Security Alert: Confirmed Malware
InternetSpeedUtility
ID: bdmpgbmbdllbpdidgdcliliimmkeocin
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- http://internetspeedutility.netView Profile
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
Test upload and download speeds. Get FREE tips on how to boost connectivity and more with this Chrome New Tab Extension.
Get InternetSpeedUtility, test upload and download speeds, plus update your new tab page search to MyWay.com. Comes with daily content to show you news, weather and more in a new Chrome window! By installing this extension, you agree to the End User License Agreement and Privacy Policy (https://eula.askapplications.com/eula/) This new tab extension is a product of Ask Applications, Inc. Permissions Requested "Read and change your data on a number of websites" For our product to work, we require access to the websites we own and manage. "Replace the page you see when opening a new tab" This allows us to show you our product - new tab page with free web search. "Read your browsing history" This allows us to tailor product specific content or offers towards relevant information. "Display notifications" This allows us the option to send you updates or additional product offers once you’ve already enjoyed the free product. "Manage your apps, extensions, and themes" This allows us to help you disable or remove this product and also understand whether we are able to provide the best experience. Release Notes: 13.962 : Optimizes the sync of this extension between Chrome profiles.
The background page creates a hidden iframe to a remote web domain and waits for a content-script connection from that page so it can read back storage contents. This is a covert cross-origin collection pattern: the extension uses its privileged context to pull install/tracking data from a remote site without user interaction.
function openDLPDomain(url, getLocalStorage, parseLocalStorage, resolve, reject) { var bgifr = document.createElement("iframe"); bgifr.setAttribute("id", "bgifr"); bgifr.setAttribute("src", url); document.body.appendChild(bgifr); var _this = this; _this.defer(function() { var bgifr = document.getElementById("bgifr"); document.body.removeChild(bgifr); }); var onConnect = function(port) { if (!port.sender.hasOwnProperty("tab")) { chrome.runtime.onConnect.removeListener(onConnect); _this.defer(function() { port.disconnect(); }); getLocalStorage(port, _this.keys) .then(function(response) { _this.cleanUp(); if (!response) { Logger.log("dlpHelper: openDLPDomain: FAIL: no response"); reject(new Error("dlpHelper: openDLPDomain: FAILED to find DLP data in local storage")); } Logger.log("dlpHelper: openDLPDomain: SUCCESS: response looked like: " + JSON.stringify(response)); resolve(parseLocalStorage(response)); })This code iterates over all tabs and frames, scrapes tracking parameters from URL hashes and query strings, and converts them into install-pixel and secondary-offer URLs. Reading campaign identifiers from arbitrary open tabs and reusing them for telemetry/redirect logic is a strong indicator of install attribution tracking beyond the immediate extension UI.
frameDetails.some(function(frame) { var url = new URL(frame.url); var urlHash = url.hash; if (urlHash && (ask.apps.background.parentProductHashMatchRegEx.test(urlHash) || ask .apps.background.extensionDetectContentScriptMatchRegEx.test(frame.url))) { var mappedParams = getParamsFromString(url.hash.slice(1), params.hash.mapped, {}); var calculatedParams = {}; if (mappedParams.partnerId) { var partnerId = GlobalPartnerIdFactory.parse(mappedParams.partnerId); calculatedParams.cobrand = partnerId.getCobrand(); calculatedParams.campaign = partnerId.getCampaign(); calculatedParams.dlput = partnerId.getTrack(); } var unmappedParams = getParamsFromString(url.hash.slice(1), params.hash .unmapped, { soep: "index.jhtml" }); var urlParams = getParamsFromString(url.search.slice(1), params.searchParams .unmapped, { hostname: url.hostname }); var isDlp2 = !!unmappedParams.sgn; var pixelUrl = isDlp2 ? ask.apps.background.config.buildVars.dlpTemplates.pixelUrl.dlp2 : ask.apps.background.config.buildVars.dlpTemplates.pixelUrl.dlp1; var secondaryOfferUrl = ask.apps.background.config.buildVars.dlpTemplates .secondaryOfferUrl; pixelUrl = replaceTemplatePlaceholders(pixelUrl, mappedParams, unmappedParams, urlParams, calculatedParams); secondaryOfferUrl = replaceTemplatePlaceholders(secondaryOfferUrl, mappedParams, unmappedParams, urlParams, calculatedParams);When a visited page contains a matching install hash, the extension sends a `ToolbarDetect` beacon tied to the extension's toolbar ID and then forcibly redirects the active tab into the extension's new-tab page. This couples user navigation with remote install attribution and redirection logic, a pattern commonly seen in aggressive toolbar/adware ecosystems.
frameDetails.some(function(frame) { var url = new URL(frame.url); if (url.hash) { var hashParams_1 = ExtensionDetectWithHash.extractHashParams(url.hash); if (!ask.apps.background.parentProductHashMatchRegEx.test(url.hash)) return false; var dlpEndpoint_1 = ExtensionDetectWithHash.getDLPEndpoint(Util .getTopAndSecondLevelDomainsFromHostName(url.hostname)); ask.apps.background.extensionStateStorage.get() .then(function(state) { ExtensionDetectWithHash.fireToolbarDetect(hashParams_1, state, dlpEndpoint_1); var redirectUrl = PageUtils.appendParams(PageUtils.getNewTabResourceUrl(), [ "rd=alreadyInstalled", "ruid=" + Util.generateToolbarId(), PageUtils.stParamName + "=" + PageUtils.stParamValueTab ]); PageUtils.redirectToUrl(details.tabId, redirectUrl, true) .catch(Logger.warn); });This content script turns remote pages on the extension's controlled new-tab/offer domains into command senders by forwarding `postMessage` payloads to the privileged background page. That creates a web-to-extension bridge where remotely served page content can invoke extension capabilities, which materially increases abuse risk if the page or backend is compromised.
if (extensionState && extensionState.toolbarData.newTabURL) { var currentUrl = new URL(currentUrlStr); var newTabUrl = new URL(extensionState.toolbarData.newTabURL.toLowerCase()); if (currentUrl.hostname === newTabUrl.hostname && currentUrl.pathname === newTabUrl .pathname) { return resolve(); }}return reject(new Error("Invalid webtooltab call: : URL: " + window.location.href +" does not match offer-service URL or the new tab URL"));});});}function handleWebTooltabMessageEvent(e) { if (isWebTooltabMessage(e)) { isValidSource() .then(function() { sendMessage(channel, { name: "webtooltab", data: JSON.parse(e.data) }, commands.webtooltab);The webtooltab API exposed to web pages includes privileged self-management actions such as `chrome.management.uninstallSelf`, with support for suppressing confirmation dialogs via caller-controlled options. In combination with the proxy bridge, remotely hosted pages can directly control lifecycle actions that should normally remain internal to the extension.
uninstall: function(customUninstallOptions) { var uninstall = function() { return new Promise(function(resolve, reject) { ask.apps.ul.fireInfoEvent(config.buildVars.unifiedLoggingUrl, { message: "on-before", topic: "uninstallAPI" }, config, null); new Promise(function(resolve, reject) { return window.setTimeout(resolve, 50); }) .then(function() { try { var uninstallOptions = { showConfirmDialog: !!customUninstallOptions && customUninstallOptions .showConfirmDialog || false }; Logger.log("webtooltabAPI: uninstall - uninstall options: " + JSON.stringify( uninstallOptions)); var result = chrome.management.uninstallSelf(uninstallOptions); if (result) { return result.catch(reject); }The extension uses the powerful `management` permission to enumerate other installed extensions, record their IDs/versions, and determine which ones can override the new tab page. Monitoring competing extensions like this is privacy-invasive and can support anti-competitive behavior or targeted remediation flows.
chrome.management.getAll(function(extensionInfos) { var watchExtensions = getEmptyWatchExtensionsObject(); extensionInfos .filter(function(eInfo) { return eInfo.type === "extension" && eInfo.id !== chrome.runtime.id && Util.checkOverlap(eInfo.permissions, WatchExtensionsHandler.permissionsToMonitor); }) .forEach(function(eInfo) { WatchExtensionsHandler.permissionsToMonitor .filter(function(monitorPermission) { return ~eInfo.permissions.indexOf(monitorPermission); }) .forEach(function(permission) { watchExtensions[permission].stackOfExtensions.push({ id: eInfo.id, version: eInfo.version, enabled: eInfo.enabled }); }); }); Object.keys(watchExtensions) .forEach(function(installedWatchExtensionsKey) { watchExtensions[installedWatchExtensionsKey].isDefault = true; watchExtensions[installedWatchExtensionsKey].stackOfExtensions.push({ id: chrome.runtime.id, version: config.buildVars.version, enabled: trueThe extension schedules recurring background telemetry pings to a remote endpoint and includes stable extension identifiers. The telemetry helper populates these events with toolbar ID and partner identifiers, turning this into a periodic user/device tracking mechanism rather than a purely functional feature.
function startULPing(config) { var alarmName = "livePing"; var minTimeToNextPing = 60000; var interval = config.buildVars.livePing.interval; var lastPing = config.state.lastLivePing; var ping = function() { var eventData = { cwsid: chrome.runtime.id }; apps.ul.fireToolbarActiveEvent(config.buildVars.livePing.url, eventData, config) .then(function(response) { config.state.lastLivePing = Date.now(); background.extensionStateStorage.update(config.state);By severity
Versions scanned
Showing 2 of 4 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 13.962.19.39177 | 13 |
| 13.958.19.40261 | 7 |
Files with findings
14 distinct paths — top paths by unique finding count:
- js/background.js3
- js/dlp.js3
- js/dlpHelper.js2
- js/watchExtensionsHandler.js2
- config/config.json1
- js/babAPI.js1
- js/babTypeInjectionScript.js1
- js/extensionDetect.js1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.