Security Alert: Confirmed Malware
MySocialShortcut
ID: dffodcokjhgglfakabaogimnpblkhdjj
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- http://mysocialshortcut.comView Profile
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
Find the best, FREE way to access your social networks with this Chrome New Tab Extension.
Discover the easy way to access your social media networks, plus update your new tab page search to MyWay.com. Comes with daily content to show you news, weather and more in a new Chrome window! By installing this extension, you agree to the End User License Agreement and Privacy Policy (https://eula.askapplications.com/eula/) This new tab extension is a product of Ask Applications, Inc. Permissions Requested : "Read and change your data on a number of websites" For our product to work, we require access to the websites we own and manage. "Replace the page you see when opening a new tab" This allows us to show you our product - new tab page with free web search. "Read your browsing history" This allows us to tailor product specific content or offers towards relevant information. "Display notifications" This allows us the option to send you updates or additional product offers once you’ve already enjoyed the free product. "Manage your apps, extensions, and themes" This allows us to help you disable or remove this product and also understand whether we are able to provide the best experience. Release Log: 13.962 : Optimizes the sync of this extension between Chrome profiles.
This code executes arbitrary JavaScript stored in `_this.remoteScript` directly into the active tab at `document_start`. Earlier in the same file, `_this.remoteScript` is populated by downloading content from a remotely controlled URL, which creates a classic remote-code-loading pattern that can be repointed after installation.
this.initRemoteScript(extensionConfig);return function(tab) { ask.apps.ul.fireInfoEvent(extensionConfig.buildVars.unifiedLoggingUrl, { message: "browser-action-clicked", topic: "browser-action" }, extensionConfig, "BAB") .catch(Logger.log); if (_this.handleSubsequentBabClicks(tab, getConnection)) return; BabClickHandler.getInjectionDetails(tab, extensionConfig.buildVars.newTabURL) .then(function(injectDetailsArr) { var remoteScriptInjectionDetails = { code: _this.remoteScript, runAt: "document_start" }; if (injectDetailsArr.length && injectDetailsArr[0].frameId) { remoteScriptInjectionDetails.frameId = injectDetailsArr[0].frameId; } return Promise.all([ Util.injectScriptsSequentially(tab.id, injectDetailsArr, extensionConfig, { message: "failed-inject-babContentScript lastError", topic: "browser-action" }), new Promise(function(resolve) { chrome.tabs.executeScript(tab.id, remoteScriptInjectionDetails, resolve); }) ]); })The extension assembles its tracking/install identity by harvesting data from multiple places in priority order: sync storage, domain cookies, localStorage on a remote page, and URL fragments from open tabs. This is an aggressive data-recovery routine for partner IDs, install metadata, and pixel URLs, and it persists even when one source fails.
function getToolbarData(localStorageUrl, cookieDomain, timeout, defaultToolbarData, config) { var syncStorageAPIFailed = false; return Dlp.getDataFromSyncStorage() .catch(function(rejectionObj) { if (rejectionObj.name !== Dlp.syncErrorValueNotSet) { syncStorageAPIFailed = true; } Logger.log( "Background: getToolbarData: Fail over to cookies, since fetching DLP data from sync storage failed." ); return Dlp.getDataFromCookies(cookieDomain); }) .catch(function(cookiesErr) { Logger.log("Background: getToolbarData: Failed to get DLP data from COOKIES: " + cookiesErr); Logger.log( "Background: getToolbarData: Fail over to LOCAL STORAGE, since fetching DLP data from cookies failed." ); return Dlp.getDataFromLocalStorage({ url: localStorageUrl, timeout: timeout, keys: ["toolbarData"] }, defaultToolbarData, config); }) .catch(function(rejectionObj) { if (!rejectionObj.hasOwnProperty("dataSource")) { Logger.log("Background: getToolbarData: Failed to get DLP data from LOCAL STORAGE: " + rejectionObj); Logger.log( "Background: getToolbarData: Fail over to URL HASH values, since fetching DLP data from local storage failed." ); return Dlp.getParamsFromHash(defaultToolbarData);This extension exposes a code path that can uninstall itself via `chrome.management.uninstallSelf()`. In this codebase, management methods are surfaced through the `webtooltab` messaging bridge to pages hosted on the vendor's domains, so a remote page can drive privileged extension-management actions.
uninstall: function(customUninstallOptions) { var uninstall = function() { return new Promise(function(resolve, reject) { ask.apps.ul.fireInfoEvent(config.buildVars.unifiedLoggingUrl, { message: "on-before", topic: "uninstallAPI" }, config, null); new Promise(function(resolve, reject) { return window.setTimeout(resolve, 50); }) .then(function() { try { var uninstallOptions = { showConfirmDialog: !!customUninstallOptions && customUninstallOptions .showConfirmDialog || false }; Logger.log("webtooltabAPI: uninstall - uninstall options: " + JSON.stringify( uninstallOptions)); var result = chrome.management.uninstallSelf(uninstallOptions); if (result) { return result.catch(reject); } } catch (error) {The extension enumerates other installed extensions, collects their IDs, versions, enabled state, and specific overlap with monitored permissions. This is surveillance of competing/default-controlling extensions and is later tied to telemetry about whether this extension 'lost' or 'took' default status.
return new Promise(function(resolve) { chrome.management.getAll(function(extensionInfos) { var watchExtensions = getEmptyWatchExtensionsObject(); extensionInfos .filter(function(eInfo) { return eInfo.type === "extension" && eInfo.id !== chrome.runtime.id && Util.checkOverlap(eInfo.permissions, WatchExtensionsHandler.permissionsToMonitor); }) .forEach(function(eInfo) { WatchExtensionsHandler.permissionsToMonitor .filter(function(monitorPermission) { return ~eInfo.permissions.indexOf(monitorPermission); }) .forEach(function(permission) { watchExtensions[permission].stackOfExtensions.push({ id: eInfo.id, version: eInfo.version, enabled: eInfo.enabled }); }); });This code injects a full-page, extremely high z-index iframe over the current site and passes the current tab title and URL into the remote iframe URL. Combined with the remote BAB configuration machinery, this creates a server-controlled overlay channel that can impersonate site UI, run ads, or present phishing prompts on arbitrary pages.
} else if (modalWindowType === "iframe") { if (args.replaceableParams) { args.replaceableParams.tabtitle = window.document.title; args.replaceableParams.taburl = window.document.location.href; _this.contentIframe.src = TextTemplate.parse(args.iframeUrl, args.replaceableParams); } else { _this.contentIframe.src = args.iframeUrl; }}};var contentIframeId = "bab-content-iframe";var contentDivId = "bab-content-div";if (!document || !document.body) { return Promise.reject(new Error("missing document and/or body blocked content injection"));}var existingContentIframe = document.getElementById(contentIframeId);if (!existingContentIframe) { _this.modalConfig = modalConfig; _this.contentDiv = document.createElement("div"); _this.contentDiv.id = contentDivId; _this.contentDiv.style.cssText = _this.applyModalConfigOnCSS(_this.contentDivCSS); _this.contentIframe = document.createElement("iframe"); _this.contentIframe.id = contentIframeId; _this.contentIframe.name = "bab-content"; _this.contentIframe.frameBorder = "0"; _this.contentIframe.scrolling = "no"; _this.contentIframe.style.cssText += ";width:99%;\n max-width: 100%; height:99%;\n overflow: hidden; background-color: transparent; z-index: 9999999999; display: hidden;";When injected into vendor-controlled pages, this script discloses a stable toolbar ID, partner identifiers, and install date to page JavaScript and also drops detection cookies into the page context. That enables cross-page install tracking and lets the remote site fingerprint whether the extension is present and which affiliate/install it belongs to.
function getCommands(configData) { return { GET_INFO: function(reply) { reply({ toolbarId: configData.state.toolbarData.toolbarId, partnerId: configData.state.toolbarData.partnerId, partnerSubId: configData.state.toolbarData.partnerSubId, installDate: configData.state.toolbarData.installDate, toolbarVersion: configData.buildVars.version, toolbarBuildDate: configData.buildVars.buildDate, }); } };}function setInstalledCookies(toolbarId) { var hourFromNow = new Date(Date.now() + (1 * 60 * 60 * 1000)) .toUTCString(); document.cookie = "mindsparktb_" + toolbarId + "=true; expires=" + hourFromNow + "; path=/"; document.cookie = "mindsparktbsupport_" + toolbarId + "=true; expires=" + hourFromNow + "; path=/";}By severity
Versions scanned
Showing 2 of 4 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 13.962.19.39225 | 6 |
| 13.958.19.40306 | 13 |
Files with findings
12 distinct paths — top paths by unique finding count:
- js/background.js4
- js/babTypeInjectionScript.js2
- js/dlp.js2
- js/extensionDetect.js2
- js/watchExtensionsHandler.js2
- js/babAPI.js1
- js/babContentScriptAPI.js1
- js/babRemoteConfigProcessor.js1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.