MetaMask Malicious Chrome Extensions - Revision history

Azoundria at 19:31, 1 May 2023

2023-05-01T19:31:42Z

← Older revision		Revision as of 13:31, 1 May 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/metamaskmaliciouschromeextensions.php}}		{{Imported Case Study 2\|source=https://www.quadrigainitiative.com/casestudy/metamaskmaliciouschromeextensions.php}}
	{{Unattributed Sources}}		{{Unattributed Sources}}

	[[File:Metamask.jpg\|thumb\|MetaMask]]Multiple malicious Chrome extensions attempting to impersonate the MetaMask wallet were found on the Google Play, and hundreds of users had downloaded them. The extensions, if used, would attempt to steal the 24 word seed phrase of new cryptocurrency users by tricking them into providing it. There is no report of any funds lost nor of any being recovered.		[[File:Metamask.jpg\|thumb\|MetaMask]]Multiple malicious Chrome extensions attempting to impersonate the MetaMask wallet were found on the Google Play, and hundreds of users had downloaded them. The extensions, if used, would attempt to steal the 24 word seed phrase of new cryptocurrency users by tricking them into providing it. There is no report of any funds lost nor of any being recovered.

	This is a global/international case not involving a specific country.		This is a global/international case not involving a specific country.<ref name="cointelegraphtwitter-6706" /><ref name="cointelegraph-6707" /><ref name="cointelegraph-6907" /><ref name="nakedsecurity-6908" /><ref name="danfinlaytwitter-6909" /><ref name="metamask-6871" /><ref name="youtube-6872" /><ref name="pastebin-7165" /><ref name="danfinlaytwitter-7166" /><ref name="theregister-7167" /><ref name="chromiumblog-7168" /><ref name="coingeek-7169" /><ref name="crowdfundinsider-7170" /><ref name="myetherwallettwitter-7857" /><ref name="myetherwallettwitter-7858" /><ref name="danfinlaytwitter-7859" /><ref name="nakedsecurity-8285" />
	<ref name="cointelegraphtwitter-6706" /><ref name="cointelegraph-6707" /><ref name="cointelegraph-6907" /><ref name="nakedsecurity-6908" /><ref name="danfinlaytwitter-6909" /><ref name="metamask-6871" /><ref name="youtube-6872" /><ref name="pastebin-7165" /><ref name="danfinlaytwitter-7166" /><ref name="theregister-7167" /><ref name="chromiumblog-7168" /><ref name="coingeek-7169" /><ref name="crowdfundinsider-7170" /><ref name="myetherwallettwitter-7857" /><ref name="myetherwallettwitter-7858" /><ref name="danfinlaytwitter-7859" /><ref name="nakedsecurity-8285" />

	== About MetaMask ==		== About MetaMask ==
Line 73:		Line 72:
	!Description		!Description
	\|-		\|-
	\|May 5th, 2020 9:41:00 AM		\|May 5th, 2020 9:41:00 AM MDT
	\|Main Event		\|Main Event
	\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
Line 81:		Line 80:
	\|		\|
	\|}		\|}

			== Technical Details ==
			This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

	== Total Amount Lost ==		== Total Amount Lost ==
Line 100:		Line 102:
	== Ongoing Developments ==		== Ongoing Developments ==
	What parts of this case are still remaining to be concluded?		What parts of this case are still remaining to be concluded?
			== General Prevention Policies ==
			Always check and visit the official website of a service. The majority of funds should be stored offline and not on a live wallet application. When setting up a new wallet or upgrading wallet software, never enter your pass phrase or send any funds without first transferring a smaller amount.
			== Individual Prevention Policies ==
			{{Prevention:Individuals:Placeholder}}

			{{Prevention:Individuals:End}}

			== Platform Prevention Policies ==
			{{Prevention:Platforms:Placeholder}}

			{{Prevention:Platforms:End}}

			== Regulatory Prevention Policies ==
			{{Prevention:Regulators:Placeholder}}

	== Prevention ~~Policies ==~~		{{Prevention:Regulators:End}}
	Always check and visit the official website of a service. The majority of funds should be stored offline and not on a live wallet application. When setting up a new wallet or upgrading wallet software, never enter your pass phrase or send any funds without first transferring a smaller amount.

	== References ==		== References ==

Azoundria at 16:50, 22 February 2023

2023-02-22T16:50:33Z

← Older revision		Revision as of 10:50, 22 February 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/metamaskmaliciouschromeextensions.php}}		{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/metamaskmaliciouschromeextensions.php}}
			{{Unattributed Sources}}

	[[File:Metamask.jpg\|thumb\|MetaMask]]Multiple malicious Chrome extensions attempting to impersonate the MetaMask wallet were found on the Google Play, and hundreds of users had downloaded them. The extensions, if used, would attempt to steal the 24 word seed phrase of new cryptocurrency users by tricking them into providing it. There is no report of any funds lost nor of any being recovered.		[[File:Metamask.jpg\|thumb\|MetaMask]]Multiple malicious Chrome extensions attempting to impersonate the MetaMask wallet were found on the Google Play, and hundreds of users had downloaded them. The extensions, if used, would attempt to steal the 24 word seed phrase of new cryptocurrency users by tricking them into providing it. There is no report of any funds lost nor of any being recovered.

	This is a global/international case not involving a specific country.		This is a global/international case not involving a specific country.
			<ref name="cointelegraphtwitter-6706" /><ref name="cointelegraph-6707" /><ref name="cointelegraph-6907" /><ref name="nakedsecurity-6908" /><ref name="danfinlaytwitter-6909" /><ref name="metamask-6871" /><ref name="youtube-6872" /><ref name="pastebin-7165" /><ref name="danfinlaytwitter-7166" /><ref name="theregister-7167" /><ref name="chromiumblog-7168" /><ref name="coingeek-7169" /><ref name="crowdfundinsider-7170" /><ref name="myetherwallettwitter-7857" /><ref name="myetherwallettwitter-7858" /><ref name="danfinlaytwitter-7859" /><ref name="nakedsecurity-8285" />

	== About MetaMask ==		== About MetaMask ==
Line 51:		Line 53:

	Don't Include:		Don't Include:

	* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.		* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
	* Anything that wasn't reasonably knowable at the time of the event.		* Anything that wasn't reasonably knowable at the time of the event.
Line 73:		Line 74:
	\|-		\|-
	\|May 5th, 2020 9:41:00 AM		\|May 5th, 2020 9:41:00 AM
	\|~~First~~ Event		\|Main Event
	\|~~This is an expanded~~ description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
	\|-
	\|
	\|
	\|
	\|-		\|-
	\|		\|
Line 97:		Line 94:

	== Total Amount Recovered ==		== Total Amount Recovered ==
	~~It is unknown how much was~~ recovered.		There do not appear to have been any funds recovered in this case.

	What funds were recovered? What funds were reimbursed for those affected users?		What funds were recovered? What funds were reimbursed for those affected users?
Line 108:		Line 105:

	== References ==		== References ==
	[https://twitter.com/Cointelegraph/status/1351695990437376005 @Cointelegraph Twitter] (Feb 25)		<references><ref name="cointelegraphtwitter-6706">[https://twitter.com/Cointelegraph/status/1351695990437376005 @Cointelegraph Twitter] (Feb 25, 2022)</ref>

	[https://cointelegraph.com/news/trezor-crypto-wallet-warns-users-of-doppelgaenger-scam-app-on-google-play Trezor crypto wallet warns users of doppelgänger scam app on Google Play] (Feb 25)		<ref name="cointelegraph-6707">[https://cointelegraph.com/news/trezor-crypto-wallet-warns-users-of-doppelgaenger-scam-app-on-google-play Trezor crypto wallet warns users of doppelgänger scam app on Google Play] (Feb 25, 2022)</ref>

	[https://cointelegraph.com/news/22-more-crypto-stealing-google-chrome-extensions-discovered 22 More Crypto-Stealing Google Chrome Extensions Discovered] (Mar 2)		<ref name="cointelegraph-6907">[https://cointelegraph.com/news/22-more-crypto-stealing-google-chrome-extensions-discovered 22 More Crypto-Stealing Google Chrome Extensions Discovered] (Mar 2, 2022)</ref>

	[https://nakedsecurity.sophos.com/2020/05/08/more-crypto-stealing-chrome-extensions-swatted-by-google/ More crypto-stealing Chrome extensions swatted by Google – Naked Security] (Mar 2)		<ref name="nakedsecurity-6908">[https://nakedsecurity.sophos.com/2020/05/08/more-crypto-stealing-chrome-extensions-swatted-by-google/ More crypto-stealing Chrome extensions swatted by Google – Naked Security] (Mar 2, 2022)</ref>

	[https://twitter.com/danfinlay/status/1257696177736175617 @danfinlay Twitter] (Mar 2)		<ref name="danfinlaytwitter-6909">[https://twitter.com/danfinlay/status/1257696177736175617 @danfinlay Twitter] (Mar 2, 2022)</ref>

	[https://metamask.io/ https://metamask.io/] (Mar 6)		<ref name="metamask-6871">[https://metamask.io/ https://metamask.io/] (Mar 6, 2022)</ref>

	[https://www.youtube.com/watch?v=YVgfHZMFFFQ What is MetaMask? - YouTube] (Mar 6)		<ref name="youtube-6872">[https://www.youtube.com/watch?v=YVgfHZMFFFQ What is MetaMask? - YouTube] (Mar 6, 2022)</ref>

	[https://~~pastebin~~.com/~~r--removeit--aw~~/33AJfKR3 ~~Raw PasteBin Source~~] (Mar 13)		<ref name="pastebin-7165">[https://pastebin.com/raw/33AJfKR3 https://pastebin.com/raw/33AJfKR3] (Mar 13, 2022)</ref>

	[https://twitter.com/danfinlay/status/1257696833960214532 @danfinlay Twitter] (Mar 13)		<ref name="danfinlaytwitter-7166">[https://twitter.com/danfinlay/status/1257696833960214532 @danfinlay Twitter] (Mar 13, 2022)</ref>

	[https://www.theregister.com/2020/05/06/chrome_malicious_extensions/ Fake crypto-wallet extensions appear in Chrome Web Store once again, siphoning off victims' passwords • The Register] (Mar 13)		<ref name="theregister-7167">[https://www.theregister.com/2020/05/06/chrome_malicious_extensions/ Fake crypto-wallet extensions appear in Chrome Web Store once again, siphoning off victims' passwords • The Register] (Mar 13, 2022)</ref>

	[https://blog.chromium.org/2020/04/keeping-spam-off-chrome-web-store.html Chromium Blog: Keeping spam off the Chrome Web Store] (Mar 13)		<ref name="chromiumblog-7168">[https://blog.chromium.org/2020/04/keeping-spam-off-chrome-web-store.html Chromium Blog: Keeping spam off the Chrome Web Store] (Mar 13, 2022)</ref>

	[https://coingeek.com/more-fake-digital-currency-wallets-on-google-taken-down/ More fake digital currency wallets on Google taken down - CoinGeek] (Mar 13)		<ref name="coingeek-7169">[https://coingeek.com/more-fake-digital-currency-wallets-on-google-taken-down/ More fake digital currency wallets on Google taken down - CoinGeek] (Mar 13, 2022)</ref>

	[https://www.crowdfundinsider.com/2020/05/161309-google-removes-22-malicious-chrome-browser-extensions-impersonating-widely-used-cryptocurrency-wallet-providers-like-trezor-ledger-metamask/ https://www.crowdfundinsider.com/2020/05/161309-google-removes-22-malicious-chrome-browser-extensions-impersonating-widely-used-cryptocurrency-wallet-providers-like-trezor-ledger-metamask/] (Mar 13)		<ref name="crowdfundinsider-7170">[https://www.crowdfundinsider.com/2020/05/161309-google-removes-22-malicious-chrome-browser-extensions-impersonating-widely-used-cryptocurrency-wallet-providers-like-trezor-ledger-metamask/ https://www.crowdfundinsider.com/2020/05/161309-google-removes-22-malicious-chrome-browser-extensions-impersonating-widely-used-cryptocurrency-wallet-providers-like-trezor-ledger-metamask/] (Mar 13, 2022)</ref>

	[https://twitter.com/myetherwallet/status/1258120699316596736 @myetherwallet Twitter] (May 31)		<ref name="myetherwallettwitter-7857">[https://twitter.com/myetherwallet/status/1258120699316596736 @myetherwallet Twitter] (May 31, 2022)</ref>

	[https://twitter.com/myetherwallet/status/1258140957574262785 @myetherwallet Twitter] (May 31)		<ref name="myetherwallettwitter-7858">[https://twitter.com/myetherwallet/status/1258140957574262785 @myetherwallet Twitter] (May 31, 2022)</ref>

	[https://twitter.com/danfinlay/status/1257696173491544064 @danfinlay Twitter] (May 31)		<ref name="danfinlaytwitter-7859">[https://twitter.com/danfinlay/status/1257696173491544064 @danfinlay Twitter] (May 31, 2022)</ref>

	[https://nakedsecurity.sophos.com/2020/04/16/49-malicious-chrome-extensions-caught-pickpocketing-crypto-wallets/ 49 malicious Chrome extensions caught pickpocketing crypto wallets – Naked Security] (Jul 2)		<ref name="nakedsecurity-8285">[https://nakedsecurity.sophos.com/2020/04/16/49-malicious-chrome-extensions-caught-pickpocketing-crypto-wallets/ 49 malicious Chrome extensions caught pickpocketing crypto wallets – Naked Security] (Jul 2, 2022)</ref></references>

Azoundria: Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/metamaskmaliciouschromeextensions.php}} MetaMaskMultiple malicious Chrome extensions attempting to impersonate the MetaMask wallet were found on the Google Play, and hundreds of users had downloaded them. The extensions, if used, would attempt to steal the 24 word seed phrase of new cryptocurrency users by tricking them into providing it. There is no report of any funds..."

2023-01-25T17:22:54Z

Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/metamaskmaliciouschromeextensions.php}} thumb|MetaMaskMultiple malicious Chrome extensions attempting to impersonate the MetaMask wallet were found on the Google Play, and hundreds of users had downloaded them. The extensions, if used, would attempt to steal the 24 word seed phrase of new cryptocurrency users by tricking them into providing it. There is no report of any funds..."

New page

{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/metamaskmaliciouschromeextensions.php}}

[[File:Metamask.jpg|thumb|MetaMask]]Multiple malicious Chrome extensions attempting to impersonate the MetaMask wallet were found on the Google Play, and hundreds of users had downloaded them. The extensions, if used, would attempt to steal the 24 word seed phrase of new cryptocurrency users by tricking them into providing it. There is no report of any funds lost nor of any being recovered.

This is a global/international case not involving a specific country.

== About MetaMask ==
MetaMask is a "crypto wallet & gateway to blockchain apps. Start exploring blockchain applications in seconds. Trusted by over 21 million users worldwide." "Available as a browser extension and as a mobile app, MetaMask equips you with a key vault, secure login, token wallet, and token exchange—everything you need to manage your digital assets."

"Since the introduction of the Chrome Web Store in 2011, it has become the largest catalog of browser extensions with over 200,000 available to all of our users. This has helped millions of users to customize their browsing experience on Chrome in ways we could have never imagined, from niche utilities to companies building businesses around the platform’s capabilities."

"As Cointelegraph reported in mid-April, Google removed 49 phishing Chrome web browser extensions after reports of malicious activity. In early March, leading cryptocurrency hardware-wallet producer Ledger warned its users about the phishing extensions on the store."

"[In late April], Google announced yet more restrictions aimed at cleaning up the Chrome Web Store, noting "the increase in adoption of the extension platform has also attracted spammers and fraudsters introducing low-quality and misleading extensions in an attempt to deceive and trick our users into installing them to make a quick profit.""

"In May 2020, a cybersecurity researcher discovered 22 malicious Google Chrome extensions imitating crypto services like Ledger and MetaMask."

"Online scammers have been targeting other popular crypto companies to impersonate their apps on Google and steal money from users. In May 2020, a cybersecurity researcher discovered 22 malicious Google Chrome extensions imitating crypto services like Trezor’s rival Ledger and major Ether (ETH) wallet MetaMask."

"Talking to Naked Security, Denley explained that he finds new ones each day. He pointed us to this Pastebin entry showing the original 49 he reported in April, along with another 22. The new ones impersonated the Ledger, KeepKey, MetaMask, and Jaxx wallets. The IDs on the left are extension IDs, which show up at the end of an extension’s URL when viewed in the Chrome store."

"The extensions he discovered impersonated well-known crypto firms such as Ledger, KeepKey, MetaMask and Jaxx. Their purpose is to trick users into giving away the credentials needed to access their wallets."

"MEANWHILE, Google _keeps on approving phishers_. The quantity of impostor MetaMasks on the Chrome store has been growing, and apparently they all pass the manual security review. FURTHERMORE they are all allowed to buy premium Google ad space at the top of search results."

"Most of the phishing extensions have already been taken down as of press time. Per the report, most were down within 24 hours of Denley reporting them."

"Finlay told The Register that if Google wants to run the Chrome Web Store with few people, then they should implement systems to automatically enforce brand and trademark restrictions for the store and its ad platforms."

"I think it would be great for Google to make a stance of respecting trademarks in their ads, but I’m not sure if that runs counter to their business model," he said. "I sure hope Google doesn’t feel they need to protect phishing to stay afloat."

"Google's ad policy says the company will review trademark complaints from trademark holders, but only after receiving a complaint. Google's Chrome Web Store developer agreement forbids developers from violating intellectual property rights, which probably doesn't mean much to committed law-breakers. At the same time, it makes clear, "Google is not obligated to monitor the Products or their content.""

"Most of the phishing extensions have already been taken down as of press time. Per the report, most were down within 24 hours of Denley reporting them." "Harry Denley, director of security at MyCrypto, who identified the previous lot of bad extensions, told The Register at least eight among the latest crop of 11 impostors, pretending to be crypto-wallet software KeyKeep, Jaxx, Ledger, and MetaMask, have been taken down."

In August 2020, "Google acknowledged a general problem with malicious extensions and has announced new rules for the Chrome Web Store."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:

* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - MetaMask Malicious Chrome Extensions
!Date
!Event
!Description
|-
|May 5th, 2020 9:41:00 AM
|First Event
|This is an expanded description of what happened and the impact. If multiple lines are necessary, add them here.
|-
|
|
|
|-
|
|
|
|}

== Total Amount Lost ==
The total amount lost is unknown.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
It is unknown how much was recovered.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?

== Prevention Policies ==
Always check and visit the official website of a service. The majority of funds should be stored offline and not on a live wallet application. When setting up a new wallet or upgrading wallet software, never enter your pass phrase or send any funds without first transferring a smaller amount.

== References ==
[https://twitter.com/Cointelegraph/status/1351695990437376005 @Cointelegraph Twitter] (Feb 25)

[https://cointelegraph.com/news/trezor-crypto-wallet-warns-users-of-doppelgaenger-scam-app-on-google-play Trezor crypto wallet warns users of doppelgänger scam app on Google Play] (Feb 25)

[https://cointelegraph.com/news/22-more-crypto-stealing-google-chrome-extensions-discovered 22 More Crypto-Stealing Google Chrome Extensions Discovered] (Mar 2)

[https://nakedsecurity.sophos.com/2020/05/08/more-crypto-stealing-chrome-extensions-swatted-by-google/ More crypto-stealing Chrome extensions swatted by Google – Naked Security] (Mar 2)

[https://twitter.com/danfinlay/status/1257696177736175617 @danfinlay Twitter] (Mar 2)

[https://metamask.io/ https://metamask.io/] (Mar 6)

[https://www.youtube.com/watch?v=YVgfHZMFFFQ What is MetaMask? - YouTube] (Mar 6)

[https://pastebin.com/r--removeit--aw/33AJfKR3 Raw PasteBin Source] (Mar 13)

[https://twitter.com/danfinlay/status/1257696833960214532 @danfinlay Twitter] (Mar 13)

[https://www.theregister.com/2020/05/06/chrome_malicious_extensions/ Fake crypto-wallet extensions appear in Chrome Web Store once again, siphoning off victims' passwords • The Register] (Mar 13)

[https://blog.chromium.org/2020/04/keeping-spam-off-chrome-web-store.html Chromium Blog: Keeping spam off the Chrome Web Store] (Mar 13)

[https://coingeek.com/more-fake-digital-currency-wallets-on-google-taken-down/ More fake digital currency wallets on Google taken down - CoinGeek] (Mar 13)

[https://www.crowdfundinsider.com/2020/05/161309-google-removes-22-malicious-chrome-browser-extensions-impersonating-widely-used-cryptocurrency-wallet-providers-like-trezor-ledger-metamask/ https://www.crowdfundinsider.com/2020/05/161309-google-removes-22-malicious-chrome-browser-extensions-impersonating-widely-used-cryptocurrency-wallet-providers-like-trezor-ledger-metamask/] (Mar 13)

[https://twitter.com/myetherwallet/status/1258120699316596736 @myetherwallet Twitter] (May 31)

[https://twitter.com/myetherwallet/status/1258140957574262785 @myetherwallet Twitter] (May 31)

[https://twitter.com/danfinlay/status/1257696173491544064 @danfinlay Twitter] (May 31)

[https://nakedsecurity.sophos.com/2020/04/16/49-malicious-chrome-extensions-caught-pickpocketing-crypto-wallets/ 49 malicious Chrome extensions caught pickpocketing crypto wallets – Naked Security] (Jul 2)