Source code being injected into every website

Question

I had a client contact me today because a website I developed (that deals with sensitive information) wasn't loading correctly on one computer on Chrome. After poking around for a while it appears to be caused by the underlying source code being manipulated in Chrome. The code injection (a javascript snippet) appears BEFORE any DOM is parsed, and is actually happening to all sites she visits that have a <title> tag (the code is inserted before any <title> text in the code... it isn't parsing the DOM because the insertions are happening even if the <title> string is inside a pre tag or textarea. Given that you can see the injection directly in view-source I'm fairly certain this isn't being injected by a plugin/extension (which I don't believe can modify source code before the DOM is registered). And the fact that it is happening on https sites means I assume it's something installed on the client's computer that's doing the code manipulation.

The injected code (reformatted for readability) is:

function getRandomInt(max) {
    return Math.floor(Math.random() * Math.floor(max));
}

function shuffle(array) {
    var currentIndex = array.length,
        temporaryValue, randomIndex;
    while (0 !== currentIndex) {
        randomIndex = Math.floor(Math.random() * currentIndex);
        currentIndex -= 1;
        temporaryValue = array[currentIndex];
        array[currentIndex] = array[randomIndex];
        array[randomIndex] = temporaryValue;
    }
    return array;
}

var __toUserAgent = window.navigator.userAgent;
Object.defineProperty(window.navigator, "userAgent", {
    get: function () {
        return __toUserAgent + '/b3S2rCM5-8';
    }
});
var testPlugins = [];
for (var s = 0; s < window.navigator.plugins.length; s++) {
    var plg = {
        'name': window.navigator.plugins[s].name,
        'description': window.navigator.plugins[s].description,
        'filename': window.navigator.plugins[s].filename,
    };
    plg[0] = {
        'type': window.navigator.plugins[s][0].type,
        'suffixes': window.navigator.plugins[s][0].suffixes,
        'description': window.navigator.plugins[s][0].description
    };
    testPlugins.push(plg);
}
if ({
        'name': 'VT AudioPlayback',
        'description': 'VT audio playback',
        'filename': 'vtaudioplayback.dll',
        '0': {
            'type': 'application/vt-audio',
            'suffixes': '',
            'description': ''
        }
    }, {
        'name': 'ChanWebPlugin',
        'description': 'Chanw checking plugin',
        'filename': 'chanwebplugin.dll',
        '0': {
            'type': 'application/chan-web',
            'suffixes': '',
            'description': ''
        }
    }) testPlugins.push({
    'name': 'VT AudioPlayback',
    'description': 'VT audio playback',
    'filename': 'vtaudioplayback.dll',
    '0': {
        'type': 'application/vt-audio',
        'suffixes': '',
        'description': ''
    }
}, {
    'name': 'ChanWebPlugin',
    'description': 'Chanw checking plugin',
    'filename': 'chanwebplugin.dll',
    '0': {
        'type': 'application/chan-web',
        'suffixes': '',
        'description': ''
    }
});
testPlugins = shuffle(testPlugins);
Object.defineProperty(window.navigator, "plugins", {
    get: function () {
        return testPlugins;
    },
    enumerable: true,
    configurable: true
});

Basically, it seems to be editing the browser userAgent string slightly and then randomizing an array of plugin details, and then attempting to set the registered plugins on the browser.

Two questions:

1. I don't see how this would actually do any damage, but are there specific security concerns about the JS code being rendered here (we checked her bank's website and the code was being injected there as well)?

2. How is it possible for the underlying source to be changed? I understand JS-powered code injection attacks, but in this case the actual original source appears to have been edited. So html served via https is being changed on the fly (so it looks like the remote server actually sent the code). I was wondering if her Antivirus (AVG) might have been the culprit, but disabling protected temporarily didn't seem to fix it.

3. If AVG didn't cause or prevent the issue, any thoughts on how to prevent this?

Answer 1

tl/dr: It's definitely a plugin doing this, and is almost certainly a privacy-focused plugin that is trying to randomly obfuscate your user agent and plugin list to hide you from sites performing browser fingerprinting. However it is doing it very poorly and I'm dubious that the people who wrote this knew what they were doing. So while there likely isn't a security risk, I'd probably ditch this particular plugin anyway.

Since this is injected into the source of just a single browser there are only two ways it could happen:

1. Compromised browser
2. A plugin/extension

However, it is almost certainly a plugin/extension. You can verify it easily by turning off all the extensions on the browser and seeing if it goes away. I expect this will solve the issue immediately. Turn them back on one-by-one to find the culprit.

Potential Security Concerns

Are there potential security concerns here? Yes and no. The fact that this code seems innocuous doesn't mean it is safe, because there is something injecting code into every website you visit. Without knowing where the code is coming from, who is to say it doesn't turn into a keylogger on your bank website tomorrow?

Most likely though this is a plugin, so the only question is "What plugin is doing this?". If it is a plugin from a reputable company that is doing exactly what it is supposed to be doing (more about that below), then you are probably fine. Injecting code into all websites is actually perfectly normal for plugins, and is why you need to be very careful about installing plugins judiciously, only when necessary, and from entities you trust.

Purpose

Based on your code though, I think we can say a bit more about what this plugin is doing, and so which one may be responsible. As you say, this (poorly) written code is trying to "change" the user agent string and list of plugins. It's important to note though that neither of those things can be changed with Javascript like this, and a plugin author would (probably) know that.

Instead, what this is doing is changing the user agent and list of plugins as reported to JavaScript running on the page. Keep in mind that this would not affect the actual User Agent that the browser reports in requests, nor would it affect the actual plugins running on the tab.

Instead, this is most likely meant to help hide the browser from JavaScript libraries that use browser fingerprinting to track users. User agents and the plugin list are two common items used for browser fingerprinting. Therefore, this is likely the result of a privacy-focused plugin.

I have to say though that this is very poorly executed, for a number of reasons:

1. You hide from fingerprinting with conformity, not randomness. Having a random user agent actually makes you stick out more.
2. Since it only fires on pages with a <title> tag, and not all pages have one, it doesn't protect you everywhere. It's not that hard to inject it in a smarter way that will cover 100% of sites.
3. User agent string and the list of plugins are only a small part of browser fingerprinting, and not necessarily the most important parts. If that is all they are trying to obfuscate then this may not be very effective anyway.
4. The code is just poorly written.

As a result, I might suggest ditching this particular plugin, especially since it is causing usability issues.

Answer 2

The same code as in the question appears on every site I visit. It happens in all browsers I have (Edge, Chrome, Firefox).

Then it occurred to me that I use software from Piriform (distributor of the famous/infamous CCleaner). This software is called Kamo and one thing it does is to mask user metadata that can be collected on the internet by randomizing it.

When I turn "Browser Protection" in Kamo settings off the injected code is removed. Turning it on again and it appears again.

Answer 3

So it's only happening on that one computer, other machines don't see this, correct?

I've seen something similar before and it was a compromised JavaScript remote library call.

If it's only on the one computer, it may be a hosts file issue directing the library call to a compromised site. If it's on all machines, it may be a compromised library itself.

In either case, running the connection through a proxy like Fiddler or Zap should nail it pretty quickly.