The Great Suspender Extension Attack

What happened

In June 2020 the original developer sold the extension to an unknown entity, because he could not keep up with maintenance. BleepingComputer reports that the new owners released 7.1.8 in October 2020 with scripts that tracked user behavior and ran code from a remote server.

Version 7.1.8 went to the Chrome Web Store but not to GitHub, so the public source did not match. The GitHub issue reports that the extension loaded a script disguised as OpenWebAnalytics. Researchers said it intercepted requests, made extra advertising requests and used cookies. The script was heavily minified and obfuscated.

The script came from owebanalytics.com. According to the issue, that domain was created at the same time as the update, bought with Bitcoin, and held only tracking scripts.

The CNCF TAG Security catalog gives this timeline:

• 6 November 2020: a user found the malicious code
• 23 November 2020: Microsoft flagged the extension as malware
• Version 7.1.9 followed and removed the code
• 4 February 2021: the Chrome Web Store removed the extension, and Google disabled it

Affected versions

Version 7.1.8 is the malicious version, and it reached users through automatic store updates. Version 7.1.6 was the final release by the original developer and contains no malicious scripts, according to BleepingComputer.

• 7.1.6: clean, last release by the original owner
• 7.1.8: malicious, Chrome Web Store only
• 7.1.9: released after discovery, without the malicious code

The sources I fetched do not mention version 7.1.7.

Indicators of compromise

• Domain: owebanalytics.com
• Extension version 7.1.8 installed from the Chrome Web Store
• Extension source in the store that differs from the GitHub repository

How to check

Open chrome://extensions, turn on developer mode and read the version of The Great Suspender. You can also search the extension folder for the domain. This example is for Chrome on macOS.

grep -rl "owebanalytics" ~/Library/Application\ Support/Google/Chrome/*/Extensions

Also search DNS or proxy logs for owebanalytics.com.

What to do now

1. Remove The Great Suspender from every browser.
2. If you need your suspended tabs, use your browser history to find the URLs.
3. Block owebanalytics.com.
4. Treat the sites you used during the exposure as tracked. Change passwords for sensitive accounts.
5. Use a different tab suspender from a source you trust.

Vigilance compares the version you trust with a new one and reports the file that gained a new capability. See all attacks.

What Vigilance showed

Vigilance compares the version you trust with the new one and names the file that gained a new capability. The block below is rebuilt from the public reports in the words Vigilance prints. It is not a captured scan, because the malicious release is not redistributed.

files scanned: 22

HEADS UP  1 file can now do things the old version could not. The rest changed and gained nothing.

CHANGED    background.js
           It now downloads from the internet and runs other programs. It did not before.

Sources

1. github.com/greatsuspender/thegreatsuspender/issues/1263
2. tag-security.cncf.io/community/catalog/compromises/2020/thegreatsuspender/
3. bleepingcomputer.com/news/security/the-great-suspender-chrome-extensions-fall-from-grace/