Cyberhaven Chrome Extension — a Gift for Hackers?

Last week, a cyberattack on the Cyberhaven Chrome extension has raised questions about the security of browser extensions and the risk that hackers could take advantage of them.

Table of Contents

The Attack

On Dec. 24, a cybersecurity attack on Cyberhaven led to the compromise of an employee’s account with access to the Google Chrome Web Store. This enabled them to release a malicious version of the Cyberhaven Chrome extension. The malicious code was active for around 25 hours and may have exfiltrated sensitive data from the affected users.

Impact and Scope

Although the attack was rapidly mitigated, it shows the vulnerability of browser extensions to malicious actors. Chrome extensions — which are supposed to supercharge your browser — need a lot of permissions to do their job. Attackers can use this access to steal sensitive information, including cookies, passwords, and browsing history.

A Wider Threat

The Cyberhaven attack was part of a broader campaign that targeted developers of Chrome extensions. Other extensions were compromised as well, putting potentially hundreds of thousands of users at risk of data and credential theft. This is a well-planned attack that demonstrates the rising threat malicious actors pose when targeting browser extensions.

Mitigating the Risk

Users are advised to take the following precautions to protect themselves from similar attacks.

Update extensions: Make sure your Chrome extensions are up to date by regularly updating them to the latest versions available to patch any security vulnerabilities.
Check the permissions: Be sure to read the permissions each extension requests during installation. Do not add extensions that ask for unnecessary permissions.
Avoid installing low-quality extensions: Install extensions only from reputable sites, such as the official Chrome Web Store.
2-Step verification: Make use of 2-Step Verification to keep your Google account secure from unauthorized access.
Be careful of phishing: You might receive phishing emails and other social engineering attacks in order to gain access to your accounts.

Current State of Web Browser Extension Security

The Cyberhaven attack should be a wake-up call for both developers and users. Browser extensions are very useful, however they are a very huge security vulnerability if not properly secured. With the increasing use of browser extensions, it’s imperative to have strong security measures in place to anticipate and defend against a malicious attack.