77
Popular Twitch ad blocker caught sending live account credentials to Russian proxies News (socket.dev)
submitted 1 month ago by to c/privacy@lemmy.dbzer0.com
11 comments fedilink hide all child comments
 

cross-posted from: https://piefed.world/c/tech/p/1400813/popular-twitch-ad-blocker-caught-sending-live-account-credentials-to-russian-proxies

Threat Research Team identified a cross-store browser extension, “Twitch Enhanced Viewer | JeetBot,” that forwards each user’s live Twitch OAuth session token to proxy servers operated by a Russian commercial bot service. The extension ships on both the Chrome Web Store (extension ID pnhhdhhcadcjfckjhpmjneldiegbojfb, 30,000 users) and Firefox Add-ons (twitchenhancedviewer@example.com, 552 users). Both listings are live at time of writing.

you are viewing a single comment's thread
view the rest of the comments
[–] [S] 1 point 1 month ago (2 children)

After Google created v3 manifests, all chrome addons MUST be readable. It's simply JS, HTML, & JSON in a ZIP.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 1 month ago (1 child)

    I did not mention Google not having this measure (nor was I aware of it), I only stated what I knew. And this only proves my argument further anyway: Google has no reason not to catch it. (“it” being the malicious extension)
    There were no lies in my comment but you jumped the gun, accused me of lying and were rude about it too.

    Calling out misinformation is good, just please be politer.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] [S] 1 point 1 month ago

    Politeness is a ladder. The extension isn't still malicious: it does what it says. It just the tradeoff is getting your API credentials stolen. Calling twitchenhancedviewer “obfuscated” is pure disinformation, as we can both see both codes, Firefox's & Chrome’s.

  • permalink
  • fedilink
  • source
  • parent