Google has removed the two add-ons Nano Adblocker and Nano Defender from the Chrome Web Store. This was because the extensions appeared to be executing data-collecting code. The add-ons were sold to two Turkish developers at the beginning of October who are now suspected of having implemented the malicious code in the ad blocker.

As ZDnet reports, both extensions added up to a quarter of a million installations on Google Chrome. The add-ons of the same name on Firefox are not affected, they are also looked after by other developers. However, the competing browser Firefox has had problems with add-ons in the past. Overall 192 extensions were removed from Firefox in the course of this.

Data theft in a big way? After the extensions were sold to a Turkish development team in early October, GitHub users, including uBlock developer Raymond Hill, discovered that the add-ons have been changed. The now malicious extensions would collect different data from outgoing network queries and send them to https://def.dev-nano.com send. Accordingly, the add-ons collected the following data:

IP of the user Name of the country Information on the operating system used URL of the website Time stamp of the call HTTP methods Size of the HTTP responses HTTP Status Time spent on the website which URLs were still clicked on from the website After the code changes became known, the new developers tried to explain themselves. For this purpose, the development team reinserted the previously removed privacy policy page. It is also noticeable that the author name of the original developer is never removed