The Great Suspender Chrome Extension Takeover

What happened

A new owner took over The Great Suspender and then published an update that tracked users and executed remote code. BleepingComputer reports that the original developer sold the extension to an unknown party in June 2020. Versions 7.1.8 and 7.1.9 came through the Chrome Web Store with no public release notes.

The GitHub issue 1263 describes code in 7.1.8 that ran scripts from owebanalytics.com. According to that report, the code intercepts requests, adds ad fraud, tracks activity across sites, and sets cookies that normal analytics do not use. A contributor noted the removed script was not Open Web Analytics, but another application posing as it.

Microsoft removed the extension from the Edge store in November 2020. Version 7.1.9 removed the malicious scripts, but the same maintainer stayed in control. The Register notes that researchers suspected an acquire-and-subvert approach. Google then removed the extension from Chrome on 4 to 5 February 2021 with the message that it contains malware.

No public analysis in these sources names the exact file that changed in 7.1.8. The evidence for the diff is weaker than in other cases on this site.

Affected versions

• The Great Suspender 7.1.8 (malicious, remote code and tracking)
• The Great Suspender 7.1.9 (scripts removed, but under the same new maintainer)
• The Great Suspender 7.1.6 and earlier (published under the original developer)

Indicators of compromise

• Requests to owebanalytics.com from the extension.
• Open Web Analytics-style tracking code in an extension that has no analytics purpose.
• A version of 7.1.8 or 7.1.9 in the extension manifest.

How to check

Chrome removed the extension from most browsers, but a copy can remain in a profile folder or a managed browser. Search the extension files for the domain. This command works on macOS. On Linux, use ~/.config/google-chrome.

grep -rl 'owebanalytics' ~/Library/Application\ Support/Google/Chrome/*/Extensions/ 2>/dev/null

You can also open chrome://extensions and look for The Great Suspender and its version.

What to do now

1. Unsuspend all tabs before you remove the extension, so that you can recover their pages. You can also find the suspended URLs in Chrome History.
2. Remove the extension.
3. Change passwords for important accounts and turn on two-factor authentication.
4. If you want the same function, use a maintained tab suspender. Sources mention building 7.1.6 from GitHub in developer mode, or a fork such as The Marvellous Suspender.
5. Check ownership and permission changes before you update any extension.

What Vigilance showed

Vigilance compares the version you trust with the new one and names the file that gained a new capability. The block below is rebuilt from the public reports in the words Vigilance prints. It is not a captured scan, because the malicious release is not redistributed.

files scanned: 33

HEADS UP  1 file can now do things the old version could not. The rest changed and gained nothing.

CHANGED    background.js
           It now downloads from the internet. It did not before.

Sources

1. github.com/greatsuspender/thegreatsuspender/issues/1263
2. theregister.com/2021/01/07/great_suspender_malware/
3. bleepingcomputer.com/news/security/the-great-suspender-chrome-extensions-fall-from-grace/