The Objective: Use Wix as a distributor to form a botnet
5
This Magical Bot...
6
What Makes A Good Bot
7
What An Extension Can Do
8
Command & Control
9
Too Much Work...
10
How Can We Make It Easier?
11
Adobe Acrobat extension XSS
12
Nothing New Here...
13
Content Security Policy
14
AVG Web Tuneup extension XSS
Description:
Explore a Black Hat conference talk detailing a massive botnet attack orchestrated through malicious Chrome extensions. Delve into the investigation of attack patterns, extension capabilities, and the attackers' objectives in using Wix as a distribution platform. Examine the characteristics of effective bots, command and control structures, and methods to streamline attacks. Analyze specific case studies, including Adobe Acrobat and AVG Web Tuneup extension vulnerabilities, and discuss the role of Content Security Policy in mitigating such threats. Gain insights into the evolving landscape of web-based attacks and defense strategies in this 46-minute presentation by Tomer Cohen.
Game of Chromes - Owning the Web with Zombie Chrome Extensions