If you downloaded an ad blocker for Google Chrome recently, your browser may not be as secure as you think.
More than 37,000 people downloaded a fake ad blocking extension in the Chrome Web Store over the last two weeks. AdBlock Plus was designed to look exactly like the real Google extension Adblock Plus (spelled with a lowercase b) and was available from September 22 until yesterday, when it was removed.
Aside from the errant capitalization, the only difference between the two programs was that the fake ad blocker was classified as an app rather than an extension.
The hack was first made public by Swift on Security, a Twitter account that comments on online security issues in the voice of Taylor Swift (yes, really). The account, whose admin has not been made public, discovered that the fake extension spammed keywords in order to appear legitimate.
The reviews page for the fake AdBlock Plus noted that installing the extension actually increased the number of browser ads and opened new tabs. A staffer for the real Adblock Plus extension solved the mystery by posting that the capital B version was a spam account and “not the legitimate version of Adblock Plus” (which has been downloaded by over 10 million people).
To determine whether you have the correct ad blocker, go to the Chrome store and make sure your extension is “offered by adblockplus.org.” If not, the company recommends reinstalling the program just to be safe.
Google said in a statement to the Observer that it had pulled the phony extension “within minutes” of being alerted to it.
“We’re always working to improve how we detect malicious extensions, and will continue to update our security protections to help prevent these types of issues in the future,” the statement read.