Apart from cryptojacking, viruses, exit scams, phishing and honey pots, “Browser add-ons can steal your crypto and identifying information,” Casa’s CEO Jeremy Welch, forewarned the attendees of the Baltic Honeybadger conference in Riga.
Harmless browser extensions can collect piles of data, which can be used by hackers to leak or steal KYC data and change Bitcoin (BTC) transactions. The only significant multi-signature system which requires access to KYC data is the one provided by the US-based custody service, Unchained Capital.
Tapping a user’s browsing history can give hackers access to users’ online habits, including activities on crypto-related site.
Browser extensions impose major risks, and these risks haven’t been discussed until this point, Make sure you don’t expose your bitcoin addresses anywhere,
He demonstrated how extensions were being used to steal KYC data while KYC form was being filled. In the example, the house was shown, how an extension providing wallpapers with inspiring quotes was stealing KYC data like name, address, date of birth, and social security numbers.
The extension was also shown, extorting graphical (location) data, and photos from driver’s license, which were seized as code, and then are decoded to obtain the actual photos.
The same quote-wallpaper extension possesses the ability to modify the receiver’s address when the users try to send cryptocurrencies to someone else. The extension would redirect the coins to the hacker’s wallet instead of sending it to the intended recipient.
Welch remarked that many popular applications request permits to gather personal data, like password managers, Joule extension for in-browser Lighting transactions, text editing app Grammarly, the Lolli bitcoin-earning extension, and Casa’s Stats extension.
The omnipresence and demand for browser extensions make them extremely dangerous hacking tools.
“It’s terrifying, right? We all are using browser extensions all the time,” With no easy way out, the developers’ should be very vigilant.
We all need to be discussing these issues more because we’re not even in the phase yet when real attacks will be taking place,
Welch added that Casa would publish more security research on extension hacks. He also urged bitcoin developers and businesspeople to approach their company and share their opinions, concerns, and ideas regarding how to deal with this uprising security threat.