All right, hi everyone, so today we're going to talk about research that we've done on the Chrome extension. We researched the threat landscape and the Chrome extension anatomy, and we created the models to detect malicious Chrome extensions. So we are going to talk about the old process that we've done from looking at the threat landscape and to train a model that can detect malicious extensions. Actually we are threat researchers, we consulted with our data scientist Jonathan, which is sitting here. So thanks for Jonathan. So I'm Tal, I'm working at Deep Instinct for the past two and a half years. Prior to Deep Instinct I've been serving in the IDF for seven years. Hi guys, I'm Rui, I've been working with Tal for the last two years and previously I've worked in additional security companies and also in the IDF intelligence as well. So the agenda for today. So first we're going to talk about some background, about browser extensions and why we decided to work on Chrome extension specifically. After that we'll talk about the threat landscape and we will show some example of attacks that have been done using the Chrome extension. And then we will talk about the collection of the data and the creation of the data sets, the sourcing of the data and the ground tools that we were able to set in order to validate the data. And after that we will talk about the model that we created and we will show some three models that we tried and we will show the results and the process that we've done. All right, so let's quickly talk about browser extensions. First of all, what are browser extensions? I mean if we look at the Wikipedia definition we'll see it's a small software module customizing a web browser. Basically whatever we need to do to add functionalities to our browsers, add advanced features we would like to have. And other than that we see a trend today of much more services and companies turning to web based products and we see that our today the browser extensions are exposed to much more standard of data than before. Which obviously makes it an attractive attack surface for hackers and attackers. So why specifically Chrome? Well basically Chrome is the most common browser of the mall. With controlling over 65% of the market as well as other browsers who also support Chrome extensions such as Edge, the new Edge browser and Oprah. Which are all based on the Chromium project. Other than that we can see a Cisco report from 2016 which I mentioned that Chrome extensions are one of the most prevalent sources for data leakage in enterprises. Mostly due to the fact that they are undetected for long periods of time. This is just a small graph to describe the Chrome versus additional browsers as you can see from rules. So there are some features like built in features in Chrome that makes it attractive for attackers. So first the extension can be installed through developer mode. So after applying the switching to developer mode the browser it's possible to install extensions not through the Chrome web store only. Also manually for example by social engineering the user or with the flag which is called the minus minus load extension that can be passed to Chrome.exe. Another feature is ignorance of HTTPS. So in case this flag is turned on. If a user surfing to a website that has invalid certificate the default message of invalid certificate is not shown to the user. Last feature is like it's not a feature but it's by design like an extension can look at fields, sensitive fields like password fields or credit card fields without the need of spatial permission to be declared. That's it. So now we will talk a bit about the anatomy of Chrome extension. So first Chrome extension has the file type .crx so from now on we will mention crx as Chrome extension. So the crx is actually a zip file, an archive file which is built as follows. So first there is the manifest file which is a JSON file that describes the most important things about the file such as the permission that the extension requires, resources it uses, metadata such as name, ID and stuff like that. Background script, background script is like the main script which is the JavaScript of the extension. This script holding the state of the extension and every event that occurs so the background script is notified and decides what to do. For example it can trigger another content script. So now I will talk about the content scripts. Content scripts are scripts that are made for particular web pages. It has full access to the full JavaScript API in contrast to the background script that does not have full access and it's used to manipulate as I said particular web pages. Last component is just general resources that are in use in every extension such as HTML or CSS files, images, etc. All right so let's talk a bit about the thread landscape of Chrome extension malware. So at 2010 if we'll go all the way back we'll see that the Chrome Web Store was live for the first time. A year later we're talking hundreds of millions of downloads and according to Google 200 million active users. In the couple years following there was substantial measures taken in order to prevent attackers from accessing user's data. For example we have seen several measures taken by Google for either if it's scanning each and every extension before applying it to the Web Store or stopping all options to natively or secretly install extensions without using a developer mode. Also they canceled the style install and also they discontinued for example the Netscape plugin API which was basically allowed users to allow the attackers to access the file system and it was deprecated. In 2015 they stopped it, 2014 they stopped it. A couple of years ago obviously these measures caused a drop in Chrome malware distribution. However last couple of years specifically 2019 was the biggest one. We saw a big growth in the propagation of malware from CI-rex files. And this is a graph from Viral Stoles. You can see that only the first half of 2019 already passed the 2016 which was the biggest year for Chrome malware. Also another interesting thing we've seen from Viral Stoles is the lack of treatment to Chrome malware in traditional AV vendors in Viral Stoles. Most extensions in Viral Stoles are with zero detections. So let's talk a bit about the attack surface. So first all the JavaScript code runs in isolated environment sandbox of Chrome. So for example it cannot touch or gets the memory of the machine or the file system without having an exploit. What it can actually still do is everything that is related to the browser itself. For example stealing information or credentials. Forming a botnet by installing extensions on different, a lot of machines. Monetizing like using advertisement and stuff like that. Now we'll see an example of an attack that was presented in Defconn and Black at two years ago. It was called the Game of Crumbs. So basically what the attack was about is to create a botnet based on a Chrome extension. So it was like that. The extension was injected an iframe to the Facebook page of the user like an invisible iframe. And inside the iframe it signed up to Wix and created a website in Wix. Wix is a free platform to create a website very fast. So using the Wix website, the Wix website was published to all the friends of the user. And by entering to the link of the Wix webpage other users were installing by clicking and installing the extension. The extension was spread. And lastly the extension rated itself in a Chrome Web Store with five stars which just genius. So that's one attack. Another attack from the last month is Dataspy. Dataspy was spread with eight extensions for Firefox and Chrome as well. The extensions collected URLs and hyperlinks and webpages titles. And all this data was sent to a CNC server. And the data was actually is still sold in third party websites. You can see the research paper and see the particular website where it's sold now. Why it's interesting for example in URL, in HTTP protocol. So there are passed a lot of data, tokens for file sharing is passed through URL. Zoom meeting uses tokens and stuff like that. Okay. All right. So we're going to talk a bit about the daily collection and the labeling process. So basically when sourcing for data sets such as the CRX we had several challenges such as finding reliable sources. This was a highly uncommon and small and rather new threat landscape. Other than that we wanted to make sure that all FISA were actually in their correct format. There are actually CRX files. And of course knowing how to distinguish between the malicious and the non malicious ones. For that we used three sources. One was the intelligence feed for example. The other was the official Chrome Web Store and last was unofficial Chrome stores which are basically stores that crawl the official store and offer the same extensions. So we're going to talk a bit about each one. So intelligence feeds had the lowest amount of CRX files, but they had much more quality metadata. For example, we had the AV vendors detections. We had the number of submissions when it was the first uploaded, etc. But also had some more challenging metadata. We faced a lot of missing details. We couldn't find the ways to across reference between the Chrome Web Store and Virestall for example. Also a lot of files were actually incorrectly tagged as CRX files. In fact something like 30% were invalid even though they were tagged as CRX files. However in the Chrome Web Store obviously it's the most reliable resource to valid files. But they also removed malicious files, at least the one they were aware of. And they only stored the most recent version of each extension. So we decided to refer to most files there as benign. And we did have find some metadata that was useful, but as I said it's hard to cross-reference between them. If we talk about the unofficial stores, so obviously this is the largest source for CRX files because it stores all previous versions, all deleted extensions and basically everything that was ever uploaded to the official store. But in some cases we didn't have metadata to use only an ID or not even that in some cases. And obviously we do not know what happened to the CRX between the store and the crawl. So we're not sure what's the trash factor for these extensions, for these files. So just to sum it up real quick. So as we said the threat intelligence feeds were actually almost the best in everything except quantity. So what we did was use most the official Chrome Web Store and the unofficial stores together with the feeds and basically uploaded these files to get the results we wanted and made the data that we thought would be necessary for our ground truth. So basically we decided to use five positives by AV vendors in order to decide the files malicious. As I said at the beginning we see that not a lot of vendors even scan these files. So five is not a lot of vendors, but it was enough for us at least for this research model. And B9 we decided that whether the files are in the official store and have zero positives after they were scanned in Firestore or uploaded from the unofficial stores and also received zero positives. All right, so now we will dive into the three models that we created. Something important to say is that these three models are our research model. We just wanted to prove a point that it's possible to create a model to detect malicious Chrome extension with good detection rates. So this slide about the overall process of the creation of the model. So first is the prepossessing step. We validated the file that were introduced into the data set. After that we extracted from the relevant files the relevant like the features. We ended up with a big dimensional size. So we had to reduce the dimensionality to the dimensional. So we first used Chi-square and after that we tried another model with applying two different method like with two steps. First Chi-square and then Gradient Boosting. We represented the features into numerical value using TFIDF in order to train a model. And the models that we trained were one logistic regression model and two DNNs. Last thing to say about that is that we didn't try to optimize the hyperparameters since it's just a research model as I said. Sorry. All right. So the prepossessing. So first we validated the files as I said. Every deployed file should be CRX or ZIP. You can check it or test it by looking at the magic of the file for example. Another thing to test is that each archive has manifest.json file which is a must for any extension. We ended up with a bigger dataset but we used 20,000 files. 75% of the data sets went for training and 25% for test. All right. So the feature extraction method. We extracted features from the JavaScript files and from the manifest. The feature extraction method that we used was looking for sequences of four characters or more of alphanumeric values or relevant characters to JavaScript such as underscore or dollar. Now we'll see an example. So let's say that we're trying to extract features using this method from this function. So these are the features that will be extracted using the features. I hope it's clear. All right. Dimensionality reduction. So using the extraction method that we saw earlier, we ended up with 1.1 million features which is... A big amount. Of course that we had to reduce the amount. So as I said we tried chi-square to reduce to... Actually we tried to different numbers. We tried to... We decided to take for this model the 10K features. And in the second step we used the gradient boosting to reduce from 10K to 1K. And then we represented the features into numerical value using TFIDF as I said earlier. So here are the results of the tree models. So first the DNN model using chi-square only. The results were the best results out of the tree models. As you can see the recalls was 99% and the false positive rate was about 2 or 3%. The second DNN model using another step of XGBoost was worse. The recall was pretty similar but the false positive rate was much higher. The last logistic regression model using chi-square and XGBoost had the worst results out of this tree. The false positive rate was around 30% which makes it... It's not a sustainable model. Another thing to note is that in general the recall is more important for Chrome extension. The false positive rate since an average user is around 5 or 10 extensions and you wouldn't want to miss the one malicious extension rather than false positive on one of the out of the 10 which is not good as well but not bad as missing the one malicious one. And the last thing to say about this model that all of these tree models were able to detect the data spike campaign and the other one the game of chromes. Future research. So we would like to try to de-opfuscate the JavaScript files before extracting the features. So the extension straight landscape suffer from a lot of obfuscations on the JavaScript code. So we'd like to do some normalization and de-opfuscation before we extract the features. Another thing to try is combine the dataset to train a model with combined dataset of Chrome and Firefox extensions. These formats and the files should be similar but we didn't try to train a combined model or tested the results on Firefox dataset. That's pretty much it. Thank you very much. Actually we are out of time so we'll stay here. All right. One question, okay? Is there a question? All right. Thank you very much.


But it's crossing an elite to an elite breeding or pollen chucking. I Consider regular breeding like using a male.  You don't have to do anything. You just they they make their seeds themselves You don't have you might have to shake it around. That's about it breeding using reversal techniques is a lot more Involved it's it's a lot more unpredictable You can make a lot more errors a lot real fast I mean you could you could take something and isolate it and make it more true breeding really fast But you can also make huge errors right away and very rarely Does a pollination go where you can just like get something and shake it in a reversal and the seeds make themselves?


Just call me Android 13 from now on. Okay now I'm a Dragon Ball Z fans to get that There is a 10 hours of walking in New York as Princess Leia and because I love Star Wars I'm gonna have to react to this It has to be good So let's get it on Yeah, this was good. This was one of my favorites This one my favorite parodies that they did matter of fact, I think this probably my favorite comments below and Be the force


ake your nintendo switch bigger when you travel like big giant screen Today, we just got confirmation from let me read the email Um, you know poppy poppy the drink that's so They're giving away they're giving away like three cans three three three three three can't three boxes You got a can you get the poppy you got the poppy Yeah, yeah, yeah, I don't air to grab it Oh, okay. That's fine. Yeah, we got a poppy right here. Nice. Did you try already? Yeah, uh I like half the flavors. Okay, half of yeah. Yeah, of course you have to find the one that you like that you like the most Um But yeah, uh, let's see here. What's what's the thing? Oh Prebiotic healthy soda ny xy is is is um providing their nintendo switch game cube controllers For the giveaway. Um, there's one of the controllers That has not been announced yet That they will provide also or for a winner So you'll be getting like you'll be among the first to get that that version of that controller um And uh, I think I have one more Uh, I can't remember. I didn't reach out to anyone. Yeah, there's there's gonna be giveaways. By the way I'm saying that next year. None of the giveaways for the the 16th have are Thankfully bought by me because I didn't have to spend a dime I reached out to everyone. They were all like even the nintendo switch. Um, we have a company who provided the Um, the the prize and they donated the nintendo switch for the channel as well. So Um, I I just give out addresses and then they they ship to you directly. So I paid for all my giveaways I don't know if that makes a difference. Everybody's rich, Nate Everybody got like a hundred You have significantly bigger and more Um It's all good. You know, uh, I I have a bunch of companies that I've been talking to but it's for an event next year You know 150k event. Yeah, I believe that's happening So I'm trying to like get some get some companies behind it. So But I'm pushing it out because hey, we gotta we got to get everything else out of my house. I've already Yeah, I agree. I'm gonna be happening. By the way, that's like in the works to get everything shipped to hell out of here I'm missing something in the works. Finally. Finally back to boxing labeling and shipping Yeah, here you go. Come up at the house. I don't want to hear anymore Yeah, that's it. I think that's it Oh, wait, wait, one more thing The the big event is going to be a Uh, uh, a skit which is going to be not a skit a movie. Okay. Yeah Okay, it's a movie It's called a bowser steals christmas starting bowser mario luigi princess peach Toad so that Um while luigi Wario and they're all gonna be me playing the same character in the same in in that movie So I already started filming it. It's already in in production Um, it's gonna air that day. So On the christmas event giveaway thingy See this sounds like what is it a show or Movie, what was that show where that guy put on his no, I'm talking about like an actual show or movie where they the guy put on his own solo Event like this where he played every character on stage And then it ended with nudity at the end No, mine's gonna be a full reveal of himself mine's completely g rated g Because because I'm just hearing I'm playing this character and that character and this character And it's making me have flashbacks to that moment when this guy played all those characters and then Just drop draws right at the end. Yeah, I mean the chat was the one who chose it Mr. D It's the mr. D show and the vice principal who does it? It's the vice principal. Who does it? I think you have a really strong memory. Did you watch that a lot? I've I've rewatched the entirety of mr. D over Well, you just last let's just pause the last one hilarious show and if you have not seen that you need to watch Don't worry. You don't actually see it yourself It's called mr. D. Yeah, it's called mr. D. It's a can a canadian show Yes, really good. It's really Really bad, but I mean, uh, you'll you'll you're gonna love it You love it when when when the third grader brings in the damn rocket ship for show and tell it's great All right I'm skeptical, but I'm willing to try No, jake, you will You got me. I'll if it's that good. I'll I'll No, let me do one of that. Do you like step brothers? Do I like what step brothers? Yeah, of course. Yeah, you'll love this thing. All right. All right. All right It's okay. You should have started with that. That's that's much easier That's that's all I said wait a second.   All right, but yeah, all right. Yeah, mr. D. Don't worry. That's not season one There's a build up What years did this run like what? God They just had it out. It's like a 90s show 2000. No, no, no Uh First episode was 2012 2012 I ran for eight seasons. So probably up to 2020 Okay Yeah, so it's not that old of a show in a long time. Okay. Yeah Eight seasons was 2018. Yeah, and it's available to stream on a few different services. So All right. Yeah, like you can watch, uh, tuby has it for free. Roku amazon prime Yeah It's really it's really good not kid-appropriate, but it's it's it's hilarious Ah, all right That being said guys, thank you so much for sitting in after I just don't worry about finding me guys Yeah, we don't need to find Jay. You can find him here tomorrow All right, Jay coming on youtube jake randall twitter jake randall. I'll keep it short. I'll keep it clean See you guys I I thought you were just going to talk about your only fans. That's why I was skipping over you. Oh, that's been promoted You're doing I gotta I gotta I'm trying to start a family friendly show for the first six hours tomorrow. All right And then it goes rated r. It's a pretty hard turn It's a hard turn not a hard r a hard turn. Whoa, whoa Cue the Where's the outro? I just got canceled. Yep. No


Now, Charles, military has claimed a victory in its weeks-long battle with northern rebels that led to the death of President Idris Debi on the front line. The rebel group, Front for Change and Concord in charge, did not respond to a request for comment on the military's claim on Sunday. Now, the transitional military authorities have previously said they have defeated the rebels only for fighting to continue. Charles soldiers were greeted with cheers as they returned to the capital in Jomena on Sunday. The military says it had defeated northern rebels following weeks of fighting. It was in those clashes that President Idris Debi was killed, after which a military cancelled as in power. On Sunday, the military displayed prisoners and vehicles from the Front for Change and Concord in charge for the media. Abaq Abdo Kareem Dawood is the Chadi and Army's Chief of General Staff. We brought back war prisoners and their gear. We cleaned up all the areas where they infiltrated and I can guarantee that the whole territory is secured. We asked the people to return to their normal occupations and enjoy regained peace. Our country is secured thanks to God. However, this is not the first time that the transition on military authorities have declared victory, only for fighting to then continue. The rebel group which crossed the border with Libya in April says it was not aware of an end to fighting. A spokesman said they would comment when there was reliable and credible information. Debi's debt in a battle against rebels plunged into crisis. The military council led by Debi's son took power and promised an 18-month transition to elections. But opposition politicians and civil society groups have denounced the takeover as a coup. On Saturday, security forces fired tear gas to disperse the protest against the military takeover.


Today we're turning this unused wall into this pegboard storage vinyl display Craft room organization, and we'll show you how we did it right now What is up welcome back this year in 2020 I'll be doing all the intros Just kidding Do you like to do a builder make it a great and that's what we do in this channel every week So you should go ahead and hit that like button Subscribe and tick that bell cuz like I just said we do this every week this week. We're making some pegboard storage Something for our paint our tools our vinyl is become a cluttered mess up here in our studio And I can't work like this Yes Right so we're looking at an empty wall on the other side of this camera and We're gonna fill it with storage space. I need somewhere to stack my vinyl so I can see it I need somewhere to put all these paints all these tiny little bottles of paints What else tools 57 bottles of Mod Podge? We're gonna gather all of our materials We ran to our local home improvement shop Lows and we picked up our our materials. We got a full sheet of this half-inch birch plywood Looks nice very nice finally sanded. It was like 50 bucks. Yes. It was expensive But it was like 42 it should come in the whole wall and then we picked up some one by twos three of them And some one inch dowel rods big fatty dowel rods. We just started with three. We're probably gonna need some more Oh, and then we picked up a one by six, but I misplaced that Step a whoa like I said we cheated we had a the guy at our home improvement shop make our cuts for us They cut three equal pieces at 32 inches Right there. The guy took his time. He did a great job He didn't rush through it and rip it that way we could get him in the car. Yeah, we didn't cheat. That is super convenient Yeah, I was super convenient. It's only like what 50 cents a cut first cuts free Ever charges for a cut.  We're gonna put the one by two on the wall and then hang the Apply wood on that so it's not directly on the wall Give you some gap gap it those are the only cuts right now So we're gonna jump right into step two We're gonna drill a million holes a million holes, so we're making our own pegboard and I think the spacing we will want is Four inch holes four inches apart Every four inches down So how many holes does that end up being babe? like 231 holes there's like 77 holes on each board and we're doing three boards, so that's a Lot of freaking holes That's all right, I'm gonna put together a little jig to hopefully help us do all these holes at least keep the hole straight and So like step one a we're gonna make all of our measurements Four inches and four inches and four inches and four inches and then we're gonna snap a chop now We're gonna use a chalk line Daddy's a little helper We're just gonna run the line over where we just made our little marks on both sides of the board There'll be too many holes. I don't know what do you think? It's gonna be plenty of holes so we got so far I'm gonna build a little jig to keep my drill Up and down vertical, so I don't have wonky crazy catty wampus holes Kitty won't us there's my jig.  We're gonna try a different hole saw. We're gonna try a little hole saw Not a Forstner bit So this one will chip away all the wood as it goes down and this one will create a hole And if you go too deep you got to try to dig that hole out a little plug with a screwdriver But I don't want to dig that hole out with a screwdriver So we'll start the hole and we'll flip it and hit it on the other side, too We also decided maybe we don't want to do every four inches so we're gonna see what it looks like space Whoops, maybe I'll go all the way through. Whoo. I left a better hole Forstner bit hole I think we're gonna do all of them with the little hole saw hole To save some time I decided that I'm gonna lay the one that we Did the blue chalk line on on top of our other two and I'm gonna drill a pilot hole through all the holes We want to do and then come back and Make them a hole So you're gonna clamp them together first a little piece of green painter's tape on here So I don't go too deep so I don't come all the way through so that I can flip it and do the other side Make it nice. I missed the hole One by six as our shelf Well first we set them on a one by two like it's gonna be on the wall then we put the dowels in Now we're gonna mark it However long this is all right, so we'll go make a couple of shelves at 16 inches Summit 24 and cut a bunch of dowel rods at six and three-quarters The natural wood look looks pretty Psychedelic, we're just gonna give it a clear coat. I'm gonna make some boxes some shelves some bungee cord things We're gonna start with a box that we're gonna make for our vinyl We're gonna keep our we're gonna try what to yes, we're gonna show you two methods on How to mount the vinyl onto this board or how we're thinking one will be the box method Which I think will look nice, but the other is To use bungee cord between two dowels and a little shelf at the bottom and then just slide them right in there Yeah, we're gonna try both gonna start with our little shelf or a little box So I cut some one by threes down to 23 inches and then four inches and then a one by six I cut down to 23 inches One and a quarter inch bread The nail not the guy on it. We're just using three sides The pegboard will be the back and then he said a pretty cool idea for how to mount this box onto the pegboard Yeah, let me take this We're gonna use these one inch brackets around the one inch dowel Got so far you put this green painter's tape up so that we'd be able to map out Where the stuff is on the wall like where the boards will be where the gaps will be and now where we're finding the studs Kim's great at finding studs Step five now, we're gonna use these one by twos as our mounting hardware to mount them to the wall It'll keep it off of the wall a little bit give those pegs a little more meat to blade into He was marking on all these panels Where they're gonna hit the one by two behind them and I'm gonna come in and give them a little pilot hole And now we're just attaching the panels to the one by two brackets using some one inch wood screws Step six, I can't do it because I have way too many pegs pegs on the wall all of the stuff We made to hang on one. This was a beginner to intermediate project if you're comfortable with making Small cuts and drilling a bunch of holes. You can totally do this project easy took us an afternoon probably five hours Maybe 70 or 80 dollars. Yeah, and it all started because I wanted some final storage and this is great It looks beautiful and it's expandable We can add an additional bungee cord right here and double up all the storage that I have But this is all the vinyl that I had so it's all I need it right now I love the fact that it's modular and configurable. We can move it around change it around We don't know we want to keep this as our background should this be our typical Channel background, but we turn the camera background and and make it what it used to be you guys vote down below Let us know in a comment if we should keep this as our background We'll go back to that or go back to the other way. I kind of like this for 2020 We might keep it hit that like button if you're not yet subscribed hit that subscribe button because we do this every week So don't forget to hit that bell hit the bell So you get your notifications and until next week. Maybe watch something over here now watch my video Don't watch hers