Latest in Gear

Image credit: AP Photo/Mark Lennihan

Russian hackers modify Chrome and Firefox to track secure web traffic

The perpetrators may have Russian government support.
1621 Shares
Share
Tweet
Share
Save

Sponsored Links

AP Photo/Mark Lennihan

Many hackers won't touch web browsers beyond exploiting their vulnerabilities, but one group is taking things one step further. Kaspersky has detailed attempts by a Russian group, Turla, to fingerprint TLS-encrypted web traffic by modifying Chrome and Firefox. The team first infects systems with a remote access trojan and uses that to modify the browsers, starting with installing their own certificates (to intercept TLS traffic from the host) and then patching the pseudo-random number generation that negotiates TLS connections. That lets them add a fingerprint to every TLS action and passively track encrypted traffic.

Just why the intruders would need to do that isn't entirely clear. If you've infected a system with a remote control trojan, you don't need to patch the browser to spy on traffic. ZDNet suggested it might be a failsafe that let intruders spy on traffic for people who remove the trojan, but aren't cautious enough to reinstall their browsers.

The perpetrators appear to be easier to identify, and that might reveal their motives. Turla is believed to work under the protection of the Russian government, and initial targets were located in Russia and Belarus. The group is sophisticated enough to have compromised Eastern European internet providers in the past to infect otherwise clean downloads. This may be an attempt to snoop on dissidents and other political targets using a method that's difficult to thwart.

All products recommended by Engadget are selected by our editorial team, independent of our parent company. Some of our stories include affiliate links. If you buy something through one of these links, we may earn an affiliate commission.
Comment
Comments
Share
1621 Shares
Share
Tweet
Share
Save

Popular on Engadget

Google's new Shopping portal will show you what everyone else wants to buy

Google's new Shopping portal will show you what everyone else wants to buy

View
Thousands of 'Coolest' Kickstarter backers will only receive $20

Thousands of 'Coolest' Kickstarter backers will only receive $20

View
Nikon ends its authorized third-party repair program

Nikon ends its authorized third-party repair program

View
IDC: Wearable shipments nearly doubled thanks to earbuds like AirPods

IDC: Wearable shipments nearly doubled thanks to earbuds like AirPods

View
What's on TV this week: 'The Expanse' season four

What's on TV this week: 'The Expanse' season four

View

From around the web

Page 1Page 1ear iconeye iconFill 23text filevr