Mackenzie Jackson: Hello and welcome to another episode of The Secure Disclosure. My name is Mackenzie, and this is your weekly news brief.
We're kicking off today's show by diving into the dodgy, mysterious world of data brokers and data intelligence agencies, and how they may be spying on you. We dive into the work of an anonymous security research group called The Q Continuum and analyze a research paper that they released where they found hundreds of Chrome extensions that were spying on you or accidentally leaking your user information. While this group has decided to remain anonymous, I was still able to interview a representative from them. We dive into their report where they analyze tens of thousands of Chrome extensions to find out that hundreds of them are actually spying on you or, at best case, potentially leaking your information. Next, we're going to be going into the release of Claude Code Security and what this means for the security vendor space moving into a more AI-centric world, all of the great initiatives that this could bring about, some of the gaps, and what it means for the future. And in our final segment, we're going to be chatting about our friends over in North Korea, the Lazarus Group, and the Medusa ransomware attacks that they have been linked to. So, stick around to the end for that. Before we get into our first segment, please do me a favor, like this video, subscribe to the channel. We release two shows every single week, a new show on Thursday and a thought leadership show on Tuesday. So, subscribe to the channel if you don't want to miss that out, and like the video. It really helps the algorithm gods promote our stuff. In our first segment, we're going to be diving into a report from The Q Collective, an anonymous research group that released a report that explains and showed how vast the problem of Chrome extensions stealing information or spying on you is. Or if we want to put it politely, we can say that some of them may be accidentally leaking data. The report analyzed 240,000 Chrome extensions and filtered out information of those that were requesting data for potentially sensitive sources, things like your tabs, your browsing history, or broad host permissions. They narrowed this down to 37,000 Chrome extensions which they analyzed deeply to discover 287 that were, according to the authors, transmitting sensitive data to external servers. Now, you may think to yourself, 287 Chrome extensions, that doesn't sound like a whole lot. Well, let me give you a much bigger number: this impacted 37 million users. And what makes this interesting is the parallels that they are able to bring to the kind of dodgy world of data brokers and how they actually get this information. A lot of these data brokers actually say that they get this data from Chrome extensions. Not only this, there's also links to data intelligence sources. The report, though, is much more than just analyzing a few Chrome extensions. They go into some pretty deep research. They uncover a pretty neat way to be able to detect what kind of information is being sent to external servers without actually having to intercept any encrypted data. But the first question that I had while reading the report was, why go to all this effort? If they're choosing to remain anonymous, why did they do this report, because it's clearly not really for clout.
Unknown Speaker: There were a few aspects we wanted to explore. We were curious about where SimilarWeb obtains its data. After a relatively short amount of online digging, we discovered a blog post by Michael Weissbacher titled "These Chrome extensions spy on 8 million users." We thought it would be interesting to replicate that study and apply a few small tweaks on top of it. It is essentially a public secret that data brokers like SimilarWeb collect data from browser extensions. The company has already disclosed it in its public reports as a publicly traded entity.
Mackenzie Jackson: As they said, they were basing this off much smaller previous studies that have been done. So I was really curious to know what did they expect to find when they started this? Did they expect that it would be as big of a problem as it ultimately is, or were they expecting to find something on a smaller scale?
Unknown Speaker: We anticipated seeing the same leakage patterns across the majority of extensions, but we underestimated the creativity of the actors involved. We began with a modest set of extensions that had previously been reported as spying. Since many of those extensions are still active, they provided a solid starting point. Each time we broadened our search, we uncovered additional malicious extensions. Eventually, the scope became too large to continue, and we had to draw a line and halt further investigation. Consequently, the figures presented in the report should not be considered final. We believe the true number of spying extensions could be several times higher.
Mackenzie Jackson: Here's something that I really loved, which is the behavioral analysis of the payloads. So, what they were able to tell is that these extensions were sending off external payloads, but without knowing what that payload is, you can't know if that's containing sensitive information or not. Now, you could try to decrypt this, sure, but this would be pretty much impossible, especially at a scale of this and especially for a hacking group that didn't have a whole heap of resources. And this is where it gets really clever. Instead, they started with known baseline URLs that they knew and checked what the payloads were. They then went to longer URLs, had longer history, and measured whether or not having more of this type of information would increase the payload. If it increased the payload, it's pretty clear evidence that they're sending this information across. So by measuring the size of the bytes of a payload and changing the types of data that they had access to, they could tell what information it was actually sending without having to decrypt it. This is kind of brilliant.
Unknown Speaker: We wouldn't claim the method is entirely novel, but it draws heavily from the study by Weissbacher. Nonetheless, the approach has broader use. It could be used wherever data loss prevention, DLP, is needed, not just for browser history leakage. The main limitation is that you must monitor network traffic and compare it against a reference baseline. In the case of browser history, establishing that baseline is relatively straightforward. Our implementation runs offline and is deliberately simple, that essentially observes how the payload size changes when we inject known data. While this method was crude, it demonstrates that behavioral correlation can reveal leaks without ever decrypting the underlying traffic.
Mackenzie Jackson: Now, there is an important distinction that the report makes. This is that some of the extensions were leaking information and some of the extensions were spying on people. I think leaking is pretty favorable use in this case, but I understand the distinction that they wanted to make. They've been able to determine that things like URLs are being sent via these extensions to an external server. However, you could say that perhaps this information was just being bundled up, accidentally leaking it and sending it across to a server, but not necessarily wanting to use that, sell that, or monetize it. But then they noticed some other things when they were doing the manual inspection. They were able to notice that actually this type of information was being encrypted. They were noticing B64 strings, encryption via things like RSA certificates, LZ string compression on URLs, and ROT47 obfuscation. Now basically what this means is by encrypting these payloads, you're trying to protect the data. That in itself isn't proof of malicious intent. I know this. However, it does add weight to the fact that this is valuable. You don't really encrypt stuff that's not that valuable. So, this is where they make the distinction.
Unknown Speaker: We felt that calling the extensions only "leaking" or "spying" would be misleading. That's why operationally we draw the line at purpose. Leaking is exposure of data that occurs as a side effect of normal analytics or CDN calls, whereas spying implies a deliberate design to collect and transmit information about the user's behavior. There was a case where leakage was done by calling some parameters on Google CDN favicons. It's hard to imagine that Google CDN would have some kind of secret spying method via get parameters on favicons. Cases such as these, we think, could be hardly turned into purposely spying methods. We gained this knowledge only after manual inspections of traffic logs. If we ever made this into some kind of platform or tool, the aim would be to have classifications of severity of the leakage. OSINT methods could be applied to determine the purpose of the leakage in a similar manner as we did it.
Mackenzie Jackson: Now, being completely honest, I'm not going to be able to go through everything that's in this report because it's quite comprehensive. But I loved how clever some of these researchers were in being able to think outside the box and be able to create relationships with these Chrome extensions to be able to determine whether or not this is a coordinated activity. One of the ways they're able to do this is by analyzing the icons of the Chrome extensions. So first they scraped the web store icons and they then applied machine learning techniques to determine whether or not these icons were made in similar ways or used similar graphics. This enabled them to be able to draw relationships between certain Chrome extensions that otherwise couldn't be discovered. And spoiler alert, they found a whole heap of relationships that they were able to categorize together. Again, not proving malicious intent, but adding weight to the fact that this is a coordinated effort to be able to take information and data from users and be able to use it or sell it. Now, all of this, I get it, sounds less than concrete, and that's because it is. We've got a lot of evidence, and I suppose you'd call it circumstantial evidence. I think it has a lot of weight to it when you actually look at it. However, we don't really have any smoking guns, that someone's actually taking this information and selling it. So, that's why they set up a honeypot. Now, if you don't know, a honeypot is basically trying to come up with a resource that you can track. So, for example, you can create a website that if someone goes to that website, it will alert you that someone's been there. Or you could create things like fake secrets, API keys that if someone tries to use them, you can get an alert. In this case, they used honeypot URLs. So, if anyone actually went to them, they would get a hit. Now, there should be no reason for anyone to actually go to these URLs. They weren't indexed. They weren't available on the net. No one would accidentally end up there. And what they did is that they fed this through the Chrome extensions so that they were included in these payloads. Now, if this is all totally innocent, that payload maybe would have ended up somewhere on a server, we know it's ending up there, and never actually used. However, spoiler alert, they were used. It was very exciting to see the first request to Honeypot made from the Honey URLs. At that moment, we were sure that something is definitely going on here. We can only hypothesize. It would be interesting to see what happens with the data on the other side. We were hoping to see many smaller crawlers, but there was only one prominent scraper. Contra, Contara seems to be a small company that was acquired by Amoba later. Most likely, this kind of link will stop working in the near future after the publishing of the report. Nevertheless, we decided to disclose it as it may inspire some people in the future. Now, to finish up, I kind of want to be clear on one thing. I've looked at this report, and there's definitely behavior that goes in, but it doesn't prove fundamentally wrongdoing, malicious intent, or malicious behavior, but it does prove that there is a lot of information being sent from selective Chrome and browsers. And you can draw a reasonable hypothesis that this data isn't just being collected by accident, that it's actually being used, aggregated, and sold to these various data brokers or even data spy agencies. But I'm hopeful this won't be the last that we've heard from The Q Continuum and that they will continue their research. There were even hints, if you picked it up in there, they may be thinking about some kind of product version of this so that you can be aware of what your extensions are doing, the information that is leaving your computer without having to do all of this research yourself. All right, let's move on to our next story. The whole entire security world was thrown into chaos last week because Claude Code tweeted. And if you didn't see, Claude Code released Claude Code Security. I think this is a great step for Claude Code, but one that shouldn't have been as much of a surprise as it seems like it was. For the past couple of years, since we moved into the AI coding world, and since pretty much every single developer started to use AI as part of their daily workflow, there's been a lot of security researchers like myself that have gone on and on about how vulnerable AI coding makes us. And this is true. And this wasn't an argument against AI coding. It's just to basically say, hey, this is a new vector. So therefore, bringing security to the layer of that code from the models and the foundational models themselves, to me, makes a whole bunch of sense, but it's not quite the disruption that you think it is. AI can bring a new level of security that we only dreamed of five years ago, but it doesn't actually replace much of the legacy systems. And I will explain it. See, there's something called determinism when it comes to security. We want to be pretty deterministic when we find security flaws. Now, what I mean by this is a deterministic answer is yes or no. Do I have a security flaw or not? Yes or no? And we've been able to do this pretty well with rules. For example, does this dependency have a known CVE, have a known vulnerability? Well, that's a yes or no answer. Or does this SQL query have an SQL injection vulnerability? That's also yes or no, but doesn't use something like prepared statements. Now, where the gray area gets muddled in is if a user inputs malicious text for an SQL injection, does that text actually get executed as a function at a sync? Well, this is much harder to know and a much more non-deterministic answer. Or for example, does this CVE that I know about that is there, does it affect my application? Again, a little bit of non-determinism in there. So, we want to find vulnerabilities in a deterministic way, and we want to analyze them and understand them in a non-deterministic way. This is the part where AI can be really powerful. And I think it's great that Claude Code is being able to introduce this. But ultimately, what it needs to focus on is all of the additional context around it because AI models are famously non-deterministic. You answer the same question multiple times and it will give you different responses. That's because it doesn't have a set response for that, it comes up with it new every time. That being said, AI has absolutely transformed security, and you would be completely foolish to think that legacy tools are going to survive in the next five, ten years. But what it does mean is that just because Claude Code is able to analyze code really well doesn't mean that it's going to replace all the need for security. And I think the CrowdStrike CEO said it really well. AI is powerful. It's transformative, and it absolutely makes security better. But AI doesn't eliminate the need for security, it increases it. If you want to build AI, you need GPUs. If you want to deploy AI, you need security. That's not a hallucination, that's a fact. So I think the direction that we're going in in the world with this AI-powered security is fascinating. I think it makes total sense that Claude Code are going to be introducing security into this. But we also have to remember that security is not just about code. That is one component, but it's also about your cloud environment. It's also about business logic flaws and the design of your application and all these different components which Claude Code isn't going to be able to replace. However, it is going to be able to help us greatly along the way. So, I'm really excited to see what's next. But I do just want to point out that no, we're not about to replace all of our security tools with Claude Code. It actually would be wildly expensive from a computational point of view, but that starts a whole discussion that I really want to get into right now, but it is going to be fascinating to see what comes next. And I look forward to Claude Code doing another tweet that is going to send the security world into total chaos again. All right, and now to our last story of the day. We're talking about our friends over in North Korea. They have launched a pretty persistent attack against US-based healthcare services. Healthcare services are just a notorious attack path for state-sponsored actors because they contain some of the most sensitive information and some of the most likely to pay a ransom. Now, in this case, what makes it interesting is that whilst the North Koreans are very sophisticated actors, there is something interesting that has just happened, and that's a change of tools that they've actually used. And for this we need to go into the world of malware as a service and ransomware as a service. Semantic and Carbon Black research were able to attribute that the Lazarus Group started to use Medusa ransomware as a service. Now, this is kind of interesting for those that want to uncover how these worlds operate. Medusa is a ransomware product operated by the Spearwing Criminal Group that makes money by charging a percentage of the ransom that the cybercriminals will use. So, in this case, Lazarus using this tool enables them to basically use it for free if they pay a percentage of the ransom. And in this case, you can be sure of that because the ransom is paid through Medusa. So this may sound very similar. It may sound like every single SaaS company ever, and it's exactly true. This is how sophisticated criminal networks actually operate. You can get a little bit of an insight into how much money these criminal organizations make because there's been a reported 366 attacks by the Medusa software with an average ransom of $260,000. Now, there is a little bit of a nuance here in the sense that not all ransomware attacks are actually reported. So, we don't really know what this number is, but if you do times 260,000 by 366, you get to a pretty large number, which shows how profitable these companies were. And in fact, since the Medusa product was launched in 2023, it would probably be one of the most successful security SaaS products out there on the market if it wasn't, you know, horrible and bad and illegal and all of that kind of stuff. What makes this interesting and why I wanted to highlight it is it shows the growing connection between cybercriminal organizations and state-sponsored actors. It shows the increased level of sophistication but also teamwork that different organizations are willing to go through to try and extort victims. This is why we always need to be so on our toes when it comes to cybersecurity because we're not up against single actors anymore. In fact, we're not even up against state-sponsored actors alone anymore. We're up against an entire sophisticated network of cybercriminals working together to try and extort as much money and do as much damage as we can. It sounds terrifying because it is, but it's nothing that Claude Code Security won't be able to solve. I'm being cheeky now. I need to stop talking. All right, that's all I had for you today in this episode. I hope I will see you next Tuesday for our thought leader episode, Cyber and Saki, and until then, stay safe and stay secure.
