Google Removes The Great Suspender Chrome Extension As It Contains Malware

A well-known chrome extension, known as The Great Suspender, which was utilized by millions and millions of people, was removed by Google from its Chrome Web Store on Thursday with the claim that it contains malware.

A notice from Google said that this extension contains malware, yet it has since arisen that the extension silently added functions that could be abused to execute arbitrary code from a remote server, including following clients on the web and performing frauds of advertisement.

Calum McConnell, in a Github post, said, “The old maintainer appears to have sold the extension to parties unknown, who have malicious intent to exploit the users of this extension in advertising fraud, tracking, and more. In v7.1.8 of the extension, arbitrary code was executed from a remote server, which appeared to be used to commit a variety of tracking and fraud actions.”

The extension had over two million installs before it was removed. The extension suspends tabs that aren’t being used, supplanting them with a clear dim screen until they were reloaded after getting back to the tabs being referred to.

Indications of the extension’s malicious behavior had been going the rounds since November 2020, driving Microsoft to impede the extension, v7.1.8, on the Edge browser around November.

Dean Oemcke, the extension’s unique engineer, is believed to have sold the extension in June 2020 to an anonymous individual, which resulted in two new forms of the extension being delivered straightforwardly to clients through the Chrome Web Store, v7.1.8 and v7.1.9.

Clients that utilized the extension can recuperate the tabs utilizing the details highlighted here, or as another option one can likewise utilize the most recent variant accessible on GitHub (v7.1.6) by turning on the Chrome Developer mode.

However, turning on the Developer mode can have different outcomes, as well, as uncovered by the security analyst Bojan Zdrnja, who revealed a novel strategy that lets bad actors misuse the Chrome sync service to sidestep firewalls and build up associations with servers controlled and managed by attackers/hackers for information exfiltration.

Zdrnja said that the enemy made a vindictive security extension that took on the appearance of Forcepoint Endpoint Chrome Extension for Windows, after which it was installed straightforwardly on the browser in the wake of turning on the Developer mode.

Zdrnja said, “While there are some limitations on the size of data and amount of requests, this is actually perfect for C&C commands (which are generally small), or for stealing small, but sensitive data such as authentication tokens.”

In any case, given that this assault requires actual physical access to the selected system, it is probably not going to be settled by Google.

If you like this article, follow us on Twitter, Facebook, Instagram, and LinkedIn.