#Raymond hill ublock update
#Raymond hill ublock code

In fact, the list of websites is unknown at this time as it was remotely configured.

#Raymond hill ublock update

Remotely configurable means that there was no need to update the extensions to modify the list of websites whose data would be stolen. The gist is that the Nano extensions were updated to surreptitiously upload your browsing data in a remotely configurable way. Other users reported that sites other than Instagram were also being accessed and tampered with, in some cases, even when the user hadn’t accessed the site, but these claims couldn’t immediately be verified.Īlexei, an Electronic Frontier Foundation senior staff technologist who works on the Privacy Badger extension, has been following the discussions and provided me with the following synopsis: “I am not a malware expert so I can't come up with *all* that is possible when having real-time access to request headers, but I do get that it's really bad.”

#Raymond hill ublock code

“Since the added code was able to collect request headers in real-time (through websocket connection I guess), this means sensitive information such as session cookies could be leaked,” he wrote in a message. Hill said he reviewed some of the added code and found that it was uploading data. This has led to speculation that the updated extensions are accessing authentication cookies and using them to gain access to the user accounts. Many Nano extension users in this forum reported that their infected browsers were also accessing user accounts that weren’t already open in their browsers. User Agent Switcher, an extension that had more than 100,000 active users until Google removed it earlier this month is reported to have done the same thing. Nano Adblocker and Nano Defender aren’t the only extensions that have been reported to tamper with Instagram accounts. The screenshot to the right shows some of the photos involved. Cyril Gorlla, an artificial intelligence and machine learning researcher at the University of California in San Diego, told me that his browser liked more than 200 images from an Instagram account that didn’t follow anyone. The most obvious change end users noticed was that infected browsers were automatically issuing likes for large numbers of Instagram posts, with no input from users. “In simple words, the extension remotely checks whether you are using the extension dev tools-which is what you would do if you wanted to find out what the extension is doing,” he wrote.

If it was opened, the extension sent a file titled 'report' to a server at. The first thing Hill noticed the new extension doing was checking if the user had opened the developer console. Xu told me that Nano Adblocker and Nano Defender, which often are installed together, have about 300,000 installations total.įour days ago, Raymond Hill, maker of the uBlock Origin extension upon which Nano Adblocker is based, revealed that the new developers had rolled out updates that added malicious code. Cyril GorllaHugo Xu, developer of the Nano Adblocker and Nano Defender extensions, said 17 days ago that he no longer had the time to maintain the project and had sold the rights to the versions available in Google’s Chrome Web Store.