Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: friGate Light

CRITICAL RISKRemoved from Chrome Web Store

friGate Light

ID: mdnmhbnbebabimcjggckeoibchhckemm

Could be malicious

Extension Info & Metadata

Status

Removed

Version

2.68

Size

1.61 MB

Rating

4.4/5

Reviews

3,002

Users

570,846

Type

Extension

Updated

May 19, 2020

Publisher Contextual Analysis

Author: http://fri-gate.orgView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

1,129,246

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Accelerates access to websites. Encrypts traffic.

Extension helps to go to blocked websites, encrypts the traffic, accelerates website access. Supports TOR (.onion) sites and EmerDNS friGate Light encrypts your traffic and routes it through our secure VPN. No one will be able to identify, track you or sniff your traffic. friGate is a Chrome/Firefox extension. It is an advanced analog of ZenMate, Stealthy, Hola and Browsec. friGate extension anonymously handles personal or sensitive user data. These data include: web browsing activity. The data is used to determine the availability of the site that the user is currently accessing. Then, based on this data, the extension enables or disables the proxy for this site.

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical4

High5

Medium0

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
2.68 Code review	9

Extension Version	Code Review Findings
2.68	9

Files with findings

5 distinct paths — top paths by unique finding count:

background.js3
js/background.js2
js/profiler.js2
js/s2.js1
sb.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Network Interception	critical	background.js (line 956)	The extension sends the user's unique uid, IP address, proxy offset/state, and serial counter to a remote API endpoint via POST on every update cycle. The response is XXTEA-encrypted with the uid as key, and upon decr…	2.68
2	Network Interception	critical	background.js (line 89)	The extension installs a system-wide proxy (friproxy.biz) and attaches blocking webRequest listeners to all main_frame and XHR traffic. The proxy server list and authentication credentials are remotely updatable via t…	2.68
3	Obfuscation	critical	js/profiler.js (line 9)	Critical obfuscation: the string 'constructor' is assembled from char codes to avoid static string detection, then used to access Promise.constructor (the Function constructor) to execute arbitrary strings as code. Th…	2.68
4	Remote Code Loading	critical	js/profiler.js (line 1)	The profiler fetches a base64-encoded config from fri-gate.org/config.txt, extracts a list of remote URLs, POSTs base64-encoded extension metadata (manifest + ID) to a randomly selected URL with withCredentials:true, …	2.68
5	Code Injection	high	background.js (line 924)	The extension fetches a server-controlled `trec` (tab record) dataset and `dataRep` text-replacement rules from fri-gate.org. These are then sent as messages to matching content scripts via chrome.tabs.sendMessage, wh…	2.68
6	Code Injection	high	js/s2.js (line 130)	This content script receives server-controlled text replacement rules (regex + replacement string pairs) from the background page and applies them by directly overwriting document.body.innerHTML on every matching page…	2.68
7	Network Interception	high	js/background.js (line 5844)	The background script registers a message listener that accepts a FETCH_TEXT message type and proxies arbitrary fetch() calls on behalf of any content script — with the full set of extension permissions and bypassing …	2.68
8	Unauthorized Data Collection	high	js/background.js (line 5639)	The extension fetches affiliate redirect rules from priceneon.com (with Firebase as fallback) and uses chrome.webRequest.onBeforeRequest with blocking mode to silently redirect AliExpress navigation requests to affili…	2.68
9	Unauthorized Data Collection	high	sb.js (line 781)	The bundled Yandex Sovetnik affiliate module uses chrome.cookies.getAllCookieStores and chrome.cookies.get/set to read and write browser cookies for arbitrary URLs. This cookie access is used to manage affiliate attri…	2.68

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


fri-gate.org	//	http://fri-gate.org/\
fri-gate.org	-	http://fri-gate.org\
forum.fri-gate.org	//	http://forum.fri-gate.org/\
fri-gate.org	/update/	http://fri-gate.org/update\
developers.google.com	/speed/pagespeed//	https://developers.google.com/speed/pagespeed/\
fri-gate.org	/ru//	http://fri-gate.org/ru/\
fri-gate.org	/ru/_lang__ru.html/	http://fri-gate.org/ru/_lang__ru.html\
fri-gate.org	/ru/update/	http://fri-gate.org/ru/update\
fri-gate.org	/uninstall	https://fri-gate.org/uninstall
apigo.fri-gate	-	https://apigo.fri-gate

Showing 1 to 10 of 90 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


8.8.8.8	IPv4	-
188.165.30.217	IPv4	-
178.32.113.122	IPv4	-

2.2 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Теперь ещ�� и с вируснёй - спасибо!

КБ

Кибер Бобёр·29 Dec 2020

Это расширение -- вредоносное ПО. https://habr.com/ru/company/yandex/blog/534586/

Roman Zabaluev·29 Dec 2020

Это расшире��ие -- вредоносное ПО. https://habr.com/ru/company/yandex/blog/534586/

Roman Zabaluev·

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

friGate Light

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version9

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews