Characterizing Cryptocurrency-themed Malicious Browser Extensions

Wang, K; Ling, Y; Zhang, Y; Yu, Z; Wang, H; Bai, G; Ooi, BC; Dong, JS

Characterizing Cryptocurrency-themed Malicious Browser Extensions

Wang, K Ling, Y Zhang, Y

Yu, Z Wang, H Bai, G Ooi, BC Dong, JS

Permalink

Publisher:: ASSOC COMPUTING MACHINERY
Publication Type:: Journal Article
Citation:: Proceedings of the ACM on Measurement and Analysis of Computing Systems, 2022, 6, (3)
Issue Date:: 2022-12-08

Open Access

Copyright Clearance Process

Recently Added
In Progress
Open Access

This item is open access.

Adobe PDF

Download Published versionAdobe PDF (3.54 MB)

View on publisher's site

View statistics

Full metadata record

Field	Value	Language
dc.contributor.author	Wang, K
dc.contributor.author	Ling, Y
dc.contributor.author	Zhang, Y https://orcid.org/0000-0001-5611-3483
dc.contributor.author	Yu, Z
dc.contributor.author	Wang, H
dc.contributor.author	Bai, G
dc.contributor.author	Ooi, BC
dc.contributor.author	Dong, JS
dc.date.accessioned	2024-06-11T02:09:35Z
dc.date.available	2024-06-11T02:09:35Z
dc.date.issued	2022-12-08
dc.identifier.citation	Proceedings of the ACM on Measurement and Analysis of Computing Systems, 2022, 6, (3)
dc.identifier.issn	2476-1249
dc.identifier.issn	2476-1249
dc.identifier.uri	http://hdl.handle.net/10453/179475
dc.description.abstract	Due to the surging popularity of various cryptocurrencies in recent years, a large number of browser extensions have been developed as portals to access relevant services, such as cryptocurrency exchanges and wallets. This has stimulated a wild growth of cryptocurrency themed malicious extensions that cause heavy financial losses to the users and legitimate service providers. They have shown their capability of evading the stringent vetting processes of the extension stores, highlighting a lack of understanding of this emerging type of malware in our community. In this work, we conduct the first systematic study to identify and characterize cryptocurrency-themed malicious extensions. We monitor seven official and third-party extension distribution venues for 18 months (December 2020 to June 2022) and have collected around 3600 unique cryptocurrency-themed extensions. Leveraging a hybrid analysis, we have identified 186 malicious extensions that belong to five categories. We then characterize those extensions from various perspectives including their distribution channels, life cycles, developers, illicit behaviors, and illegal gains. Our work unveils the status quo of the cryptocurrency-themed malicious extensions and reveals their disguises and programmatic features on which detection techniques can be based. Our work serves as a warning to extension users, and an appeal to extension store operators to enact dedicated countermeasures. To facilitate future research in this area, we release our dataset of the identified malicious extensions and open-source our analyzer.
dc.language	English
dc.publisher	ASSOC COMPUTING MACHINERY
dc.relation.ispartof	Proceedings of the ACM on Measurement and Analysis of Computing Systems
dc.relation.isbasedon	10.1145/3570603
dc.rights	info:eu-repo/semantics/openAccess
dc.title	Characterizing Cryptocurrency-themed Malicious Browser Extensions
dc.type	Journal Article
utslib.citation.volume	6
pubs.organisational-group	University of Technology Sydney
pubs.organisational-group	University of Technology Sydney/Faculty of Engineering and Information Technology
pubs.organisational-group	University of Technology Sydney/Faculty of Engineering and Information Technology/School of Computer Science
utslib.copyright.status	open_access	*
dc.rights.license	This work is licensed under a Creative Commons Attribution 4.0 International License (CC BY 4.0). To view a copy of this license, visit https://creativecommons.org/licenses/by/4.0/
dc.date.updated	2024-06-11T02:09:32Z
pubs.issue	3
pubs.publication-status	Published
pubs.volume	6
utslib.citation.issue	3

Abstract:

Due to the surging popularity of various cryptocurrencies in recent years, a large number of browser extensions have been developed as portals to access relevant services, such as cryptocurrency exchanges and wallets. This has stimulated a wild growth of cryptocurrency themed malicious extensions that cause heavy financial losses to the users and legitimate service providers. They have shown their capability of evading the stringent vetting processes of the extension stores, highlighting a lack of understanding of this emerging type of malware in our community. In this work, we conduct the first systematic study to identify and characterize cryptocurrency-themed malicious extensions. We monitor seven official and third-party extension distribution venues for 18 months (December 2020 to June 2022) and have collected around 3600 unique cryptocurrency-themed extensions. Leveraging a hybrid analysis, we have identified 186 malicious extensions that belong to five categories. We then characterize those extensions from various perspectives including their distribution channels, life cycles, developers, illicit behaviors, and illegal gains. Our work unveils the status quo of the cryptocurrency-themed malicious extensions and reveals their disguises and programmatic features on which detection techniques can be based. Our work serves as a warning to extension users, and an appeal to extension store operators to enact dedicated countermeasures. To facilitate future research in this area, we release our dataset of the identified malicious extensions and open-source our analyzer.

Please use this identifier to cite or link to this item:

http://hdl.handle.net/10453/179475