Google pulls fake ad blockers: Were you one of the 20 million fooled?

By Kim Komando

April 20, 2018

When it comes to browsing the internet, few things are more annoying than ads. Small, large, silent or noisy, they are certainly things we could do without.

The best way to avoid them is to install an ad-blocker, and fortunately for us, there are many to choose from. Generally, the only drawback to them is they occasionally block something we actually wanted to see, but that’s a small price to pay for an ad-free internet.

But now fake ad-blockers are fooling millions. Google Chrome users are facing that issue right now, as extensions they thought were blocking ads did more bad than good.

Millions of browsers were infected

At issue here are five ad-blockers that were available in the Chrome Web Store that along with blocking ads, infected the computers they were installed in.

The fake ad-blocker was discovered by researchers with AdGuard, and following their report, Google removed the five suspected extensions from their store. The most downloaded one, AdRemover, had more than 10 million people using it, and it was discovered that in total, they were all downloaded a combined 20 million times.

Along with AdRemover, uBlock Plus, Adblock Pro, HD for YouTube and Webutation, were not what they appeared to be.

Once downloaded, the malware made it so that the browser would do whatever the command-center server ordered it to do. They were all connecting to the same command server and the result of it all was that your browser’s behavior could have been affected in a variety of different ways as well as have its movements tracked and recorded.

There’s a reason they were popular

A big reason for why the malware reached so many was that they were designed to have the appearance of legitimate extensions. Their code is very similar to actual, non-malware ad-blockers, but with some small tweaks that allow it to carry out its alternative mission.

The bad code is hidden inside a javascript library known as jQuery, making it even more difficult to detect. Considering the Chrome Web Store does not have particularly intense security also helps them slip through.

To ensure they are downloaded by as many people as possible when submitted to the Chrome Web Store, the authors use keyword spam in order to help them rise up the rankings to be seen by more eyes.

What if I downloaded one of the extensions?

Google removed the extensions from its store once it learned of the problem, and the extensions themselves have since been disabled on Chrome. Therefore, if you happened to install one of the five malicious ad-blockers, they can no longer do any harm. You should still delete them, though.  Here’s how:

1. Open up Google Chrome, click on the three vertical dots to open up a drop-down menu with options
2. Hover over “More tools” and when the window opens up, select “Extensions”
3. Find the extension you want to remove and click to do so
4. Confirm your choice by clicking “Remove”

Going forward, there is no easy way to determine whether or not an extension you want to download is legitimate. The best you can do is look into them, and their authors, to determine whether or not they can be trusted.

Speaking of Google, there are games and hidden tricks within its search bar

Fortunately, tech companies have a really good sense of humor. That is, they do if you know insider tricks like these 10 that we’re about to share with you.

Tags: Google, Google Chrome, internet, malware, security, YouTube