes the URL of the
newly created instance and send
it somehow in messages or

00:13:48.083-->00:13:53.833
comments notifications eh to all
the facebook friends, one of the
friends clicking it and then

00:13:53.833-->00:13:59.792
we've got the whole thing
running again. Now these two
cyber attacks had more common

00:13:59.792-->00:14:05.500
and more mutual eh eh eh effects
eh eh eh um for example there
were a lot of [inaudible]

00:14:05.500-->00:14:11.417
snippets that were similar and
also eh the attackers used the
same domains so it's clearly was

00:14:11.417-->00:14:16.417
the same attacker. Um now I want
to say that the companies that
were abused in these two

00:14:20.458-->00:14:27.292
campaigns are not minor
companies these magical bots
somehow comes and defeats

00:14:27.292-->00:14:30.167
facebook google and wix dot com
eh bot eh bot protection
services and all the services

00:14:30.167-->00:14:32.167
all all that that we were
talking about facebook
messaging, google drive, uploads

00:14:32.167-->00:14:34.167
and everything has uh um has bot
protection mechanisms in place.
So why common bots fail to

00:14:34.167-->00:14:36.167
bypass these mechanisms and our
bot succeeds? So let's ask
ourselves for a second what

00:14:36.167-->00:14:42.958
makes a good bot? So the goal
for good bots is actually to
look like human right? The bot

00:14:42.958-->00:14:47.958
wants, the bot wants eh eh eh
the website that he's visiting
to think that he is a human that

00:14:50.375-->00:14:55.375
is sitting on a computer and
surfing the internet using a web
browser right? So the first

00:14:58.833-->00:15:03.833
thing th-that this bot has to
cope with is javascript
challenges. Now th-this is a lot

00:15:22.667-->00:15:28.583
of uh this is uh eh practical eh
eh known practice in detecting
bots you give them the right

00:15:28.583-->00:15:33.583
javascript calculation and they
cannot eh cope with it. In our
case our bot is actually running

00:15:35.750-->00:15:40.750
inside chrome. So you can
challenge it with any javascript
that you want and he will cope

00:15:43.000-->00:15:48.000
with it successfully. Great!
Alright so second thing here is
what I call human context. Um

00:15:53.625-->00:15:59.125
human context is is to look, to
look like a human when you come
to do eh eh some action for

00:15:59.125-->00:16:04.125
example you don't sign up to wix
or any other service before you
pass through the sign up form

00:16:07.583-->00:16:14.167
right? I mean, eh eh eh a bot
that sends, sends like the
request sim-s-s-s-straight to

00:16:14.167-->00:16:19.167
the server is not a good bot.
Now in here we have the ability
in our bot to enter inside the

00:16:22.250-->00:16:28.250
context of the user because
chrome extensions has the
ability to inject javascript

00:16:28.250-->00:16:35.167
code into active user tabs. So
if I'm search-s-s-surfing
facebook the extension can

00:16:35.167-->00:16:41.792
inject javascript code into
facebook that will send the
facebook messages from within

00:16:41.792-->00:16:46.792
the facebook window and this way
eh eh eh it has a lot of powers
in mimicking the eh the regular

00:16:50.083-->00:16:55.083
the the human behavior. This
makes browser extensions the
perfect bot. It can run in the

00:16:59.167-->00:17:05.792
context of a user and
javascript. To understand the
full capabilities of such

00:17:05.792-->00:17:10.667
extension let's have a look at
the manifest file of the
extension, the malicious

00:17:10.667-->00:17:16.208
extensions we just saw attacking
wix. So this is the manifest
file of this extension you can

00:17:16.208-->00:17:21.208
see in the red frame eh eh that
the uhhh the name of the
extension Viad30 it's name

00:17:23.542-->00:17:28.333
already of extension that was
already exists in the webstore I
guess the attackers understood

00:17:28.333-->00:17:34.583
that this way eh they can easily
bypass the google screening
process to google webstore. Now

00:17:34.583-->00:17:40.708
what we see here under the
permissions section is this is
the most important eh eh eh

00:17:40.708-->00:17:45.708
permission of this extension, it
allows the extension to run a
cross-origin eh request to any

00:17:48.208-->00:17:54.417
eh to any destination it wants
it also gives that extension the
ability to inject javascript

00:17:54.417-->00:17:59.417
code into all the tabs. What
else? So we can also snatch the
eh eh the us-the-victim's

00:18:01.500-->00:18:08.250
cookies eh this by the way
includes http only cookies. And
what else we see here there's a

00:18:08.250-->00:18:13.250
background script now tha-thats
background script runs all the
time in the background um it

00:18:15.458-->00:18:20.875
doesn't matter where what that
you work on and let's have a
look at the background script of

00:18:20.875-->00:18:25.875
this extension. This is actually
the command and control system
of this extension. Why? Let's

00:18:29.750-->00:18:34.750
see what it does. First, it adds
a listener eh to to any tab that
is updated. Any tab that is

00:18:37.750-->00:18:42.750
updated runs this code. It goes
to eh the attacker's server
download a file called data js.

00:18:45.500-->00:18:50.500
This file eh includes the
commands for the bot. Then it
takes this eh the the the eh it

00:18:53.500-->00:18:58.500
takes data js and executed using
tabs execute script on the tab
that was updated. Now this is

00:19:00.583-->00:19:06.833
very important because it allows
the attacker full flexibility
with his bots. His bot is not

00:19:06.833-->00:19:12.333
static it it does not have
static logic, I mean, it's not
doing the same all the time.

00:19:12.333-->00:19:17.417
Every time the attacker want to
change the behavior of the bot
he's able to do it. For example,

00:19:17.417-->00:19:22.625
after in the wix attack after we
no we noticed that we that we
that there website that are

00:19:22.625-->00:19:29.292
published only 10 seconds after
sign up event. We started
unpublish eh eh websites that

00:19:29.292-->00:19:35.667
were were that that were eh eh
eh um that that had this
behavior eh um and it stopped

00:19:35.667-->00:19:42.542
the attack for about a half and
hour and after half an hour the
attacker using that changed the

00:19:42.542-->00:19:47.542
the logic of the bot and from
this from this point bots use
randomized time out between sign

00:19:49.792-->00:19:54.792
up event and the site publish.
Also I can I can create eh eh eh
a script which is tailored for

00:20:02.000-->00:20:08.458
each active tab so if I'm if I'm
on facebook I can send commands
that send facebook messages if

00:20:08.458-->00:20:13.458
I'm on google drive I can set
commands that upload files to
google drive. Great, so we know

00:20:15.833-->00:20:21.667
that that we now know that eh eh
ehmm extension, browser
extensions are very powerful

00:20:21.667-->00:20:28.333
tools for bot masters. But this
campaigns that you just saw are
very complicated and I want to

00:20:28.333-->00:20:33.333
ask you guys how can we make it
easier? Um because smuggling an
extension to google webstore and

00:20:37.542-->00:20:42.542
convincing a victims to install
this extension or running EXE or
JSE files or EXE on the on on on

00:20:45.208-->00:20:50.208
on victim's devices is very hard
and demands of course a lot of
effort. I wanna s-s think for a

00:20:52.333-->00:20:59.000
second how we make, how can we
make it easier. So the thing
here is that in order to get the

00:20:59.000-->00:21:04.000
abilities of a an extension we
only have to have the ability to
run ex-execute javascript in the

00:21:07.125-->00:21:12.125
context of the extension. Um and
for this we can go to the same
old [inaudible] that we all know

00:21:15.083-->00:21:20.083
and love. XSS. Um now XSS an
extension is not a good is not
new thing. I mean guys have

00:21:24.625-->00:21:30.792
shown it in Black Hat in 2012 um
but I want to share with you
today first I need to show you

00:21:30.792-->00:21:34.833
that that there still extensions
that are still vulnerable
secondly to show you, to share

00:21:34.833-->00:21:39.833
with you the idea of using these
vulnerabilities in order to form
a botnet. Um the first example

00:21:44.667-->00:21:49.667
is the adobe ac eh eh ac adobe
acrobat extension XSS. Um it
allows eh users to convert any

00:21:52.292-->00:21:57.292
page any webpage to a PDF file.
Now in general 2016 well it had
30 million installations, that's

00:22:01.042-->00:22:08.000
a crazy number, um 6 days eh eh
what they did is is they
automatically installed their

00:22:08.000-->00:22:14.708
extensions on all devices that
had a adobe acrobat installed on
them. And only 6 days after this

00:22:14.708-->00:22:21.250
eh eh google project zero
researcher Tavis Ormandy found
an XSS ability in this

00:22:21.250-->00:22:27.958
extension. Um this is the bot
and inside this bot you can see
the POC of the exploitation

00:22:27.958-->00:22:32.958
code. And what we see here uh is
basically that there is page
called frame dot html that if we

00:22:36.292-->00:22:42.917
send to it's payload in a
[inaudible] you will execute it.
And this is how it looks from

00:22:42.917-->00:22:47.792
the frame side eh it's pretty
pretty straight forward it
actually says here's our

00:22:47.792-->00:22:52.667
paylo-payload and it creates a
message that goes to eh your
status and then from there eh it

00:22:52.667-->00:22:57.667
adds html to the title of the
page. The problem here is it's
too easy it's that easy that

00:22:59.750-->00:23:04.750
actually [inaudible] eh blocks
it because it's an inline
script. Now a word about CSP, eh

00:23:12.125-->00:23:18.750
in 2013 google eh enforced CSP
cont default cont-content
security policy on all

00:23:18.750-->00:23:23.333
extensions this was a very
important move move because it
saved us from a horror scenario

00:23:23.333-->00:23:29.500
of excess extensions and what it
does it prevents common
JavaScript injection injections

00:23:29.500-->00:23:36.208
like inline scripts eval
functions and you can only load
scripts for whitelist uh source

00:23:36.208-->00:23:41.208
sources or at least it sources.
So the problem he-here is that
CSP is a generic policy and

00:23:45.500-->00:23:51.917
developers that tend to to be
very creative in the way that
they create XSS in their

00:23:51.917-->00:23:56.917
software. And let's see another
example so I wanna show you the
AVG web tuneup extension eh it

00:23:59.083-->00:24:05.625
aims to protect users when
surfing the internet when in
fact it has eh XSS and actually

00:24:05.625-->00:24:11.833
allows hacking this user allowed
eh this extension is is eh is
patched and um when I'm going to

00:24:11.833-->00:24:17.458
talk about the vulnerable
version of it. Um the same guy
Tavis Ormandy from eh google

00:24:17.458-->00:24:22.458
project zero eh found XSS in it
and in this case CSP fails and I
wanna show you how or I wanna

00:24:25.167-->00:24:30.167
show you why. Um uh uh uh I'll
show a demo in which uh there's
an attack page. Now we look,

00:24:36.417-->00:24:41.417
there is a victim that comes to
this attack page and open it and
this victim runs the AVG uh

00:24:43.875-->00:24:48.875
extension on his browser um and
this is why you see the
extension there uh listening on

00:24:51.833-->00:24:57.333
the attack page. That the the
extension injects javascript
into that attack page into any

00:24:57.333-->00:25:04.042
page including our attack page
that adds a listener to uh
window messages. Now our attack

00:25:04.042-->00:25:10.958
page with which we will see in a
second sends us us use window
postmessage to send req-to send

00:25:10.958-->00:25:17.375
a message to the extension, to
the, in the same page. The
extension in turn transfer our

00:25:17.375-->00:25:22.375
payload, sorry yeah this is the
payload, uh the post message and
the the chrome run script in the

00:25:25.375-->00:25:30.917
attack page eh eh forward the
our payload using chrome runtime
sendmessage to it's bad chrome

00:25:30.917-->00:25:34.500
script to it's bad chrome
script, the bad chrome script of
the extension has access to

00:25:34.500-->00:25:39.500
chrome API and particularly to
the chrome's tab, chrome tabs eh
eh API and using the update

00:25:43.250-->00:25:48.250
function eh we can eh update any
tab with any URL that we choose
in the original message that you

00:25:52.625-->00:25:57.625
sent from the attack page. In
our case we will use, we will
use beef in order to hook just

00:26:01.042-->00:26:06.042
any tab off the off the user and
for example face-facebook tab um
yes. With the hook. So - just a

00:26:23.083-->00:26:28.083
second, one second. Let's show a
little demo. [pause] One second.
Okay I will show it here. Okay,

00:26:58.750-->00:27:03.750
I'll try to do it this way. Will
be hard but I will try. [pause]
Okay. What we see here is that

00:27:19.458-->00:27:24.458
the attack page. I'm going to
turn on, this is BeEF common
command system. You can see that

00:27:27.417-->00:27:32.917
there's nothing here, there are
no bots right now. I'm going to
turn on eh the AVG extension I

00:27:32.917-->00:27:37.917
do with much caution 'cause it's
vulnerable, it's the vulnerable
version of this extension. And

00:27:41.458-->00:27:46.458
here's a black hat wh-what we're
going to see is the attack on
black hat page. Um I'm going to

00:27:50.250-->00:27:55.250
refresh it to show you that
there is nothing here. Now, I'm
going to run the attack page, my

00:28:00.750-->00:28:05.750
exploitation page. And you can
see that the black hat page has
uh uh there's an alert and you

00:28:10.625-->00:28:15.625
can see that we have a new hook
eh on this tab. And you see here
that that that the BeEF dot js

00:28:19.583-->00:28:24.583
file is downloaded from the
attacker server. If I click ok I
can see here that the BeEF agent

00:28:29.917-->00:28:34.917
started to communicate with the
CNC machine and here and here we
got the eh the BeEF bot on black

00:28:43.625-->00:28:48.625
hat dot com. [applause] So to
sum up, we saw how we can hack
extensions and run in the

00:28:59.542-->00:29:04.542
context of these extensions. And
as I said before my final goal
is create is use this

00:29:06.667-->00:29:11.417
vulnerability excess
vulnerabilities in order to
create a bot net and this is how

00:29:11.417-->00:29:16.417
we can do it. Eh eh once we have
the first victim, that installed
our bot, using BeEF for example.

00:29:19.000-->00:29:24.292
You can use, you can use him eh
we can create an attack page
attack page URL of the attack

00:29:24.292-->00:29:30.292
page and send this URL eh using
facebook messages or other
social means to all the

00:29:30.292-->00:29:37.167
f-friends on facebook of the
victims. If they the extension
installed a vulnerable extension

00:29:37.167-->00:29:43.333
we will hack them in the same
way using our attack page and
install BeEF on them. If they

00:29:43.333-->00:29:48.958
don't have the victim the
friends of the victim does not
have the extension we can always

00:29:48.958-->00:29:53.958
refer them to google web store
to download this great great
antivirus tool and then hack it

00:29:58.500-->00:30:03.500
in the same way using our attack
page. XSS. Summing up um this is
what we saw so browser

00:30:14.375-->00:30:19.375
extensions make great bots, we
saw why. Um we also saw that uh
as we speak there are, there are

00:30:22.292-->00:30:28.833
attackers that use chrome
extensions in order to uh to
c-to create and control their

00:30:28.833-->00:30:33.833
botnets. Eh we also saw that
extensions still got XSS's and
CSP is not enough in our case

00:30:36.333-->00:30:41.833
because there are many ways to
create XSS. And the same
infection campaigns that we saw

00:30:41.833-->00:30:46.833
in the wix and facebook attack
can be achieved using eh by by
exploiting chrome extensions XSS

00:30:49.125-->00:30:54.125
vulnerabilities. If you have any
questions about this topic just
approach me or you can catch me

00:30:57.083-->00:30:59.083
in this email. Thank you so
much! [Applause]