Jul 19, 2019

Broker sells near-real-time browsing info from unsuspecting victims

At least 8 browser extensions sold extremely sensitive data about their users to a data broker, who then sold access to that data in real time to unknown buyers, according to a report from researcher Sam Jadali.

Why it matters: The broker sold a continuously updated list of what sites users visited, including page titles, location and computer information about the user. That data, viewed in near real time, can severely hamper user privacy and security.

Details: Jadali discovered the following browser extensions feeding data to the broker: Hover Zoom, SpeakIt!, SuperZoom, SaveFrom.net Helper, FairShare Unlock, PanelMeasurement, Branded Surveys and Panel Community Surveys.

  • The extensions range in users from 1 to more than 1 million.
  • The extensions are for Chrome and FireFox, and would have received user permission to observe browsing behaviors on the web when first installed. But Jadali writes that only 4 of those extensions thoroughly explained that browser data would be collected.
  • Jadali is not releasing the name of the data broker.

Threat level: We don’t know that any data was used maliciously. But there’s a clear way that real-time data could be used maliciously.

  • Many sites use temporary links as a security measure. Jadali notes that when an infected machine sent an image file over a chat app, a web link to that image appeared on the broker's page to that image. The link only worked for a very short period of time.
  • A project management service included important information in the page titles, including engineering missteps at 2 major companies.
  • Other sites include critically important information in the web address itself. Links to various airline sites included account holder names.

Go deeper

Biden formally secures Democratic presidential nomination

Joe Biden speaks at Delaware State University's student cente on June 5. Photo: Jim Watson/AFP via Getty Images

Former Vice President Joe Biden became the formal Democratic presidential nominee on Friday evening, per AP.

The big picture: Biden has been the presumptive frontrunner to take on President Trump since Sen. Bernie Sanders suspended his campaign in early April.

Updated 7 hours ago - Politics & Policy

Coronavirus dashboard

Illustration: Sarah Grillo/Axios

  1. Global: Total confirmed cases as of 9 p.m. ET: 6,724.516 — Total deaths: 394,018 — Total recoveries — 2,996,832Map.
  2. U.S.: Total confirmed cases as of 9 p.m. ET: 1,894,753 — Total deaths: 109,042 — Total recoveries: 491,706 — Total tested: 19,231,444Map.
  3. Public health: WHCA president says White House violated social-distancing guidelines to make reporters "a prop" — Jailing practices contribute to spread.
  4. Sports: How coronavirus could reshuffle the sports calendar.
  5. Jobs: Better-than-expected jobs report boosts stock market.
  6. Media: The Athletic lays off 8% of staff, implements company-wide pay cut.

Scoop: German foreign minister to travel to Israel with warning on annexation

Heiko Maas. Photo: Michael Kappeler/picture alliance via Getty Images

German Foreign Minister Heiko Maas is expected to travel to Israel next week to warn that there will be consequences if Israeli leaders move forward with plans to annex parts of the West Bank, Israeli officials and European diplomats tell me.

Why it matters: Israeli and European officials agree that if Israel goes ahead with unilateral annexation, the EU will respond with sanctions.