Browser extension hijacks Facebook profiles

Is it hijacking legit extensions or is it an already malicious extension to begin with? If it's the later then Google Store needs to be tightened up a bit (or a lot ).

EDIT: I read it wrong. So now I'm wondering if the malicious extension is available on Google Store or installed from other websites.

 

Funny article... They mention a malicious extension targeting Chrome and Firefox, yet they fail to mention how it installs in the first place.

I'm not sure about Firefox (there's been sometime since I last tried it, and no longer recall if it warns the user about extensions trying to install), but Chromium/Chrome no longer allow installation of extensions outside of Chrome Web Store. So, either the user downloaded it from elsewhere and installed it, or the extension was in the Chrome Web Store and Google failed to prevent it. But, considering that Mozilla has a great extension vetting process, I believe the users had to download it elsewhere.

The article does mention a link: -hxxp://u-pont.info/updates/<removed>/BL-chromebrasil.crx/xpi (Chrome and Firefox extensions respectively).

Anyway, while something like this is always bad, it seems to me advertisement against Chrome and Firefox. But, hey...

 

There is a mystery that has not been solved to me until now. Does Chrome sandbox its extensions. That might be helpful for this kind of situation.

Which one, The Blue E, The Red O, or The Compass of a Fruit?

 

Dorkbot Malware Infects Facebook Users; Spies Browser Activities and Grabs Data:

http://www.hotforsecurity.com/blog/...s-browser-activities-and-grabs-data-6165.html

 

See also: Malware focusing on the social network's users in Brazil masquerades as a legitimate Google Chrome extension and Firefox add-on.
http://news.cnet.com/8301-1009_3-57...ns-of-new-trojan-hijacking-facebook-accounts/

 

See also: -
Facebook attacked with credential-harvesting malware

• http://www.cso.com.au/article/461848/facebook_attacked_credential-harvesting_malware/