{"id":70607,"date":"2017-03-22T12:22:06","date_gmt":"2017-03-22T19:22:06","guid":{"rendered":"https:\/\/securingtomorrow.mcafee.com\/?p=70607"},"modified":"2025-08-14T07:14:53","modified_gmt":"2025-08-14T14:14:53","slug":"cybercriminals-learn-love-extensions-like-toolbars-recent-targeted-attacks","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/internet-security\/cybercriminals-learn-love-extensions-like-toolbars-recent-targeted-attacks\/","title":{"rendered":"Cybercriminals Learn to Love Extensions like Toolbars in Targeted Attacks"},"content":{"rendered":"

In the late 90s and early 2000s, most web browsers came with small, add-on programs to enhance browsing. Most of these programs were toolbars, which added functionality like search, bookmark management, local weather forecast and more in an easy to access area of the browser. All-in-all, they were harmless, albeit annoying. That is no longer the case. Ask.com, purveyor of the somewhat well-known Ask.com toolbar, has fallen victim to two very specific and targeted attacks.<\/p>\n

The first attack, according to BleepingComputer.com<\/a>, took place at the end of October. Third-party security vendors detected the attack and alerted the toolbar\u2019s creator, Ask Partner Network (APN). APN quickly flushed the intruders out of their network, but only temporarily. The cybercriminals returned in December, specifically re-infecting the Ask.com toolbar with potentially unwanted programs.<\/p>\n

So why are these small, innocuous and potentially unwanted programs<\/a> (PUPs) bad for end users? Simple: they offer cybercriminals more opportunities to compromise networks and users. They, in the parlance of the cybersecurity industry, expand the attack surface for hackers.<\/p>\n

The cybercriminals responsible for this attack managed to compromise APN\u2019s network at least twice. By doing so, they were able to take advantage of the company\u2019s digital certificates\u2014essentially little strips of code proving APN is who they say they are\u2014to push malicious updates to end users. These strips of code essentially act as an I.D. card for companies, allowing them to issue trusted, verified updates for their programs to end users.<\/p>\n

Compromised digital certificates can cause a lot of damage<\/a>. In this case, cybercriminals used the certificates to trick end users into updating their Ask.com toolbar. By doing so, they unknowingly downloaded a corrupted file that enabled the attackers to both unpack a Remote Access Tool\/Trojan (RAT<\/a>) and steal credentials that would allow them to target other computers on the network.<\/p>\n

The good news here is that the attack appears to be highly manual in nature. The security report even details typos in the attacker\u2019s code, and suggests that a human\u2014not an automated bot\u2014may be issuing the attack in real-time. This means the attack is slow-moving and unlikely to hit a lot of users at once, giving security firms the time they need to detect the attack. This does not, however, mean it\u2019s impossible for crooks to pull off.<\/p>\n

Tips to Protect Your Devices<\/h2>\n

To head off this potential exploit and protect your devices, follow these tips:<\/p>\n