Attention! Fake Extensions on the Chrome Web Store Again! – Disposable mail news

Reportedly, Google was in the news about having removed 49 Chrome extensions from its browser’s store for robbing crypto-wallet credentials. What’s more, after that, there surfaced an additional set of password-swiping “extensions” aka “add-ons”, which are up for download even now.

Per sources, the allegedly corrupt add-ons exist on the browser store disguised as authentic crypto-wallet extensions. These absolutely uncertified add-ons invite people to fill in their credentials so as to make siphoning off them easy and the digital money accessible.

Reports mention that the security researchers have affirmative information as to 8 of the 11 fake add-ons impersonating legitimate crypto-wallet software being removed including “Jaxx Ledger, KeyKeep, and MetaMask.” A list of “extension identifiers” which was reported to Google was also provided.

Per researchers, there was a lack of vigilance by the Google Web Store because it apparently sanctions phisher-made extensions without giving the issue the attention it demands. Another thing that is disturbing for the researchers is that these extensions had premium ad space and are the first thing a user sees while searching.

According to sources, much like the Google Play Store with malicious apps, the Google Web Store had been facing difficulty in guarding itself against mal-actors. There also hadn’t been much of a response from their team about the issue.

One solution that was most talked about was that Google should at the least put into effect mechanisms in the Chrome Web Store that automatically impose trademark restrictions for the store and the ad platforms in it.

Per sources, Google’s Chrome Web Store “developer agreement” bars developers from violating intellectual property rights and also clearly mentions “Google is not obligated to monitor the products or their content”. Reports mention that as per the ad policy of Google, it could review trademarks complaints from trademarks holders only when it has received a complaint.

Google heeding all the hue and cry about the extensions did herald more restrictions with the motive of wiping away traces of any fake extensions and spammers creating bad quality extensions that were causing people trouble.

The alterations in the policy will block the spammers and developers from swarming the store with similar extensions and elements with questionable behavior. Word has it that because of hateful comments the Chrome Web Store was “locked down” in January.

But, as promising as it may be, allegedly Google has been making such promises about the Chrome Web Store security strengthening for more than half a decade. So no one can blame researchers for their skepticism.


Temp Mails (https://tempemail.co/) is a new free temporary email addresses service. This service provide you random 10 minutes emails addresses. It is also known by names like: temporary mail, disposable mail, throwaway email, one time mail, anonymous email address… All emails received by Tempmail servers are displayed automatically in your online browser inbox.

“CursedChrome”, a chrome extension used by hackers to make your browser into a proxy – Disposable mail news


Security researchers have found a Chrome extension that turns Chrome browsers in proxy bots that enables the hacker to browse chrome using an infected identity.

This tool was created by Matthew Bryan, a security researcher, he named it “Cursed Chrome” and released it on GitHub as an open-source project.

 The software works on two fronts and has two parts –

  • a client-side component (this is the chrome extension) 
  • a server-side counterpart ( this is where all CursedChrome server report) 

Once this extension is installed, it can be used to log into the CursedChrome control panel, and through it, the hacker can use any infected browser. Thus, the hacker can navigate and browse the net using that identity and can even access logged in sessions and credentials.

This extension is the icing on the cake for hackers and has been received with skepticism. Many at the cybersecurity community have raised their eyebrows at the public release of such software saying it’s nothing short of handing a gun to a killer to do the killing. 

Created for Pen-testing

The creator, Matthew Bryant says that his intentions were quite innocent. “I open-sourced the code because I want other professional red teamers and pen-testers to be able to accurately simulate the ‘malicious browser-extension’ scenario,” says Bryant in a statement.

He opens sourced the code so that it would help security companies to test their walls and keep the miscreants out.
“Open-sourcing tooling is important for red teams (security companies) for the same reasons as any other job: it saves time for the teams at different companies from having to rewrite everything whenever they do a red team or pentest. It’s actually doubly important for us because pen-testers and red teamers work on extremely tight timelines,” Bryant said.

Bryant says that it’s very easy to built an extension like CursedChrome for a hacker and his only intention was to bring awareness that extensions like these that we very easily install in our system can be equal to paving way for hackers.

 “It’s […] important to raise awareness of just what level of access you’re granting when you install a random extension for your browser,” Bryant said in a mail to ZDnet.

He hopes that security companies can show the dangers of Chrome extensions through CursedChrome and build a stronger security system.

Bryant also gives a solution that blocks all extensions that could harm the user’s security. He released a second project, named Chrome Galvanizer on GitHub (this too, open-source).


Temp Mails (https://tempemail.co/) is a new free temporary email addresses service. This service provide you random 10 minutes emails addresses. It is also known by names like: temporary mail, disposable mail, throwaway email, one time mail, anonymous email address… All emails received by Tempmail servers are displayed automatically in your online browser inbox.

The 7 biggest web security news of 2015 – 10 minute mail

Below, the Disposable mail team has listed some of the largest security news and breaches of the past year, that have had a great impact on the security and privacy of both companies and individuals. Let’s make it a new year’s resolution to be more web-secure next year, shall we?

The Ashley Madison hack leaking cheaters’ user data

The online cheating site AshleyMadison.com was hacked in July, leaking out email addresses and account details from 32 million site members. Avid Life Media (ALM), Toronto-based parent company of AshleyMadison, also had sensitive internal data leaked. The hackers, calling themselves “The Impact Team”, performed the hack as a response to the site’s unethical mission of arranging affairs between married people, as well as a comeback to ALM for charging $19 from their users for a “total delete” of account information-function, which in reality didn’t work. Passwords on the live site were hashed using a bcrypt algorithm. ALM have announced a bounty hunt for the hackers, but with no result so far.
(Read more on fortune.com )

Google Chrome Extensions sharing your private browsing history

Earlier in November, the Disposable mail team could confirm that popular Google Chrome Extensions were constantly tracking you per default, and making it very difficult or even impossible to opt-out. By downloading certain extensions from the Chrome Web Store, users automatically agreed to the aggressive tracking. These extensions receive your complete browsing history, all your cookies, your secret access-tokens used for authentication (i.e., Facebook Connect) and shared links from sites such as Dropbox and Google Drive. Our findings were picked up by media like BBC and Observer.

– Since the publication, all of the Chrome Extension mentioned turned off the tracking script per default, and some of the extensions were also completely disabled by the Google Chrome Web Store team. The Firefox extension mentioned was disabled until the maintainer removed the tracking script and submitted a new version without tracking, says Frans Rosén, Knowledge Advisor at Disposable mail.

Let’s encrypt is now trusted by all major browsers

Let’s encrypt – a free, automated, and open certificate authority (CA) – announced in October that they are now trusted and supported by all major browsers. The free SSL/TLS certificate encrypts all the Internet traffic passed between a site and its users, supporting a secure browsing experience. The company wants to see HTTPS become the standard for all websites. Let’s Encrypt entered Public Beta in the beginning of December, and can now be installed through their site.

(Read more on letsencrypt.org )

CIA Director John Brennan’s private email hacked

CIA Director John Brennan’s personal AOL email account was hacked in October, in what Brennan calls a case study showing the challenges that face national security in the modern age. A high school student claimed to be behind the the hack, saying he obtained access to the account by posing as a Verizon worker, tricking another employee into revealing login information. Sensitive information from Brennan’s email was later published on Wikileaks, like Social Security Numbers of both Brennan and his family as well as of some US intelligence officials. Earlier in the year Hillary Clinton’s private server and email account were also hacked, and she has been criticized since for using her private email to do official work, and in a sense risking national security. (Read more on wired.com )

Crowdfunding site Patreon hacked – despite warnings

The crowdfunding site Patreon got hacked in October, leaking 2.3 million unique email addresses, as well as information on who had supported what projects and the conversations users had had between each other. Disposable mail reported a specific Remote Code Execution to Patreon prior to the breach, due to Werkzeug Debugger. We believe that the public debugger was the attack method due to the simplicity and availability of the vulnerable endpoint. Read our full blogpost on the hack here.

There are still thousands of publicly available instances of Werkzeug Debugger out there, causing a security breach for many more sites. To prevent it from happening to you, it is important to remember that the Werkzeug Debugger should only be used in testing environments and not when putting a site up online.

– Patreon thanked us after the disclosure, in terms of getting the information out, since more companies were affected. They also paid a bug bounty for the finding,
says Frans Rosén, Knowledge Advisor at Disposable mail.

Experian hack affecting 15 million people

The hack of Experian, one of the largest data brokers in the world, leaked personal information from around 15 million people, many of them T-Mobile customers who had used Experian to apply for credit checks. Names, addresses, and social security, driver’s license and passport numbers are assumed to have been leaked. Experian, being a data broker, is paradoxically often trusted by other companies to anonymize personal information. The hack is the most recent in a series of data breaches affecting organizations from the US government’s Office of Personnel Management to Target. (Read more on theguardian.com )

VTech hack leaking personal information of both parents and children

Chinese digital toy company VTech’s app store database Learning Lodge was hacked in November, exposing personal information of about 4.8 million parents and 200,000 children. The hack has been deemed among the biggest hacks ever documented, and the leaked information makes it possible to link listed kids to their parent. The hacker claimed there was no reason behind the hack, and appears to have shared the breached data only with the staff at tech news site Motherboard who first covered the story. However, it can’t be ruled out that the data may also have been sold to a third party. (Read more on motherboard.vice.com )

“Unfortunately more websites will be hacked in 2016”


Disposable mail co-founder and security researcher Fredrik Almroth Nordberg summarizes the consequences of the biggest security breaches of 2015, and predicts how web security will develop in 2016.

Temp Mails (https://tempemail.co/) is a new free temporary email addresses service. This service provide you random 10 minutes emails addresses. It is also known by names like: temporary mail, disposable mail, throwaway email, one time mail, anonymous email address… All emails received by Tempmail servers are displayed automatically in your online browser inbox.

Chrome extensions still track user data – 10 minute mail


It will soon be a year since we published our article exposing how Chrome extensions track their users. The research received worldwide attention and was picked up by leading tech sites like Observer, Metro and BBC. A lot has happened since then. Google has updated their User Data Policy for the Chrome Web Store to “ensure transparent use of the data in a way that is consistent with the wishes and expectations of users.” But the story didn’t end there…

The issue has recently been brought to light again after the WOT (Web of Trust) extension disappeared from Google Chrome store, which might mean it has been banned for violating Google’s updated User Data Policy – however, this has not been confirmed. WOT, an add-on promising users a safer browsing experience, turned out to have been gathering and selling a considerable amount of user data, including browsing history, usernames and emails.

WOT left a response on their forum, which can be read here.

Google’s new User Data Policy is a step in the right direction, but there are still incidents that clearly show that user privacy remains a key issue in web security.

Temp Mails (https://tempemail.co/) is a new free temporary email addresses service. This service provide you random 10 minutes emails addresses. It is also known by names like: temporary mail, disposable mail, throwaway email, one time mail, anonymous email address… All emails received by Tempmail servers are displayed automatically in your online browser inbox.