There is more criticism for Google yet again and this time it relates to how the company has been failing at spotting fake Chrome extensions, that together have also impersonated many popular brands in Chrome Web Store for quite a long time now.
The preys who have fallen into such a scam are AdBlock by AdBlock Inc (which sounds easy to confuse it with legitimate extension AdBlock by getadblock) and uBlock by Charlie Lee (pretty much similar to uBlock.org’s uBlock or Raymond Hill’s uBlock Origin).
Some of these may look like proper Ad blockers but there is a lot more to it as revealed by rival ad blocker maker, AdGuard, whose Andrey Meshkov made the final confirmation about the impersonation in a blog post, right after going through the fake software’s behavior in detail.
As per what Meshvok claims, such ad blockers do block ads considering the fact that they are based on the same code as of AdBlock, but the black magi happens right after 55 hours of installation when they start doing ‘cookie stuffing’.
Now this is where cookie stuffing come into play as cyber criminals drop floods of cookies onto a computer just to fool the companies into creating an impression that users clicked the affiliate ad. However, in reality the user doesn’t even know about the brand.
The fraudsters do know that sales are always comparatively less than number of visitors therefore they do cookie stuffing to as many computers as possible.
An in-depth analysis by Meshvok also showed that the two add-ons together have 1.6 million weekly active users, who are actually stuffed with cookies of 300 websites from Alexa Top 1000 and yes if we measure the damage, then it has become a matter of millions of USD monthly.
Google has been ignorant about picking out fake extensions which can also be seen easily and if they do take it out, the company still doesn’t have any answer related to how to get over the issue. In fact, in Meshvok’s case too, Google took the rogue extension down only after the news about it went public with blog post.
That being said, there is also a lot more to the situation as identifying legitimate software becomes difficult especially when the fake ones are so brilliantly branded along with thousands or millions of downloads. So, it doesn’t matter even if Google promises to be working hard on the removal of such extensions, in the end effective extension detectives are still researchers, security companies and the users themselves, which Google acknowledged on the occasion of expanding its Developer Data Protection Reward Program (DDPRP) and Google Play Security Reward Program (GPSRP).
The solution to this has to be related to picking out malicious or fake programs right before things get worse and for that to happen who knows creating a system to allow users to report about suspect extensions might help.
Read next: Using Google Calendar Might Put Your Privacy At Risk
The preys who have fallen into such a scam are AdBlock by AdBlock Inc (which sounds easy to confuse it with legitimate extension AdBlock by getadblock) and uBlock by Charlie Lee (pretty much similar to uBlock.org’s uBlock or Raymond Hill’s uBlock Origin).
Some of these may look like proper Ad blockers but there is a lot more to it as revealed by rival ad blocker maker, AdGuard, whose Andrey Meshkov made the final confirmation about the impersonation in a blog post, right after going through the fake software’s behavior in detail.
As per what Meshvok claims, such ad blockers do block ads considering the fact that they are based on the same code as of AdBlock, but the black magi happens right after 55 hours of installation when they start doing ‘cookie stuffing’.
What is Cookie Stuffing?
To explain this in a better way, let’s take the example of an eCommerce website that check cookies to know how users ended up at their home page and eventually buying the product. Companies also pay a fee to affiliate responsible when the purchase gets done.Now this is where cookie stuffing come into play as cyber criminals drop floods of cookies onto a computer just to fool the companies into creating an impression that users clicked the affiliate ad. However, in reality the user doesn’t even know about the brand.
- Also read: Now Android and Web Users will get their queries answered right in the address bar on Google Chrome
The fraudsters do know that sales are always comparatively less than number of visitors therefore they do cookie stuffing to as many computers as possible.
An in-depth analysis by Meshvok also showed that the two add-ons together have 1.6 million weekly active users, who are actually stuffed with cookies of 300 websites from Alexa Top 1000 and yes if we measure the damage, then it has become a matter of millions of USD monthly.
And What About The Extension Confusion?
Such add-ons are not only dangerous for the user’s system, but they also convince brands to pay for bogus clicks along with hijacking the brands of legitimate extension makers. So, fraudsters get a lot from every side.Google has been ignorant about picking out fake extensions which can also be seen easily and if they do take it out, the company still doesn’t have any answer related to how to get over the issue. In fact, in Meshvok’s case too, Google took the rogue extension down only after the news about it went public with blog post.
That being said, there is also a lot more to the situation as identifying legitimate software becomes difficult especially when the fake ones are so brilliantly branded along with thousands or millions of downloads. So, it doesn’t matter even if Google promises to be working hard on the removal of such extensions, in the end effective extension detectives are still researchers, security companies and the users themselves, which Google acknowledged on the occasion of expanding its Developer Data Protection Reward Program (DDPRP) and Google Play Security Reward Program (GPSRP).
The solution to this has to be related to picking out malicious or fake programs right before things get worse and for that to happen who knows creating a system to allow users to report about suspect extensions might help.
Read next: Using Google Calendar Might Put Your Privacy At Risk
