1

So... Tired me was browsing through Ikea's website this morning and tried to use one of their visualisation tool. Got an error message saying that I was not running the lastest version of Adobe Flash. Reluctant at first because I thought about their security issue a while ago, I still went ahead thinking "meh, they must have fixed it by now". I went to the chrome store, looked for a flash player extension and as a freakin dumbass, took the first one I saw without taking a look at the publisher and the few number of reviews for such an extension. As soon as it was installed, it opened a page for a music store out of nowhere. This is when I knew I f*cked up ...

I've immediately removed the extension. I uninstalled Brave this evening when coming back home, deleted all remaining brave folders on my ssd and performed a full system scan with Avast and a threat scan with Malwarebytes (both free versions). Nothing came out. I've also checked for any weird process running (via the task manager) and found nothing special. Should I be worried and is there anything else I should do?

The extension in question was Flash Player, offered by flash player... Yes I know, I should have seen that...

Thank you, Oberom

Improve this question
3
  • Had you kept the actual extension files you installed, it could be examined to see if it only opened ad pages or if it did more nefarious things. In any case, it should not have been able to infect your computer.
    – Ángel
    Commented Jun 7, 2019 at 23:25
  • Thank you Angel for your answer. Not even with a keylogger?
    – Oberom
    Commented Jun 7, 2019 at 23:42
  • Extensions are quite limited in what they can do. Without any vulnerabilities, they should not be able to affect anything outside the browser.
    – multithr3at3d
    Commented Jun 8, 2019 at 15:57

1 Answer 1

Reset to default
0

I assume the extension you installed was https://chrome.google.com/webstore/detail/flash-player/ooonkoejkmhiacbhhkdgfeemioceapbh

It is named "Flash Player" and states it's "Offered by: flash player". I checked version 1.1.3. On install it opens https://themusic[.]io/

The requested permissions are:

  • Read and change all your data on the websites you visit
  • Manage your downloads

The music page it opens because on install it opens https://flplayer[.]net/welcome, which redirects there. On uninstall it opens https://flplayer[.]net/uninstall which simply says "Sorry if we don't fit your needs See you next time!"

Another interesting page is http://flplayer[.]net/config.php, from which it fetches a bunch of configuration options. This includes a value named analyticsId ("UA-117750115-1"), which seems an identifier for Google Analytics (seems unused), and a mixpanelId (58410f8ab299e0eb2b736f6e233eda37) which is used if extendedAnalytics was set.

Another weird feature it has is that when rendering embed box, if the protocol is https it gives the urls through the page https://greatapptst[.]com/redirect.php?url=<url> (which proxies anything)

As the browser itself mediates what the extension can do, I do not think it could have escaped to install a system program (no, not a keylogger, either). At most, it could have published some information about your browser and pages. Specially about the pages you visited after installing it. But apparently you uninstalled it immediately, so even in that case there's not much it could have harvested. If you had, I

Improve this answer
1
  • Thank you for your time Angel. I guess I'm in the clear. I should be more careful in the future.
    – Oberom
    Commented Jun 9, 2019 at 13:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .