Well, in many cases, that oversight either falls short or is non-existent. Google Play alone has been host to a number of malware-tainted apps, for example. But this latest instance of an app store offering shady programs is making security researchers nervous. A number of popular Google Chrome extensions were found to be harvesting user data without consent. This includes credit card information, GPS locations, and even tax returns! Worse yet, this harvested data was compiled and made available online for anyone willing to pay for it! If you make use of extensions on Chrome or Firefox, you’ll want to make sure that your browser wasn’t affected by this catastrophic data breach. We have the list of affected extensions, as well as how you can secure your system going forward.
DataSpii leak contains an untold number of people and businesses’ private information
In a recently published report, security researcher Sam Jadali discussed the presence of a number of data-harvesting extensions available on the Chrome and Firefox app stores — an incident he and other researchers have dubbed “DataSpii.” These extensions, once installed, covertly track your browsing and spending habits while compiling the data to be sold online. These extensions all report back to a website called Nacho Analytics, which advertises its services through its tagline “See Anyone’s Analytics Account.” The most serious aspect of the data breach, though, is just how many people were affected by it. Based on install rates of the affected extensions, more than two million users had their data harvested — with more potentially unaware that their browser is snitching on them. The issue is restricted to a specific group of extensions, which Jadali outlined in his report. If you have ever used the following extensions, your data might be up for sale on the internet somewhere: Hover Zoom SpeakIt! SuperZoom SaveFrom.net Helper FairShare Unlock PanelMeasurement Branded Surveys Panel Community Surveys
What are Google and Mozilla doing to stop the spyware? How can I remove it?
Thankfully, Google and Mozilla both identified and removed the affected extensions to prevent them from spreading any further. Additionally, the two companies disabled the extensions in existing users’ browsers and outright removed the ones that could be uninstalled remotely. Google claims that it will be changing the way extensions work to stop situations like this from occurring in the future, while Mozilla has announced that it will be publishing a list of “vetted apps” that will have been tested for safety and privacy. If you want to make sure there are no rogue extensions attached to your browser, simply open a new window and copy/paste the following URLs in the address bar: For Chrome: chrome://extensions For Firefox: about:addons Once you’re on the extensions page for your respective browser, simply look for any of the affected extensions and click the button that says “remove” next to it. This will manually uninstall the extension. Regardless of whether Google or Mozilla disabled them, it’s still worth checking to make sure all traces of them are removed from your system. While it’s notable that Google and Mozilla have paid attention to the reveal of this breach, it’s still frustrating just how many shady apps get a pass on Google Play and other app stores. The people of the internet are expecting better accountability from the companies we trust our data to, and sadly, we haven’t really seen it up to this point. But as hackers and cybercriminals develop more sophisticated schemes, the big names of the tech industry will have to adapt or be left behind. Privacy is the way forward — let’s hope Google and Mozilla are game.
