Hello and welcome
to another application of
the minor attack framework
discussion today we're going
to be looking at browser extension.
So with that, let's go ahead and
jump on over to our objectives.
So the objectives for
today's discussion are as follows.
So we're going to describe what
browser extension is as far
as within the mind or attack
framework and how that's used.
How have browser extensions
been used?
What are some mitigation techniques?
And of course, we're going to round
out with some detection techniques
as well.
So let's go ahead and jump right in.
So browser extension, as
it is listed in the MicroTech
framework is involving
things like plug ins or programs
that can be added to or provide
function to in customization
of Internet browsers.
That's a great thing, right?
We love things that make our lives
easier, that make our lives more
convenient. Our password managers
are coupon cutters, whatever,
honey token things we're doing or
something of that nature.
But in this case,
that is not always a great thing.
Malicious extensions can
be installed through malicious
applications and downloads that
may seem legitimate through things
like social engineering or through
some phase of an already installed
malicious payload.
And so these extensions allow
three actors to do things like
website browsing in the background,
stealing information, a user inputs
into the browser command and control
purposes, and then
for the installation of other tools
such as Rantes or remote access
tools. And so there are a lot
of different things that browser
extensions can achieve.
I know that some of my
best experiences as far as helping
folks with our system issues,
just from personal stories that
I like to share with other folks, is
any time you have a user that's
complaining of slow system,
that's having problems and
they don't understand and it was
acting fine yesterday.
And so the first thing you do
is you start to investigate
as you open up a Web browser.
And lo and behold, a good quarter
of the top of that has
just all these different plug ins
and extensions and pieces.
And you kind of shake your head and
hang it low and
start doing some virus scanning and
some other questions and clean up
activity.
So browser extensions have been used
and have been around for quite some
time.
So let's talk real quick about
an application of that or looking at
a particular threat group.
So Gimzewski and
Google Chrome.
So information indicates
that the group has been active
since September of 2013.
So they've been around for a little
bit. A report released in December
of twenty eighteen indicated that
the group infected systems using
a Google Chrome extension
to steal passwords, cookie
information and of course, do
other things to those systems.
So several phishing campaigns
were essentially conducted using the
extension on the academic
sector with no information
on the victims provided at this
time. And so it's looking
like, based on some reading and
research, that a part
of the attack was motivated, of
course, by the research
the academics were doing in their
given fields, such as biomedical
engineering.
And so when we think about threat
groups, oftentimes they come
in different flavors and forms that
can be state funded criminal
organizations, but they're very
sophisticated.
And so it would make sense
that they may target research
and academia and things of that
nature because there could be
technologies or discoveries or
things that we're working on that
they could take advantage of.
And so, again,
as you'll note here, this keeps
coming up.
Phishing campaigns and things
of that nature continue to
be a savvy way for these
folks to get these extensions in
and to take advantage of that good
old user trust.
Now, let's talk about some
mitigation techniques with respect
to browser extensions and what's
going on there.
So set extension, white or black
list as appropriate for the
business security policy.
So, again, we
really want to make sure that
policies and procedures are in
place to allow us to effectively
implement controls and to enforce
those controls. If we're not
implementing controls based on
security policies are based on risk
management activities, then we
could really be shooting in the dark
and hoping that we're hitting the
mark.
Do not allow the installation of
software by standard user
accounts and practice leased
privilege again,
liste privileges coming back into
that. Make sure that you have to at
least maybe elevate your privilege
via command or a right
click or some type of prompt prior
to being able to install something
so that nothing can just run
out. Right without some type of
prompt or warning and then implement
regular end user awareness training
covering such attack methods again.
A lot of these things, especially
when we're involving
phishing attacks and things of that
nature training
and the human element
is going to be the last line of
defense when all other
technical components fail.
And so having that human element,
well-educated and strong, is going
to help us to mitigate these types
of risks. But.
I beg to ask a question
that maybe some of you caught
and maybe some of you were thinking
about, and I think this is a good
time to bring it up.
So in the previous
slide,
the attack was specific
to the academic sector.
And so we're dealing with
researchers and students
and people of that caliber in
nature.
So when I was a
student and I'm always a student,
it feels like I
used university
laptops or desktops
as they were available in a lab
setting, maybe.
But for the most part, I did
my research and my
paper writing and submissions
and email checking and all of those
things on my personal device.
So how.
Then do we start to
protect?
Academic information such as
a person's thesis or research
that could be
pertinent to bettering
our nation or whatever the case may
be, wherever you're at.
Right. Do we keep that research
in a cloud based system that is
protected and we don't keep an eye
on local systems, but then who
ultimately owns the research?
Is it the property of
the person doing the research?
The person that is is designing
that system or the person that is
doing that? Or since it's funded by
the college, does the college or
university have ultimate authority
and control over the information?
So as you can see, this
particular topic kind of led to
some very interesting questions
with respect to how we would handle
those mitigation techniques.
So keep that in mind as you design
security policies and procedures
depending on the industry in the
area that you're working, and that
may change the way in which you have
to approach these controls.
So let's talk about some detection
techniques real quick as well.
So you could audit Web browser
extensions to ensure that the ones
installed are for business purposes
only and that they are not
masquerading as legitimate ones.
We can use network monitoring tools
to look for communications with
command and control servers if we've
got a known blacklist of those,
and then we can monitor for
new files written do the registry a
portable execution files written
to the desk.
So all great things again that we
can do if we have the tools
in place that allow us to do so.
And the systems belong
to the organization in question,
because again, when we start to blur
the lines between personally
own devices versus
the property of an organization
or a university that can make these
controls in these detection
methodologies a little bit more
difficult to implement.
So with that in mind, let's go ahead
and do a quick check on learning.
True or false, browser extension
attacks are limited to Web browsers
like Google Chrome.
All right. Well, if you need some
additional time to
research or think about this
question, please pause the video.
So browser extension attacks are
limited to Web browsers like Google
Chrome? Well, the good
news is, is that they are not
limited to just Web browsers
like Google Chrome.
They can be any browser that
can install an extension
could be susceptible to these types
of attacks. And so in this case,
this is not a true statement.
It is a false statement.
Now, with that, let's go ahead
and jump over to our summary.
So today we looked at and
described browser extension
browser extensions, essentially
being applications, plug ins
customizations to the
Web browser and your overall
browsing experience.
We reviewed how browser extensions
have been used in ways in which
we can steal cookies or do things
of that nature, steal passwords,
still data or use maybe the browser
on the system without
the knowledge of the end user.
We reviewed some mitigation
techniques again, such as validating
those particular extensions
as far as that would be more
detection, sorry, with mitigation
techniques, it would be not allowing
the installation of maybe unsound
plug ins or maybe not allowing
installation at all without
administrative intervention
and then for detection techniques.
Looking for known bad browser
plug ins as well as maybe auditing
for command and control type
activity would be beneficial as
well. So with that in mind,
I want to thank you for your time
today and I look forward to seeing
you again soon.