0

I use an Apple eMac desktop computer. I formerly used Safari as my main browser. I migrated to Chrome as it is integrated with Google products. I use Google Drive very extensively as my main repository for all my files.

A couple of days ago, I experienced the attack from two viruses posing as legitimate extensions of Chrome. They are "Daily Mail Tab" and "Smart Package Tracker." They popped up all the time at completely irrelevant times, rendering my Chrome browsing really painful. I deleted Chrome from my eMac. And, I went back to Safari. And, for the time being everything is OK.

However, I am concerned that given that Chrome was compromised that Google Drive could be too.

Thus, I am considering moving my files from Google Drive to iCloud. Would that make my file archiving more secure?

Or, could I consider reinstalling Chrome and use it again as my main browser?

  • 4
    What do you mean that these were 'viruses'? We're they removed by Google? What permissions did you grant them? When you install an extension it tells you what permissions the extension is requesting before you can add it. That will tell you what it had access to and might have messed with. – Daisetsu Mar 25 at 4:55
  • 4
    What does Google Drive being compromised mean? – forest Mar 25 at 5:02
  • "Daily Mail Tab" and "Smart Package Tracker" were not removed by Google. They leveraged google's Chrome somehow and made it look like natural extension. I did not consciously install any of them and did not grant them any permission or anything. As far as "compromised" I am not sure how to use a better word... maybe unsafe, unsecure, even corrupted may also be explanatory. Although, one could in turn ask me to define any of those terms. Hopefully, the meaning is clear enough for facilitating an answer to my question. – Sympa Mar 25 at 15:58
  • 1
    If your browser is heavily compromised, you won't be able to trust anything you do with that browser. It might track everything you do, collect every password you enter and send it to the attacker, browse to pages and simulate actions (posts, likes, payments), upload malicious files to your accounts, etc. Of course formatting and reinstalling everything will remove the infection, but not the possible effect it had on the accounts you were logged in while infected. You need to check those accounts too. – reed Mar 29 at 16:53
1

Former Apple Inc. Genius Bar Technician here. Browser extensions are one of the many forms of malicious virus software that are sneaky, but common. People just don't think Google's Chrome would allow unethical people in, but it happens.

In Apple stores, they have technicians use Malwarebytes with their customers to remove malicious software. It's free (you don't need the premium version) and it's available for Mac and PC. I'd even do a time machine restore to before you installed these extensions, if you have one. Uninstall Chrome for sure. Once you're sure you've eliminated all the risky software, re-download Chrome and reset it to default settings. Possibly even changing your Google Drive's password and putting on 2-step auth.

This isn't a guaranteed method, but this is a good start for troubleshooting that is followed by Apple techs.

  • 2
    This is great information but I don't see how it directly answers the question, "Is my Google Drive still secure if Chrome was heavily compromised?" – dwizum Mar 29 at 16:39
  • Indirectly, I said "Browser extensions are one of the many forms of malicious virus software". This applies the assumption it is compromised. Then I provide simple troubleshooting steps to begin. With the information presented, we can only assume it's compromised unless more information is given or we, ourselves, are the hacker. – bs.gk Mar 29 at 19:43
2

From my point of view there are two things to consider. First, how did these extensions get installed on your computer in the first place. Second, if these are malicious what information could they have accessed.

I can't speculate how the extensions were installed, but they didn't just come bundled with the official version of Chrome. They had to get onto the machine somehow, possibly from another compromised program or from something you installed not knowing these were bundled with.

As for what information they could access, there is pretty good sand boxing within Chrome. It's very unlikely the plugins were able to access the disk contents on your computers, which is a good thing. They can however see information transmitted to/from websites. I'm not sure exactly how chrome stores session data for google drive. I would guess this is locked down pretty tightly given Google has control of the code running both server side and client side. I would gets session data was safe from these extensions but I can't say for sure. Regardless I would recommend changing your password for google drive and enabling 2 factor authentication (if its not enabled). Personally I like the Authy app for 2 factor (but there are other "TOTP" apps).

Finally, the security between Google Drive and iCloud is going to be similar. I don't think changing provides is going to provide any direct benefit. The main difference is with provides is the integration offered by each service and the devices you use. iCloud implements a useful 2 factor authentication workflow that prompts you to approve new devices/logins from an existing (approved) iPhone/Mac/iPad. In practice this seems to work well for me and is easier that launching an app and typing a code in before it expires.

1

If you haven't already, you need to enable Multi-Factor Authentication on your Google account immediately. Then immediately change your Google account password to a new, strong password.

Likewise, change your password, and if possible enable Multi-Factor Authentication, for every account on every service you accessed while your browser was compromised.

As others have commented, once you've re-installed Chrome and disabled the malicious extensions you probably don't have the persistent threat on your machine anymore. If you really want to be sure, you need to nuke it from orbit: wipe the entire machine and reinstall everything, from the operating system up. That may be painful, and it may be overkill in this specific case, but in many other cases it's the only right answer.

It is unlikely that there is a persistent threat inside the Google Drive web servers, but it's much more likely that the malicious software may have left files inside your Google Drive account that you don't want, or that might be malicious. Go through all the files you have there and remove anything that you don't need.

It is more likely that the malicious software captured information from your machine while it was installed. This could definitely include passwords (which is why you need to change your passwords, see above), but can also include other sensitive information, especially if you accessed that sensitive information while the malware was present. Unfortunately, it's very difficult to determine after the fact what may have been accessed if you didn't have comprehensive instrumentation and logging in place beforehand.

However, none of this addresses the real vulnerability: How did those malicious extensions get installed in the first place? If someone tricked you into installing software that did bad things to you, how can you prevent that from happening in the future? At the end of the day, no amount of software security can protect us from ourselves: we still need to make wise decisions about what software we choose to allow to run. You seem to have decided that Google Chrome is at fault here, and that's a worrying conclusion. Chrome is almost certainly not the problem. Even the malicious extension is not the real problem. The real problem is whatever caused that malicious software to be installed in the first place, and whatever user clicked "OK" when asked to confirm whether to install it.

  • Thanks for a really cool answer. Ultimately my issue is not only about security it is also about being completely swamped by the Google adtext complex. I can't use many of my favorite websites anymore. That is why I am getting away from Google related products as much as I can (except for Google drive). You can read all the measures I have already taken in this regard within my own answer. In any case, thanks for a great contribution. – Sympa Mar 29 at 17:03
  • @Sympa: I'm sympathetic to that but I think you'll find that Google is just one of many sources of problems in this case. You might check out the Privacy Badger extension (for either Firefox or Chrome). – Daniel Pryden Mar 29 at 17:11
  • Thanks, I really appreciate your insight on this. – Sympa Mar 29 at 17:12
0

Installing an extension you don't like and compromising your system are different things. Just because the extensions were annoying doesn't mean they hacked your Google account.

If they did somehow get your Google account information, you need to change your password for the Google services. Deleting Chrome or the extensions and cleaning your computer with anti virus or malware software wouldn't stop someone from logging into your Google account if they have the password. The only thing that would stop someone who already has the password is changing it.

  • At this stage, it is very likely they have my gmail. But, there is no known way to me how they would have my google password (which has a pretty secured structure... not something you are likely to just guess punching at a computer for 6 hours straight). Given that, I gather my Google Drive is still as secure as it was before. – Sympa Mar 26 at 0:35
  • @Symba: You say "there is no known way to me how they would have my Google password". If they were running software on the browser where you ever typed that password, then you should assume that they have the password. It doesn't matter how strong the password was, since they were potentially able to observe you typing it in! – Daniel Pryden Mar 29 at 16:59
0

I thought I would share what I eventually did based on your collective answers and additional research I had done. I decided to escape the google-ad text complex as much as possible. So, here are the actions I have taken:

a) I deleted Chrome for good and purposefully decided to not reinstall it. b) I actually purchased Malwarebytes. And, I run it at the end of every day session. c) I installed Mozilla Firefox. That will be my main browser going forward. It is safer than Chrome, and outside google-ad text complex. d) I got Adblock Plus to reduce the amount of adds, pop ups, etc. that were coming through big time through Chrome. Many of the websites I use (weather forecast in particular) became unusable. e) I now use duckduckgo as my main search engine instead of google. f) I am very seriously considering purchasing private and much safer email systems. I am considering Proton, Lavabit, Countermail, Fastmail, and others. Any recommendation on those would be most welcome.

I am still within google's universe on a couple of counts: 1) I am still using gmail as my main email. But, as indicated above that may be temporary. 2) After all I am still using Google Drive to archive all my files. From none of you, did I get that it was really worth the trouble to move them to the iCloud. And, I think with the Google Drive I would have much better access to my files through any computer in the world. I trust the iCloud is only accessible on Apple computers and appliances.

I invite anyone to suggest improvement to my existing strategy.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.