The Add to Feedly Extension Sold to an Adware Operator

What happened

The author sold the extension, and the buyer used a store update to add hidden ads. Amit Agarwal, who wrote the extension, says on Labnol that he made it in about one hour. An unknown buyer contacted him by email and paid a four-figure sum through PayPal. He could not verify who the buyer was. InfoWorld reports that the sale took place in late 2013.

The update added advertising. Labnol quotes it as inserting adware into all web pages. The Register describes invisible ads that work in the background and turn links on every site into affiliate links. Users could opt out, but that was not the default. Labnol says the update targeted superfish.com domains. Extension ratings dropped in the Chrome store. After media coverage, Google removed the extension from the store.

The same group of articles covers a second extension, Tweet This Page. InfoWorld reports it sold for 500 US dollars at the end of November 2013 and was also turned into adware. The Register adds that Google tightened its store terms in December 2013 and had warned developers in October 2013. Read Labnol, The Register and InfoWorld.

This case needs no stolen password. The store account changed hands, and the update came from the new owner. The extension gained code that runs against every page it sees. For a case with a stolen developer login, see Web Developer for Chrome.

Affected versions

The sources do not name an extension version. The affected product is the Add to Feedly extension for Chrome, with more than 30,000 users at the time of the sale. The bad update was live in January 2014, and Google removed the extension that month after the story spread.

How to check

Check whether the extension is still installed. List the names of extensions in your Chrome profile. This command works on macOS.

grep -H '"name"' ~/Library/Application\ Support/Google/Chrome/Default/Extensions/*/*/manifest.json

On Linux, use ~/.config/google-chrome/Default/Extensions. You can also open chrome://extensions and look for Add to Feedly. Some names show as message keys. If a name is not clear, open the extension page for details. The sources list no file indicators for this attack.

What to do now

1. Remove Add to Feedly from Chrome if it is still installed.
2. Use the Feedly bookmarklet, as the author recommends on Labnol.
3. Check the other extensions you use. Remove those you do not need.
4. If you own an extension, do not sell it to a buyer you cannot verify. Users cannot see the change of owner.
5. Review the permissions of each extension before you accept an update.

What Vigilance showed

Vigilance compares the version you trust with the new one and names the file that gained a new capability. The block below is rebuilt from the public reports in the words Vigilance prints. It is not a captured scan, because the malicious release is not redistributed.

files scanned: 31 (1 Added)

HEADS UP  1 file can now do things the old version could not. The rest changed and gained nothing.

NEW FILE   background.js
           It downloads from the internet.

Sources

1. labnol.org/internet/sold-chrome-extension/28377
2. theregister.com/2014/01/20/google_pulls_chrome_extensions_after_new_owners_subvert_web_tools/
3. infoworld.com/article/2609731/spammers-buy-google-chrome-extensions-and-turn-them-into-adware.html