Steam users are being warned to be on their guard after criminals created rogue browser add-ons designed to steal from the accounts of video games fans.
Security researcher Bart Blaze describes how a Steam user has created a number of Chrome browser extensions for online first-person shooter “Counter-Strike: Global Offensive” (also known as CS:GO).
Don’t be in too much of a hurry to install the Chrome extensions, however, which have names like CSGODouble Theme Changer, CS:GO Double Withdraw Helper, Csgodouble AutoGambling Bot and Improved CSGODouble.
With the extensions installed in your Chrome browser, your Steam inventory items will be stolen, and items you attempt to trade with other Steam users will actually end up with the scammer behind the extensions instead.
Bart Blaze says that examination of the rogue Chrome extensions’ code reveals that the userid of the Steam user that will receive the stolen goods, and has linked them with a user calling themselves “Delta”.
The good news is that it is fairly simple to uninstall an unwanted Chrome extensions:
To remove an extension from Google Chrome:
- On your browser, click menu .
- Select More tools > Extensions.
- On the extension you want to remove, click Remove from Chrome .
- A notice to remove the extension will appear. Click Remove.
Remember, the fact that an add-on or extension has been made available for your browser is no guarantee that it hasn’t been coded with malice in mind.
'Bart Blaze says that examination of the rogue Chrome extensions' code reveals that the userid of the Steam user that will receive the stolen goods, and has linked them with a user calling themselves "Delta".'
Well that was stupid. It doesn't even seem obfuscated (maybe they ran a beautifier on it ?). Certainly this isn't an experienced programmer who is behind this. I guess that's a good thing.
'Remember, the fact that an add-on or extension has been made available for your browser is no guarantee that it hasn't been coded with malice in mind.'
That's worth repeating: there is no guarantee that software hasn't been programmed in a malicious way; even software that might normally be legit can be compromised (whether deliberately by the developer or by a third party isn't relevant in the sense of it is no longer as safe as it might have been … and this could simply be a bug!).
Hey Coyote,
There was indeed no obfuscation whatsoever. The part of the script you see in the screenshot was beautified by my, however.
I'm pretty sure that at some point (if not already, I'll be checking to see if I can find more soon), those will come up as well.
Cheers
Bart
@bartblaze
The new Steamguard Sytem should not allow unidentified trades since the mobile 2-Step authentication