Beware Phishing in Chrome Web Store.

[David]

I just wanted to alert people to a more sophisticated phishing email than usual that we got that stated a Chrome Extension policy violation of the form:

"Unnecessary details in the description"

The link in this email looks like the webstore but goes to a phishing website that will try to take control of your chrome extension and likely update it with malware.

Hopefully if anyone googles this violation message they will come here and see this message and not give access!

[Dev]

Thank God David, you saved us. I have updated many things in my extension and i was going to submit it for review.

I received email from below email id with exact format of chrome store. Can someone please confirm, if this is spam only?

Web Store Chrome <chromewebst...@forextensions.com>

[David]

Hi Dev

Yes that is the email we got and were likewise confused.  The domain forextensions.com is not an official one for the chrome webstore.  It is definitely spam.   The button on it links to an app called "Policy Chrome Extension" that wants permissions to access your chrome developer account.

Make sure you haven't given access to an app called "Policy Chrome Extension" on your google account security settings (Google Account > Security > Your connections to third-party apps & services)

Thanks

David

[Aidan Nulman]

Thanks as well from our team at jam.dev! A colleague received this one and it threw a bunch of us for a loop :)

[hrg...@gmail.com]

I cannot find any app or extension called "Policy Chrome Extension".

Could you please provide a link so we can see what the app is doing?

Many thanks.

[newdev]

I received an email from forextensions.com and almost got scammed because the sender's address was hidden by Outlook when I first checked the email on my phone.

I tried creating a temporary account to test it.

Once you notice any issues, you can remove the "Privacy Policy Extension" permissions at https://myaccount.google.com/connections.

[Juraj M.]

Mine went to spam because the sender could not be verified, but I have to say, pretty good looking phishing!

Especially since the rejection reason looks so familiar, it's like I've seen it already multiple time for multiple of my extension! (because I did!)

But the "Go To Policy" link is still a dead giveaway - there is no way google would use some "checkpolicy.site" domain.

[John Tuckner]

Would someone mind sharing the 'client_id' from the OAuth consent page?

[Cameron Eckelberry]

Is there a way we can limit these malicious Chrome apps from gaining access to our web store accounts?
Can any member be affected by it? Or only admins?

[Patrick Kettner]

To be clear, the apps are disabled as soon as they are discovered. Extensions that were impacted have already been contacted. 

What happened here is that developers were tricked into granting oauth permission to the chrome web store api. As a domain admin, you can take some steps to limit the impact from something like this through the Google Admin console. I am by no means an gapps expert, but some things you can do to lock this down

1. Make sure your team is aware of the ongoing attack, and to not grant oauth usage to apps unless absolutely certain they are needed (the Chrome Web Store team will not be asking someone to grant us access to their account by our own API)

2. Review the currently granted apps to ensure nothing malicious exists - https://admin.google.com/ac/appslist/additional

3. Use the OAuth Token Audit logs to check if any access has been granted to the chromewebstore scope - https://admin.google.com/ac/sc/investigation?ref=reporting

4. Set up a new custom alert rule that listens to access being granted to the chromewebstore scope - https://admin.google.com/ac/ax

5. If it makes sense for your team, configure your domain to use trusted apps only - In App Access Control, enable Trust Internal or Domain-Listed Apps Only.

patrick

--
You received this message because you are subscribed to the Google Groups "Chromium Extensions" group.
To unsubscribe from this group and stop receiving emails from it, send an email to chromium-extens...@chromium.org.
To view this discussion visit https://groups.google.com/a/chromium.org/d/msgid/chromium-extensions/a4543497-c8d0-4f5c-8505-9e564b6b4268n%40chromium.org.

[Cameron Eckelberry]

Appreciate the suggestions, thanks Patrick!

[ghucz...@gmail.com]

Hi Patrick

Re your excellent suggestion of "set up a new custom alert rule that listens to access being granted to the chromewebstore scope - https://admin.google.com/ac/ax".

Could you please give some guidance?

There seems no option to filter by scope in the Rule Tool at: https://admin.google.com/ac/ax

However, the scope filter option does exist in the Audit and Investigation tool (but not useful as can't alert) at: https://admin.google.com/ac/sc/investigation

Screenshots of both tools attached.

Many thanks

Greg