Thegreatsuspender: URGENT: SECURITY: New maintainer is probably malicious

Created on 3 Nov 2020  ·  546Comments  ·  Source: greatsuspender/thegreatsuspender

TLDR: The old maintainer appears to have sold the extension to parties unknown, who have malicious intent to exploit the users of this extension in advertising fraud, tracking, and more. In v7.1.8 of the extension (published to the web store but NOT to GitHub), arbitrary code was executed from a remote server, which appeared to be used to commit a variety of tracking and fraud actions. After Microsoft removed it from Edge for malware, v7.1.9 was created without this code: that has been the code distributed by the web store since November, and it does not appear to load the compromised script. However, the malicious maintainer remains in control, however, and can introduce an update at any time. It further appears that, while v7.1.9 was what was listed on the store, those who had the hostile v7.1.8 installed did NOT automatically receive the malware-removing update, and continued running the hostile code until Google force-disabled the extension.

The Great Suspender has been removed from the Chrome Web Store. To recover your tabs, see issue #526, or continue reading
The code in the Github repository is currently safe, and the most recent tagged release happened before the transfer of ownership. To use that version, and avoid needing to finagle URL's, enable Chrome developer mode, download and extract a copy of the code, then navigate to your extensions menu and select 'Load Unpacked Extension'.

Some others have had success simply pressing the "back" button on suspended tabs: everyone should note that the site's URL is included in the URL of the suspended page. For a pictorial guide on doing this, see this comment. Further, if you just want to reload lost tabs, you can use some form of File History on Chrome's user profile directory (while chrome is closed!), before restarting chrome and using the extension menu to unsuspend all tabs before your computer realizes the extension is banned again.

Because the malicious code loaded from a server by the extension in version 7.1.8 was heavily obfuscated, it is hard to say what may have been compromised. However, those who did manage to conduct an successful analysis of the code reported no password-stealing functionality in the copies that were archived. Indeed, it is highly unlikely that the extension would have been able to steal passwords. That being said, it is theoretically plausible: see my comment here. If you don't already, I highly recommend using a password manager like Bitwarden, to reduce the difficulty of changing your passwords, and to prevent an site that transmits and stores password information in a insecure way from causing the rest of your accounts to be compromised. Additionally, enabling two factor authentication wherever you can is a very easy and powerful way to make it virtually impossible for an attacker to get your data, even if they managed to retrieve passwords.

Full description of the issue:

@deanoemcke, the original developer, chose to step back from the extension in June 2020. As a replacement maintainer, he chose an unknown entity, who controls the single-purpose @greatsuspender Github account. Much was suspicious about this change, including mention of payment for an open-source extension, and complete lack of information on the new maintainers identity. However, as the new maintainer did nothing for several months, it was believed that there was simply a failed transfer. In October 2020, the maintainer updated chrome store package. The update raised red flags for some users, because the changelog was not modified and there was no tag created in GitHub. On investigation, it appeared that the extension was now connecting to various third-party servers, and executing code from them.

This lead a few users to panic, however, on closer investigation, it appeared that the third-party servers were part of an alternative to Google Analytics: and the changes shipped along with a new (though unexplained, #1260) tracking deactivation. It appears that deactivation works. We would later discover that this was wrong: See below

The discussion continued, however, because the new update also requested additional permissions, including the ability to manipulate all web requests. That lets the extension do what it pleases, including inserting ads, blocking sites, forcible redirects.... This change was supposedly in order to enable new screenshot functionality, but that was unclear, and probably shouldn't be needed.

Furthermore, the web store extension has diverged from its Github source. A minor change in the manifest was now being shipped on the chrome web store, which was not included in Github. This is a major concern: though again, it has a possible innocent explanation. While some think it is illegal given the license on the code, this may not be a GPL violation.. Because the minified script is not part of the extension, the license does not apply to it. Because of Web Store rules, the extension itself can be unpacked and inspected in full, human-readable form, likely satisfying the copyleft restrictions.

As a final red flag, no part of the web store posting has been updated to account for this. @deanoemcke remains listed as the maintainer, and the privacy policy makes no mention of the new tracking or maintainer. It has been several months since the transfer, but almost nothing reflects that change.

@deanoemcke did respond to the thread, after a significant delay. He confirmed much of what is above, including that the secret changes are limited to analytics and are disabled by the flag. However, he hasn't yet clarified what his relationship or basis of trust with the new maintainer is, nor has he explained why the initial post mentions a 'purchase'.

On November 6th, @lucasdf discovered a smoking gun that the new maintainer is malicious. Although OpenWebAnalytics is legitimate software, it does not provide the files executed by the extension. Those are hosted on the unrelated site owebanalytics.com, which turns out to be immensely suspicious. That site was created at the same time as the update, and is clearly designed to appear innocent, being hosted on a public webhost, and being given a seemingly innocent homepage from the CentOS project. However, the site contains no real information other than the tracking scripts, appears to have been purchased with BitCoin, and is only found in the context of this extension. Most importantly, the minified javascript differs significantly from that distributed by the OWA project.

@thibaudcolas has done a more detailed analysis then my quick look. He quickly located additional hardcoded values related to other, confirmed malicious extensions, implying that the new maintainer is responsible for them. He also found incredibly suspicious additional information, that makes it clear that the extension was not loading a modified version of OWA, but a trojan disguised as it. OWA has a PHP based backend, but the fakes are using NodeJS. The trojan sets cookies, which OWA doesn't use. The response to certain requests is a completely different type then legitimate OWA. Furthermore, @joepie91 has attempted to deconstruct the minified JS, and believes that the code intercepts all requests, meaning it can track you perfectly, and furthermore manipulates those requests and makes additional advertising requests. That means the author was probably attempting to commit several flavors of advertising fraud, as well as possibly tracking you globally.

While there once appeared to be an innocent explanation for this, I can no longer say that it is remotely likely. Using the chrome web store version 7.1.8 of this extension, without disabling tracking, executed code from an untrusted third-party on your computer, with the power to modify any and all websites that you see. The fact that disabling tracking still works is irrelevant given the fact that most of the 2 million users of this extension have no idea that that option even exists. The fact that the code may not be malware is meaningless in light of the fact that it can be changed without notice, and that it is minified (human-unreadable). The fact that a new version has since been pushed that disables this behavior isn't useful given that any future update reintroduicing the malicious code will occur without notifying the user.

Many users are worried enough about the changes that they completely uninstalled the extension, preferring alternatives instead. That extension has much fewer features, but is slightly better for performance. Others have begun building it from source, and installing it manually. If a person were to try to create a new web store release, they would need to change it significantly enough that Google wouldn't reject it as spam. To simply get a safe version for yourself, see further below. Before removing or modifying the extension on your computer, be sure to unsuspend all tabs, or you WILL lose them (though the original URL's can be extracted from the extension query's, and some are working on scripts to do just that, its easier to do just avoid all that.

Throughout the above discussions, which spanned several issues, now appear in news articles, the new maintainer has never posted on the thread, or interacted in any way with the repository. Despite an ongoing discussion about how they are plotting to destroy us all, they haven't done anything to assuage our concerns: likely in the hope that all those aware of the attack would move on eventually. They aren't dead, as they were quite quick to update the extension when Microsoft removed it for malware, and @deanoemcke reports that they. But the new maintainer might well be a literal cat on a keyboard, for the amount of interaction they have made with the community.

For those who don't want to continue using the extension, alternatives include Tabs Outliner, which lets you place tabs in an outline. Auto Tab Discard is very similar to TGS, however it always reloads the tab when it is focused. Session Buddy allows you to save tabs into "collections", that can be reviewed later, as well as providing security against crashes.

If you enjoy using the extension, and wish to continue using it as it was, download the source code from the Github repository (version 7.1.6), enable developer mode, select "Load unpacked extension", and point it at the /src directory. Bam! You are now running The Great Suspender as @deanoemcke created it. @aciidic has gone further, creating a new repository not under the control of the old maintainer, and with all tracking code removed, here. The Marvellous Suspender is another fork currently on the Chrome Web Store, for those who would prefer not to finagle with developer mode settings.

That concludes my summary. For more information, please do look further down on this thread, or at the original announcement (#1175). An analysis of the script is placed here.. Additional sources began covering this in January 2021, and a lot more picked it up after February Fourth for some bizarre reason that probably has nothing to do with the removal by Google.


Edit log

Edit 01: (2020-11-06) add details from this discussion
Edit 02: (2020-11-06) Update to reflect the newly discovered evidence for malice
Edit 03: (2020-12-06) Note technique to continue using TGS
Edit 04: (2021-01-03) Add "Urgent" to title (and WOW did people start noticing) (thanks twitter)
Edit 05: (2021-01-05) Note @thibaudcolas and his analysis.
Edit 06: (2021-01-08) Note @thibaudcolas's second analysis, clarify and copyedit throughout, and start adding dates to edits
Edit 07: (2021-01-08) Remind about the process of removing the extension, and note a bit more about maintainer
Edit 08: (2021-01-08) Last one for today, promise: Reformat edit list and other minor changes throughout,
Edit 09: (2021-02-04) Note removal from store
Edit 10: (2021-02-04) Fix bold
Edit 11: (2021-02-04) Add help for those worried about losing tabs in nice big bold letters
Edit 12: (2021-02-04) Add details about password security
Edit 13: (2021-02-04) Clarify compromise, beautify edit log
Edit 14: (2021-02-04) Obscure the fact that I made my first edits 9 months in the future (fix edit years)
Edit 15: (2021-02-05) Clarify probably breaches: regret decision to keep obsessive edit log
Edit 16: (2021-02-09) Realize that issue still contained the false implication that users were safe after November.

picture TheMageKing
👍1498 ❤227 👀211 😕99 😄40 🚀25 👎8

Most helpful comment

The fact that this was sold off at all is certainly troubling, though without more context I won't judge @deanoemcke too harshly
Agreed - he wrote and distributed it, and closed over 800 tickets over half a decade, for free. GH issues aren't really a great venue for editorializing, but I posted an op-ed on my site about this.

I've been publishing and maintaining my extensions for over 10 years. At one point I had 1M+ users of one of them. I believe I can very much get into the head of @deanoemcke and relate. The work is never-ending, complex, and thankless. Sure, some users donate, but it won't make you rich. Although you're doing it "for the community", you are nevertheless very aware of the kind of revenue that you could generate by simply tracking a million users, or perhaps inserting ads. The offers come frequently, not just to buy your extension, but to monetize it with adware, malware, installers, etc.

If you get to the point where you're just sick of doing it and you want to "cash out", then doing exactly what he did is a very appealing option. Take the cash and disappear. Cover your tracks a bit. You cannot tell me he didn't know exactly what he was doing, because every extension author that reaches some level of success starts thinking about the possibility of an exit strategy. Trust me, I've been here for over a decade. I know how this works and I have explored every possible option. We just hope that most of us have enough integrity to not sell out their users.

FWIW, I have trust in the current maintainer and believe their actions and intent were never malicious.

I am highly suspicious of this statement. You knew exactly what you had and what is was worth to whom. If this statement is to be believed, I would like to know what due diligence you did in researching the "buyer", and why they remained anonymous. I would like to know what you sold it for, and how the transaction was made (anonymous BTC, perhaps?). I would like to know if you drew up a legal agreement with the "buyer" before the transaction, and if it contained any wording about what they were and were not allowed to do after the sale. I would like to know if you had any transition period where you retained partial control to prevent hijacking. I would like to know if you considered informing users in a more obvious manner about the sale so they could beware, because surely you understood the risk you were making them take.

picture matt-kruse on 4 Feb 2021
👍54 ❤6 🚀4

All 546 comments

...
This lead a few users to panic, however, on closer investigation, it appeared that _the third-party servers were part of an alternative to Google Analytics_: and the changes shipped along with a new (though unexplained, #1260) tracking deactivation. It appears that deactivation works.
...
@deanoemcke did respond to the thread, after a significant delay. _He confirmed much of what is above, including that the secret changes are limited to analytics_ and are disabled by the flag. However, he hasn't yet clarified what his relationship or basis of trust with the new maintainer is, nor has he explained why the initial post mentions a 'purchase'.
...

Are trckingbyte.com and trckpath.com part of Open Web Analytics? Because what I am seeing in @deanoemcke's post is him saying that he can't guarantee if the changes made are legitimate analytics or if they're malware:

I'm not an expert on what is legitimate analytics gathering ... and what is deemed malware.

I apologize for possibly exacerbating the "panic", but I am just asking, and trying to put a little extra emphasis on this, because when you say:

...on closer investigation, it appeared that _the third-party servers were part of an alternative to Google Analytics...

It just strikes me as sounding a little too forgiving / innocent, though I'm sure that's not your intent.

I also want to emphasize, @deanoemcke goes on to say in that post.

Giving the publisher the benefit of doubt, I would say that they have the right to collect extra analytics _so long as it is within Google's policies, and is communicated to the user_. There is a privacy policy linked on the chrome webstore (which I set up a while ago): https://greatsuspender.github.io/privacy

_Of course, this assumes that Google are aware of these changes, and also that the linked privacy policy is still accurate_.

We know that these new "analytics" were not communicated to the user. They do violate the established privacy policy. They violate Google's policies, as the information provided all over the extension's page at the Web Store is now inaccurate (owner, contact, saying the project is open source, etc) and the privacy policy itself is no longer accurate.

and @deanoemcke had previously assured us when this sale was announced:

...the project will remain open source and the code here on GitHub will continue to reflect the code published to the chrome webstore.

Although, apparently he cannot be held responsible for the actions of the current owner of the extension. But, this is why mom said you shouldn't make promises that you can't keep.

I appreciate you making this issue @TheMageKing, and I thank you for creating a more centralized location for discussion about this topic, which will hopefully reach more users and give them the information they need in order to make decisions about what to do. I apologize, because I realize much of what I said here is simply repeating what you already provided. I just felt the need to emphasize a couple of things.

Personally, I reported this extension at the Chrome Web Store on October 29, with the following:

"The extension was sold to an unknown party. This entity has "updated" the extension to v7.18 w/o publishing changes to Github. It is calling remote scripts and using remote tracking analytics, sending user information somewhere w/o user knowledge. PLEASE SEE: https://github.com/greatsuspender/thegreatsuspender/issues/1175#issuecomment-717656189 AND ALSO: https://github.com/greatsuspender/thegreatsuspender/issues/1175#issuecomment-717656189 .. Owner refuses to communicate or respond to anyone. Can only be considered as malicious/malware at this point. We have no idea what the full changes are to the code, or the ramifications of said changes."

I also reported the user @greatsuspender and the main repository to GitHub on October 29 with the following:

"This person/entity purchased the Chrome web browser extension "The Great Suspender" :

https://chrome.google.com/webstore/detail/the-great-suspender/klbibkeccnjlkjkiokjodocebajanakg

which has over 2 million users. The project is supposed to be open source, and the master repository for it is located here:

https://github.com/greatsuspender/thegreatsuspender

The announcement and information regarding the purchase/transfer is located here:

https://github.com/greatsuspender/thegreatsuspender/issues/1175

The new owner of the extension has made changes to the code, and pushed an update to the Chrome Web Store, bringing the version up to 7.18. However, they have NOT published the code changes to GitHub, and the latest release here is 7.16:

https://github.com/greatsuspender/thegreatsuspender/releases

Obviously, after the Nano fiasco, this has brought a great deal of warranted concern to the community. Despite many attempts from many people, they refuse to respond or communicate in any way with anyone. Neither does the former/original author. It has been discovered that the extension is now calling remote scripts. Please see:

https://github.com/greatsuspender/thegreatsuspender/issues/1175#issuecomment-717648105

and also:

https://github.com/greatsuspender/thegreatsuspender/issues/1175#issuecomment-717656189

The extension is now injecting a tracker which violates the Privacy Policy (also linked to from the Chrome Web Store) stated here:

https://greatsuspender.github.io/privacy

This privacy policy also has not been updated to reflect that the old owner no longer owns it, who the new owner is, or what their contact information might be. It states that the extension only uses Google Analytics, which is a lie.

The project can no longer be considered as open source, since the owner refuses to make the source open and available for review. It's my belief that this person/entity is acting in bad faith, and poses a danger to the community and to every Chrome user that installs this extension. This person has had every opportunity to clarify what is going on here, but apparently has no interest in transparency or communication.. leaving any reasonable person to wonder, why did they PURCHASE this Chrome extension?

Remote code execution w/o the user's knowledge. Code changes unpublished to GitHub, yet pushed to the Chrome Web Store. New trackers injected. Violating their own privacy policy.

XxX-Force picture XxX-Force on 4 Nov 2020
👍46

Are trckingbyte.com and trckpath.com part of Open Web Analytics? Because what I am seeing in @deanoemcke's post is him saying that he can't guarantee if the changes made are legitimate analytics or if they're malware

AFAIK, Dean's intention there is to comment that he doesn't know where each user draws the line between analytics and malware. Some people might think any sort of analytics is malware: others might disagree.

As for the trckingbyte.com and trckpath.com paths, they are not involved. They were found in other extensions, but do not appear in the distributed Great Suspender. My comment on the other thread explains what they are, and how they are not related to open web analytics (Okay, they are, but related as "Hackers rewriting open-source software for malicious purposes", not "Official part of system")

I apologize for possibly exacerbating the "panic", but I am just asking, and trying to put a little extra emphasis on this, because when you say:

...on closer investigation, it appeared that _the third-party servers were part of an alternative to Google Analytics...

It just strikes me as sounding a little too forgiving / innocent, though I'm sure that's not your intent.

Actually, it was. The open web analytics system, host of owebanalytics.com, really is a google analytics alternative. The code is hosted on a github repo with 1.3k stars, and there are people elsewhere who like it. The only reason I said "appears to be" is because I am quite busy, and I didn't have time to try and conduct any sort of detailed probe beyond that the website existed and wasn't written by a poor English speaker.

I also want to emphasize, @deanoemcke goes on to say in that post.

Giving the publisher the benefit of doubt, I would say that they have the right to collect extra analytics _so long as it is within Google's policies, and is communicated to the user_. There is a privacy policy linked on the chrome webstore (which I set up a while ago): https://greatsuspender.github.io/privacy
_Of course, this assumes that Google are aware of these changes, and also that the linked privacy policy is still accurate_.

We know that these new "analytics" were not communicated to the user. They do violate the established privacy policy. They violate Google's policies, as the information provided all over the extension's page at the Web Store is now inaccurate (owner, contact, saying the project is open source, etc) and the privacy policy itself is no longer accurate.

Indeed. This is the biggest reason why I am saying that they "appear malicious": those actions are major red flags, and it is sufficiently suspicious to justify a lot more scrutiny and skepticism than simple mistakes. But there is not yet evidence that they are actually malicious: everything can still be well explained by stupidity.

I'm not saying everything is rosy; there are major problems, right now. But it doesn't appear that we should start fearing for the safety of our passwords.

and @deanoemcke had previously assured us when this sale was announced:

...the project will remain open source and the code here on GitHub will continue to reflect the code published to the chrome webstore.

Although, apparently he cannot be held responsible for the actions of the current owner of the extension. But, this is why mom said you shouldn't make promises that you can't keep.

Yeah, mom seems to be right about a lot.

I appreciate you making this issue @TheMageKing, and I thank you for creating a more centralized location for discussion about this topic, which will hopefully reach more users and give them the information they need in order to make decisions about what to do. I apologize, because I realize much of what I said here is simply repeating what you already provided. I just felt the need to emphasize a couple of things.

Fair enough. I think I will edit that top post, to reflect some of this.

Personally, I reported this extension at the Chrome Web Store on October 29, with the following:

I, too have reported this on the web store. As a general rule, Google has more powers to remediate than Github: given that the source on Github is innocent, I doubt they will do much

I'll also respond to your comment in the other thread here, to condense this discussion more.

@TheMageKing, my comment was in reply to @ossilator's comment here, not to you. Regardless:
Oh, I know. I wanted to clear up some of your confusion.

... The extension is not directly connecting to the trck.... domains. It lacks the permissions to do so, -=-=-= AFAIK =-=-=-. Those sites are definitely malicious: they are hosted via a bitcoin hosting company, and were found in malicious extensions.
...

Honestly, it's nothing personal, but this is exactly the problem. You DO NOT KNOW.

You might not be able to tell, but I hedge what I say quite a bit. I am not a Javascript developer, though I do comprehend it perfectly well. Nor do I design manifests for chrome applications.

By my understanding, based on a reading of the documentation on the subject, Google requires that all websites which the extension can connect to be independently specified in the manifest.json. In the section that I understand to control that, many sites are listed, including google-analytics.com, stats.g.doubleclick.net (the google analytics sites), and cdn.owebanalytics.com. The trck paths are not there, nor does the word 'trck' even appear anywhere in the distributed code.

So while I don't know, I can say that I am as certain as I can be, short of a Google developer stating otherwise.

-=-=-=-=-
On a completely unrelated note, I received an email notification at 7:51 Eastern Time that @danupo had commented :

"It looks like there is a "keypressEventHandler" defined that tries to steal the password with external javascript.
In addition, the "getPassword" function and other functions are defined.

As Japanese law prohibits putting any part of the malware code on it, could someone please check this?"

But, for some reason, I cannot find that comment here. @danupo, what's up?

I got that same notification: however, I found no evidence of those functions when I checked. It was very weird. I'm not certain of how to check on the event handler, but I did verify that no "getPassword" function was defined.

TheMageKing picture TheMageKing on 4 Nov 2020
👍5

Thanks @TheMageKing. I'm just going to stfu and stop commenting about this entire situation because I'm obviously pissed off about the whole thing and my incivility isn't deserved or beneficial to anyone. Genuinely apologize to you and anyone else I may have been rude to. Good luck to all.

XxX-Force picture XxX-Force on 4 Nov 2020
👍23 ❤12

You were fine: this is a pretty scary thing going on here.

TheMageKing picture TheMageKing on 4 Nov 2020
👍31

I would like to share my own decision and how it worked for me. THe answer is quite well without TheGreatSuspender so far!

After hearing what has happened, I feel very uncomfortable about TheGreatSuspender even though I really enjoyed it up to now. A quick check shows domains with bitcoin in the name and there is a strong attempt to remain anonymous. There is no way I can trust it. I have used TheGreatSuspender along with Tabs Outliner which I also love.

I decided to buy a Pro license from the author, Vladyslav Volovyk who I found is in the Ukraine. Even though there have been rumors and posts on the extension site, even quite recently about the it being abandonware due to lack of responses, I have found posts by the author elsewhere and he strikes me as being an okay and honest programmer. I cannot hold it against someone if they do not want to dedicate their life to something, and I think it is not abandonware. I decided I trust him far more than TheGreatSuspender, it works offline, and I want the automatic downloads and extra functionality of the non-free version.

I bought Tabs Outliner pro version for about US$14 with a VISA card and it was instant gratification (even though a week ago someone said they could not purchase.) Chrome on a 2019 Macbook Pro. It works great and has automatic backup both local and to Google Drive. I just wanted to post here and let you know I have just converted over 1000 tabs, which means going to each window and unsuspending them, then in Tabs Outliner just click the X to close the entire window. And maybe type a note to name the window, or not. Poof! All those minimized windows from TGS are gone. I started feeling lighter. But the pages can be reopened from the Internet obviously. I think you can even save a downloaded page to it, and you can write notes in the tab bookmark tree and so on. I had seen Chrome slowing everything down (surprising on a new Mac) to the point I had started using Safari in parallel. Well, I saved over 1.5GB according to the Chrome task manager and I feel a lot safer.

I noticed that actually Tabs Outliner even saves windows that had crashed a long, long time ago. But they also were TheGreatSuspender links. So now I am going to each ghost of a crashed window, restoring it from the net or not, and clearing it all out. When done I will fully deactivate and uninstall TheGreatSuspender.

Hope my experience helps. Tabs Outliner works fine in free mode and I have never lost data with it, though somewhere I saw written that Chrome's storage is not bulletproof. At any rate I feel quite happy with my decision and I think TGS anyway was getting unwieldy at 1000 tabs. This was a good opportunity to lose some weight.

skycafemix picture skycafemix on 4 Nov 2020
❤9

p.s. as far as storage not being bulletproof I can confirm that some windows that had been suspended with The Great Suspender recently did not survive a chrome crash - TGS was unable to restore them. So frankly, I think the idea of Tabs Outliner is superior to TGS even though it doesn't have the cute anime eyes. Good luck everyone, I do hope some resolution is found and the new pruchaser just turns out to be clueless, but I doubt it. Injecting anything into my data along with the other scary stuff mentioned by others is just not acceptable when I use this computer for work. I feel better without TGS.

skycafemix picture skycafemix on 4 Nov 2020

This is concerning, so I too have migrated away from The Great Suspender. I can recommend Tabs Outliner as a good replacement.

dmuth picture dmuth on 5 Nov 2020
👍2

Thanks guys!!! I think that's definitely the kind of extension I was looking for due to my heavy use of tabs and "contexts" (i.e. links open from the same page). Will try & adopt for sure!!!

maxxyme picture maxxyme on 5 Nov 2020
👍1

For anyone who is concerned by the "stealth tracking" (i.e. it not being mirrored on Github for some reason), you can always install from source. It is easy: go to chrome://extensions, enable developer mode, click "Load unpacked extension" and point it to the src folder from this repo. Done!

HOWEVER, I DON'T SEE THE CURRENT ISSUE (in itself) AS A REASON TO FREAK OUT:

  1. The third-party JS is loaded from OpenWebAnalytics CDN, so it should not be able to do anything bad? I'm not 100% sure, but:
  2. It does not even get loaded if you tick that "Automatic deactivation of any kind of tracking" checkbox in settings:
var owa_baseUrl = 'https://cdn.owebanalytics.com/';
var owa_cmds = owa_cmds || [];
function loadOpenWebAnalytics(version) {
  owa_cmds.push(['trackPageView']);
  (function () {
    var _owa = document.createElement('script');
    _owa.type = 'text/javascript';
    _owa.async = true;
    _owa.src =
      owa_baseUrl +
      'owa/modules/base/js/owa.tracker-combined-latest.minified.js?siteId=klbibkeccnjlkjkiokjodocebajanakg&apikey=2cf3d852ab70d359456ce3a0aac237a3&v=' + version;
    var _owa_s = document.getElementsByTagName('script')[0];
    _owa_s.parentNode.insertBefore(_owa, _owa_s);
  })();
}

function init() {
  if (!gsStorage.getOption('trackingOptOut')) {
    loadGoogleAnalytics(
      window,
      document,
      'script',
      'https://www.google-analytics.com/analytics.js',
      'ga'
    );

    let details = chrome.runtime.getManifest();
    loadOpenWebAnalytics(details.version);
  }
  gsAnalytics = gsAnalytics();
}

This is from the actual extension installed from the chrome store, 'trackingOptOut' option is set by that checkbox, and loadOpenWebAnalytics() isn't referenced anywhere else.

Yes, this is weird that they "hid" it like that. Might have to do with the hardcoded siteId and apikey, or maybe they "just wanted to experiment with it" (on users' machines, yes, but how else do you experiment with tracking?)

Yes, they handled their PR horrendously, but that doesn't mean they are automatically malicious! (And actually, "any PR is good PR". If it spreads and then it gets proven they did nothing malicious, then more people might use the extension and more would donate to them.)

Personally, I'm going to use the "developer mode install" option, but not to avoid that tracking. Mostly because of #1259 and other autoupdate-related issues, as developer-mode extensions don't get autoupdated.

evg-zhabotinsky picture evg-zhabotinsky on 6 Nov 2020
👎18 🚀2 👍2

Okay, as was mentioned on the other issue, the CDN isn't affiliated with OpenWebAnalytics so it can, in theory, serve anything.
However, it can still be disabled with that checkbox.
And, technically, I don't think they are violating GPL: The extension literally is the src folder in case of this repo, you can't run it without having the sources, and it also functions substantially without the thirdparty JS library.

evg-zhabotinsky picture evg-zhabotinsky on 6 Nov 2020
👍7

@evg-zhabotinsky The GPL violation was a stretch, only important we needed a way to poke the maintainer. Further, the extension on the web store is not just the src folder of this repo: there is a significant difference in the manifest.json.

TheMageKing picture TheMageKing on 7 Nov 2020
👍1

@TheMageKing Yes, it _is_ a _modified_ version of the src folder. The point was that you received the modified "sources" when installing the extension so the modifications don't violate GPL.

evg-zhabotinsky picture evg-zhabotinsky on 7 Nov 2020

to fulfill the license terms, the sources must be complete and in the preferred form. it is not sufficient for satisfying the license that the code can be easily inspected or the complete source pieced together from different sources. this is very much a license violation that any copyright holder on the source can use as leverage, be it to get the extension out of the store, or to kill the (shell) company @deanoemcke has clearly signed an NDA with (i'm assuming that he at least checked that it _is_ a real company). a relevant association like the software freedom conservancy might help with the legalese.

on the technical side, Somebody (TM) should have a look at the jQuery code loaded by the downloaded OWA code - according to https://adguard.com/en/blog/over-20-000-000-of-chrome-users-are-victims-of-fake-ad-blockers.html that's where the malice was hidden in the previous incidents.

ossilator picture ossilator on 7 Nov 2020
👍5 👀2

Hi, I am an user of "The Great Suspender" extension for the Google Chrome browser.

My system currently has version 7.1.6 installed of the TGS. And I'm getting the pop-up tabs telling me to upgrade TGS. I do not want to upgrade TGS, much less after reading this thread here.

I have several questions:
1) Can I keep using version 7.1.6 of TGS? How do I stop it from requesting to be updated, as it is doing now in my system?
2) A general question about Google Chrome: Is it true that if I enable "developer mode" inside Google Chrome extensions settings, then no extension will be automatically updated without my manual intervention?

Spidify picture Spidify on 10 Nov 2020

2. A general question about Google Chrome: Is it true that if I enable "developer mode" inside Google Chrome extensions settings, then no extension will be automatically updated without my manual intervention?

Unfortunately you can't disable automatic updates for Chrome or its extensions.

Poopooracoocoo picture Poopooracoocoo on 10 Nov 2020
👍3
  1. Can I keep using version 7.1.6 of TGS? How do I stop it from requesting to be updated, as it is doing now in my system?

It seems the only "sane" way to stop updates to an extension is to install it from source. And it is easy: Download this repository, go to chrome://extensions, enable developer mode, click "Load unpacked extension" and point it to the src directory. Done!
To switch from one instance of extension to the other, I clicked "unsuspend all tabs in all windows" (took a while for over 100 of them), manually copied extension settings, and finally deleted the one from chrome store.

evg-zhabotinsky picture evg-zhabotinsky on 10 Nov 2020
👍2
  1. Can I keep using version 7.1.6 of TGS? How do I stop it from requesting to be updated, as it is doing now in my system?

It seems the only "sane" way to stop updates to an extension is to install it from source. And it is easy: Download this repository, go to chrome://extensions, enable developer mode, click "Load unpacked extension" and point it to the src directory. Done!
To switch from one instance of extension to the other, I clicked "unsuspend all tabs in all windows" (took a while for over 100 of them), manually copied extension settings, and finally deleted the one from chrome store.

Thanks. I'm doing as you say, and indeed it is easy to install the extension from source once you get the gist of it.

This way, I will keep using The Great Suspender version 7.1.6 installed from source, and let it be at that version. If it works, it needs no fixing nor upgrading! :-)

Spidify picture Spidify on 10 Nov 2020
👍1

If you want to report the extension you can simply write this: @TheMageKing

The extension was sold to an unknown party. This entity has "updated" the extension to v7.18 w/o publishing changes to Github. It is calling remote scripts and using remote tracking analytics, sending user information somewhere w/o user knowledge. PLEASE SEE: #1175 (comment) AND ALSO: #1175 (comment) .. Owner refuses to communicate or respond to anyone. Can only be considered as malicious/malware at this point. We have no idea what the full changes are to the code, or the ramifications of said changes.

github.com//issues/1175#issuecomment-717656189

github.com//issues/1175#issuecomment-717656189

stamstamNitzan picture stamstamNitzan on 21 Nov 2020
👍1

Any alternative packages recommended?

duoi picture duoi on 23 Nov 2020

My understanding is that 7.1.6 is the last stable one, but I am not an expert.

stamstamNitzan picture stamstamNitzan on 23 Nov 2020
👍1

I kind of just want to hop off this train altogether at this point, to be honest.

duoi picture duoi on 23 Nov 2020
👍4

Any alternative packages recommended?

I've been using Tabs Outliner for a couple of weeks now, and I'm really happy with it. I even bought the paid version!

dmuth picture dmuth on 26 Nov 2020

Same here, I have not actually deinstalled GSP yet but have told it to never sleep tabs. I will deinstall it after making sure no past history is desired (since Tabs Outliner knows about long ago slept and crashed tabs too.) Tabs Outliner is working wonderfully well (paid version) and actually has made my work faster since I need to do a lot of research online while working. With the automatic backup both local and to google (not sure where it saves though), and being able to organize pages into folders, closing windows and just opening them from the outliner window when needed it is much better organized and I no longer constantly trend back to 1000 tabs. I can close the window/tabs from Tabs Outliner and it will remember them for later.

skycafemix picture skycafemix on 26 Nov 2020

the new web store release 7.1.9 does not contain the presumably malicious code any more. that might be a reaction to the fact that MS Edge started blocking the extension. but note that the permissions in the manifest have not been revoked.

ossilator picture ossilator on 29 Nov 2020
👍9

I can confirm what @ossilator says, but my system has yet to automatically update (though the new version is listed on the chrome web store). The new version no longer loads code from owebanalytics.com, as far as I can see, but I still don't trust it.

TheMageKing picture TheMageKing on 4 Dec 2020

Why not simply sticking with the version that was before the change? It was great as far as I saw.

stamstamNitzan picture stamstamNitzan on 6 Dec 2020

Tabs Outliner is working wonderfully well (paid version) and actually has made my work faster since I need to do a lot of research online while working. With the automatic backup both local and to google (not sure where it saves though), and being able to organize pages into folders, closing windows and just opening them from the outliner window when needed it is much better organized and I no longer constantly trend back to 1000 tabs. I can close the window/tabs from Tabs Outliner and it will remember them for later.

Unfortunately since Chromium-like browsers don't allow extensions to persist tabs, Tabs Outliner too only can offer bookmarks: no scroll position, no back/forwards history.
I didn't have the best time with https://chrome.google.com/webstore/detail/scrollmark-autosave-scrol/gekidlkidjohjompjafiphdpgejjgklo?hl=en ; I didn't try https://chrome.google.com/webstore/detail/scrollmarks/dhgphpilnllknnoaafmgobkmnialglad?hl=en .

Also, I recently removed Tabs Outliner because of how much it was slowing down my Chrome. Perhaps a non-issue if you don't actually open all that many tabs at the same time.
(And there's the annoying duplication bug if you don't close all windows and rather make Chrome restore the session on startup)

Luckz picture Luckz on 7 Dec 2020

My attempt to remove tracking, notifications & permissions from the latest v7.1.8, for those interested in testing a privacy-preserving version of this plugin.

https://github.com/aciidic/thegreatsuspender-notrack

aciidic picture aciidic on 16 Dec 2020
👍7 👀3

I've also removed The Great Suspender and installed Auto Tab Discard instead. But looks like Auto Tab Discard lacks of session management feature, which was very helpful with The Great Suspender when Chrome fails to restore lost tabs after an unexpected crash/shutdown etc. Are any of you aware of a good alternative that has this feature?

If we have no alternative that has this feature, maybe we, as migraters from The Great Suspender, can create a feature request at Auto Tab Discard repo.

cagdas001 picture cagdas001 on 18 Dec 2020

Session Buddy is one alternative. Extensions to replace the session management features were discussed in the other issue @cagdas001 :)

Poopooracoocoo picture Poopooracoocoo on 18 Dec 2020

... Are any of you aware of a good alternative that has this feature? ...

You can always just install version 7.16 of The Great Suspender directly from the source. Works fine.

Because I know absolutely nothing about programming, but still didn't want the (fairly innocuous imo) Google Analytics, which was _always_ present in TGS, and the option to disable it is not present in v7.16, I opened the gsAnalytics.js file located in src\js with NotePad++ and changed line 146 from:

'https://www.google-analytics.com/analytics.js',

To:

'https://0.0.0.0/',

Which threw some error when I then installed TGS, but everything works completely as expected. All of the experienced people here, please don't be too brutal with me lmao, as I'm sure this was a very stupid way of doing things, but again.. zero knowledge of programming anything.

Version 7.16 can be obtained here:

https://github.com/greatsuspender/thegreatsuspender/releases/tag/v7.1.6

Instructions for installing it directly from the source code (very easy!) are in the README for the extension, located here:

https://github.com/greatsuspender/thegreatsuspender#install-as-an-extension-from-source

If you choose to install 7.16, make sure that you unsuspend all suspended tabs before disabling / removing the current version.

You may also/alternatively want to consider @aciidic 's fork of the extension, with analytics _properly_ (lol) and other annoyances removed, located here:

https://github.com/aciidic/thegreatsuspender-notrack

I haven't tried it yet, but definitely want to thank @aciidic for it!

Good luck.

XxX-Force picture XxX-Force on 18 Dec 2020
👍2

Perhaps unrelated, but will put here anyway. One of my friends had their email compromised in early Dec 2020 with having this extension (amongst others) installed on Chrome.

ppp-one picture ppp-one on 3 Jan 2021
👀20

I vaguely remember that newer Chrome versions automatically “suspend” tabs from RAM? So if all I care about is performance (not tab organization), why do I need an extension?

NightMachinary picture NightMachinary on 3 Jan 2021

I vaguely remember that newer Chrome versions automatically “suspend” tabs from RAM? So if all I care about is performance (not tab organization), why do I need an extension?

Because Chrome's suspension isn't terribly aggressive, isn't as efficient, and will reload a tab if you accidentally open it momentarily.

TheMageKing picture TheMageKing on 3 Jan 2021
👍2

Thanks for bringing this up. I have wiped this extension from all of my devices + sent an abuse report to Google. I at least suggest you to report abuse.

berkant picture berkant on 4 Jan 2021
👍4

there is no point in sending more abuse reports. the owner was caught, they backed out the questionable code, and until they make another attempt in presumably many months, there is no grounds for complaining to google. being a terrible maintainer is no policy violation.

as for the technical merits of TGS, it offers more control over (un-)suspension than chrome's built-ins, as @TheMageKing already pointed out. but chrome's tab discarding _is_ more effective than TGS's "classical" suspending - which is why TGS will use discarding when appropriate and enabled (option "Apply Chrome's built-in memory-saving when suspending").

ossilator picture ossilator on 4 Jan 2021
👎15 😕3

@ossilator
That sounds like a great way to get hit with malicious code X months down the line to me.

Do you really think someone who attempted to do something malicious after being caught is just going to go "oh, I guess I was doing something malicious, didn't know that, I guess I shouldn't!"?

TZer0 picture TZer0 on 4 Jan 2021
👍16 👎2

A mysterious new owner that want to remain anonymous, never interacted with the community and silently updates store's build without corresponding commits to the repo?
Right, this great extension is now officially a virus provider.

Should we point out that this extension is GPLv2 and that the new owner obviously violated the license?
How do we retaliate against license violation? Complain to GitHub? Google?

sheepdestroyer picture sheepdestroyer on 4 Jan 2021
👍27

the point is that we currently have no leverage against them, as they aren't violating any webstore requirements (not even the license, see your #1288). and until they provably carry out an attack which gets them banned, the 2+ million users will remain vulnerable to that attack. google clearly considers that acceptable, as otherwise they'd have already acted. one can only hope that internally they flagged the extension, so they'd block any update that appears even
slightly suspicious.

of course i installed the extension from git, but this is a luxury only a few privileged people can afford.

ossilator picture ossilator on 4 Jan 2021
👍10

Well this is terrifying. I'm no infosec guru, but if someone's pushing releases without updating the git or even the manifest, I'd be shutting the whole thing down NOW, no one in or out (metaphorically, in this case)
Is there any way to shut them out, or will we have to Martin Luther the repo?

Willt125 picture Willt125 on 4 Jan 2021
👍10 😄1

I'm not sure anyone really notified Google.

mihaimaruseac picture mihaimaruseac on 4 Jan 2021

I sent a report to Google via the "Report abuse" ("Missbrauch melden" in German) button on extension page. I'm sure that I'm not the only one.

Everyone who also reported the extension to Google could react to this comment with a rocket 🚀 reaction.

sbusch picture sbusch on 4 Jan 2021
🚀45 👍7

the point is that we currently have no leverage against them, as they aren't violating any webstore requirements (not even the license, see your #1288). and until they provably carry out an attack which gets them banned, the 2+ million users will remain vulnerable to that attack. google clearly considers that acceptable, as otherwise they'd have already acted. one can only hope that internally they flagged the extension, so they'd block any update that appears even
slightly suspicious.

of course i installed the extension from git, but this is a luxury only a few privileged people can afford.

Would Google have previous versions? This is such a clear violation of trust that it ought to be enough to pull the entire extension down.

TZer0 picture TZer0 on 5 Jan 2021

I’ve spent a bit of time inspecting the owa.tracker-combined-latest.minified.js loaded from cdn.owebanalytics.com by v7.1.8 of the extension (and removed in v7.1.9) – will have to stop now but sharing the details of my findings for others to feed back on / if someone wants to spend more time on this.

TL;DR; the code published in v7.1.8 associates this extension with other extensions that I would consider to be likely adware or malware, either because they contain things I find questionable, or are related to now-unpublished extensions that had even more questionable "phone home" features, and have been reported to inject ads.

  • As far as I can see this owa.tracker-combined-latest.minified.js file loaded in v7.1.8 is almost identical to one from the source of Open Web Analytics v1.6.2, owa.tracker-combined-min.js. There are two differences. Edit: here is the diff between v1.6.2 and the TGS version.
  • There is further minification on the file. As far as I can tell this is just more advanced JS minification, no obfuscation going on.
  • There is a hard-coded siteId, which doesn’t match the siteId set as a query parameter of the script URL in the extension’s source. Apparently this is meant to identify the property being tracked, like the Tracking ID in Google Analytics.

The siteId in question is bacakpdjpomjaelpkpkabmedhkoongbi – this is actually the ID of another extension in the Chrome Web Store called Video Downloader professional.

This one file, along with its different minification and hard-coded site id, is an exact match to the file of the same name / path served from the static.trckingbyte.com and static.trckingbyte.com domains – initially mentioned in https://github.com/greatsuspender/thegreatsuspender/issues/1175#issuecomment-717661094. Those domains are present in the source of different extensions – Auto Refresh Premium, and Stream Video Downloader. I can only guess why one extension’s ID would find itself in other extensions, on different domains – it suggests they’re related, perhaps made by the same person / group of people, but it could also be accidental.

From there, I took a look at those other extensions, starting with Video Downloader professional.

  • Video Downloader professional opens a tab onto another extension’s store page on install, Video Downloader Plus. That extension also seems to offer a SaaS online download service.
  • Both have a web page they show when attempting to download videos from YouTube, which displays ads.
  • Video Downloader professional’s store privacy policy page links to http://4kdownloader.net/, which itself references another extension ID that is no longer available on the store, kmdldgcmokdpmacblnehppgkjphcbpnn.
  • Installing that older kmdldgcmokdpmacblnehppgkjphcbpnn extension, its "YouTube download page fallback" links to a download page for a Windows .exe YouTube video downloader.
  • Oh and – comparing both the old and new extensions, the old version contained hundreds of lines of code with "phone home" / background request / chain redirect / domain blacklist features. This isn’t my area of expertise but to untrained eyes this looks as fishy as it gets, particularly since as far as I can tell the "background processing" and "video download" codes are completely independent of one-another (!?). I’ve made the source available here should someone else want to investigate: https://gist.github.com/thibaudcolas/698e737ce9065bece1f77e12ef38b782.

I’ll stop there. Googling all those extensions, there are references to malware, although it’s not always clear whether they are false positives or not. Taking a brief look at their code / sites, it’s a similar web of at-best questionable practices (unclear who the authors are, links to phishy-looking sites, lack of an apparent business model).

Back to The Great Suspender and its new-but-now-gone tracking script – the script currently served by those domains does look like an innocuous Open Web Analytics tracker script. It could well be selectively serving the innocuous script, and on occasion switch over to a more malicious payload. Or it really could just be added tracking. Based on the association with those other extensions, I’d expect TGS will eventually switch to have a similar business model – stay low-profile long enough so people here move on, then cash in on whoever is left unaware of the change of direction.

thibaudcolas picture thibaudcolas on 5 Jan 2021
❤37 👀8 🚀3

Thanks to all who have been investigating this and spreading the word about it.

We should consider that, if the new owner of the extension and this repo is indeed malicious (and, from a security perspective, one should assume hostile intent, given what's transpired so far), it's likely that the discussion on this issue will be locked and deleted by him at some point. In order to continue the investigation and preserve what's been found so far, the discussion thus far should be mirrored somewhere, and further discussion should probably be held elsewhere. Perhaps someone who's forked the repo could host an issue in their repo, or maybe it could take place on a Gist (if it's to stay on GitHub).

alphapapa picture alphapapa on 5 Jan 2021
👍7

Not perfect, but here's an imgur screenshot backup: https://imgur.com/a/q7IbkCr

Nezteb picture Nezteb on 5 Jan 2021
👍6

https://archive.is/Em1wb

https://archive.is/jdSWW

aciidic picture aciidic on 5 Jan 2021
👍2

I’ve made the source available here should someone else want to investigate: https://gist.github.com/thibaudcolas/698e737ce9065bece1f77e12ef38b782.

I'm currently going through the code and writing up a description of its behaviour, and will report back with more details soon.

joepie91 picture joepie91 on 5 Jan 2021

I've published a more readable version of the code here: https://gist.github.com/joepie91/fa55c936438bab8bb977e008e8be82f2

Most parts of the code are remotely configurable, can be rate-limited, and so on.

The general functionality of the code is:

  • Intercepts all requests to:

    • Strip out certain response headers (config.validateFields, string)

    • Strip out the Referer header from every request

    • Optionally add in a fake Referer header based on configuration rules (against the current URL, what page the request originates from, etc.)

  • Intercepts all pageloads, to:

    • Report their URLs to the API server (max. once every 2 hours per domain), but only for those domains in a remotely-configured list (/coverage API)

    • Generate a new URL, from an affiliate URL template + the request URL, then:



      • Request that URL and optionally receive a new URL in response


      • Either load that URL in the background, or in a new tab



Possible and likely usecases:

  • 'Competitor analytics', basically tracking how much traffic competitors get, by tracking requests to their sites
  • Advertising fraud (through background requests to advertising servers)
  • Adware (by opening new tabs with ads)
  • Affiliate fraud (through Referer header manipulation/injection)

__Edit:__ To be clear, these are the risks to you as the user, currently:

  • Operator may receive a log of every URL you load, ie. your browsing is not private
  • Your browser becomes involved in advertising/affiliate fraud, which may also get you blocked from sites
  • You may start seeing ads in new tabs
joepie91 picture joepie91 on 5 Jan 2021
👍17 ❤7 🚀2

@joepie91 Any risk of password capture? The permission to read/modify data is needed to be able to read out from form elements (say for a login page).

nmichaud picture nmichaud on 5 Jan 2021
👀2

@nmichaud I have not seen any code that could do so, in the code provided by @thibaudcolas, and there does not seem to be any "execute arbitrary JS" functionality in there either.

That having been said:

  • As I understand it, that code originates from a different extension (Video Downloader), and I have not verified whether the malicious code in this extension is exactly the same.
  • As long as the extension is owned by a malicious party, it's always possible for them to push an update later that can steal passwords. Likewise, they may have pushed an update that does so in the past (and removed the functionality later) that noone has noticed yet.

If the malicious code in this extension comes from the same source as Video Downloader, then most likely your passwords will not have been at risk, also because the publisher mainly seems interested in various forms of large-scale advertising fraud, and accounts aren't often useful there.

But there's no way to be 100% sure without going through the release history of the extension, and verifying that none of them contained any additional malicious code (which I unfortunately don't have the time for today).

UPDATE: This conclusion turned out to be possibly-wrong. See below.

joepie91 picture joepie91 on 5 Jan 2021
❤1

@thibaudcolas @joepie91 Thank you both for the detailed analysis! I have edited the top post to reflect it.

As for @thibaudcolas's idea that people will move on: bad news! Until I added 'urgent' to the title, the thread basically died: people have been reporting other, new issues to the repository, which tells me nobody notices when it just says "security". In short, they're doing quite well at acheiving their goal of 'getting everyone to forget', by literally doing nothing.

That said, @joepie91, keep in mind that the suspicious code posted by @thibaudcolas isn't part of the extension. The extension (contained) code to download and execute javascript from a remote, suspicous-looking server: that is what you analyzed. It is already executing arbitrary JS; and while the latest update removed that (we think), it can be brought back anytime.

TheMageKing picture TheMageKing on 5 Jan 2021
👍4

That said, @joepie91, keep in mind that the suspicious code posted by @thibaudcolas isn't part of the extension. The extension (contained) code to download and execute javascript from a remote, suspicous-looking server: _that_ is what you analyzed. It is already executing arbitrary JS; and while the latest update removed that (we think), it can be brought back anytime.

Aha, I missed that detail. In that case, yes, it's possible that anything could have been run, including password-stealing code :(

(It actually kind of baffles me that extensions are allowed to access the extension API from downloaded code, then, but that's a whole separate discussion...)

joepie91 picture joepie91 on 5 Jan 2021

it's likely that the discussion on this issue will be locked and deleted by him at some point

Possible, but that would basically instantly confirm the suspicion, and the majority of possibly targeted users that are less tech-savvy would not see this thread anyway. It seems zero communication would actually be an effective strategy given malicious intent, which makes it even more valuable that there are people monitoring and analyzing the releases :clap:

jeysal picture jeysal on 5 Jan 2021
👍1

@thibaudcolas @joepie91 Thank you both for the detailed analysis! I have edited the top post to reflect it.

As for @thibaudcolas's idea that people will move on: bad news! Until I added 'urgent' to the title, the thread basically died: people have been reporting other, new issues to the repository, which tells me nobody notices when it just says "security". In short, they're doing quite well at acheiving their goal of 'getting everyone to forget', by literally doing nothing.
[snip]

No doubt you're all already aware, but this was circulated by a number of Infosec Twitter accounts yesterday, which is how I learned of it, so it's getting some wider exposure.

furettino picture furettino on 5 Jan 2021

But there's no way to be 100% sure without going through the release history of the extension, and verifying that none of them contained any additional malicious code (which I unfortunately don't have the time for today).

Also since they control the endpoint where the code was fetched, they could have substituted a malicious payload at any time and likely it would never be caught (I wonder how much data is provided by client-side fetch code - like the recent event-stream issue (https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/hacker-infects-node-js-package-to-steal-from-bitcoin-wallets), its possible this change could have been targeted at a particular user of TGS).

nmichaud picture nmichaud on 5 Jan 2021
👍2

No doubt you're all already aware, but this was circulated by a number of Infosec Twitter accounts yesterday, which is how I learned of it, so it's getting some wider exposure.

Yes it is now in Life Hacker. Keeping the new maintainer's identity secret is downright irresponsible and unethical given the likelihood of a malicious maintainer and the extension having over 1M+ installs.

dismantl picture dismantl on 5 Jan 2021
👍10

I ended up just makeing my own version from before the new maintainer took over, see: https://github.com/wylie39/Thesuspender

I tried to submit it to the Webstore but got denied because it was too similar.

wylie39 picture wylie39 on 5 Jan 2021

Picking this back up – I went back to the owa.tracker-combined-latest.minified.js that was loaded by v7.1.8 of the extension, and found more definitive evidence that this is indeed _not_ Open Web Analytics, but another application trying to pass for it.

Inspecting the response headers, rather than the actual script:

$ curl -I 'https://cdn.owebanalytics.com/owa/modules/base/js/owa.tracker-combined-latest.minified.js?siteId=klbibkeccnjlkjkiokjodocebajanakg&apikey=2cf3d852ab70d359456ce3a0aac237a3&v=7.1.8'
HTTP/1.1 200 OK
Server: nginx/1.16.1
Date: Tue, 05 Jan 2021 22:21:49 GMT
Content-Type: text/javascript; charset=utf-8
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Expose-Headers: Set-Cookie,Content-Type
Set-Cookie: sjkid=679c4ee0-4fa4-11eb-aa0b-9d2325fcbc69; Path=/; Expires=Mon, 13 Nov 2023 14:21:49 GMT; Secure; SameSite=None
Allow: GET
Vary: Accept-Encoding
Via: 1.1 vegur

Massive red flags: X-Powered-By: Express (served by Node.js), and setting a sjkid cookie. OWA is PHP-based, and doesn’t set any cookies when serving its tracker script.

Here are the response headers of a legit OWA implementation for reference,

$ curl -I http://www.openwebanalytics.com/wp-content/plugins/owa/modules/base/js/owa.tracker-combined-min.js
HTTP/1.1 200 OK
Date: Tue, 05 Jan 2021 22:27:37 GMT
Server: Apache
Upgrade: h2
Connection: Upgrade
Last-Modified: Wed, 13 May 2020 01:41:52 GMT
ETag: "12bf6-5a57daf375e4c"
Accept-Ranges: bytes
Content-Length: 76790
Cache-Control: max-age=2592000
Expires: Thu, 04 Feb 2021 22:27:37 GMT
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript

There are valid reasons for some headers to differ when serving static files, but not those headers. To corroborate all of this I also loaded the extension in a sandboxed Chrome and inspected its fake tracking pixel requests. The request to log.php looks like what a normal OWA client would send, but the response doesn’t match what the OWA backend is meant to serve.

TGS fake tracking pixel log.php response vs real OWA implementation

curl -I 'https://cdn.owebanalytics.com/log.php?owa_timestamp=1609886290&owa_event_type=base.page_request&owa_visitor_id=1609886217541603325&owa_fsts=1609886217&owa_dsfs=0&owa_last_req=1609886217&owa_session_id=1609886217488590504&owa_nps=1&owa_dsps=0&owa_medium=direct&owa_source=%28none%29&owa_search_terms=%28none%29&owa_session_referer=%28none%29&owa_page_url=chrome-extension%3A%2F%2Fgkgkjnibjgollfdknieejhejimddigep%2F_generated_background_page.html&owa_HTTP_REFERER=&owa_page_title=&owa_site_id=&' \
  -H 'Connection: keep-alive' \
  -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4379.0 Safari/537.36' \
  -H 'Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8' \
  -H 'Sec-Fetch-Site: none' \
  -H 'Sec-Fetch-Mode: no-cors' \
  -H 'Sec-Fetch-Dest: image' \
  -H 'Accept-Language: en-GB,en-US;q=0.9,en;q=0.8' \
  -H 'Cookie: sjkid=84211c60-4fa6-11eb-a0f4-45a5ca107f8d' \
  --compressed
HTTP/1.1 200 OK
Server: nginx/1.16.1
Date: Tue, 05 Jan 2021 22:43:10 GMT
Connection: keep-alive
X-Powered-By: Express
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Expose-Headers: Set-Cookie,Content-Type
Via: 1.1 vegur

And the real OWA instance – that serves a 1px GIF as expected:

curl -I 'http://www.openwebanalytics.com/wp-content/plugins/owa/log.php?owa_timestamp=1609883437&owa_event_type=base.page_request&owa_user_name=&owa_page_type=Search+Results&owa_page_title=Search+Results+for+%22node%22&owa_visitor_id=1609882775092400392&owa_fsts=1609882775&owa_dsfs=0&owa_last_req=1609882859&owa_session_id=1609882775856888878&owa_nps=0&owa_dsps=0&owa_medium=direct&owa_source=%28none%29&owa_search_terms=%28none%29&owa_session_referer=%28none%29&owa_site_id=b07455aa2c46698dbb2d053f96447dfb&owa_page_url=http%3A%2F%2Fwww.openwebanalytics.com%2F%3Fs%3Dnode&owa_HTTP_REFERER=http%3A%2F%2Fwww.openwebanalytics.com%2Fabout%2F&' \
  -H 'Connection: keep-alive' \
  -H 'Pragma: no-cache' \
  -H 'Cache-Control: no-cache' \
  -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36' \
  -H 'Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8' \
  -H 'Referer: http://www.openwebanalytics.com/?s=node' \
  -H 'Accept-Language: en-US,en;q=0.9,fi;q=0.8,fr;q=0.7,ja;q=0.6' \
  -H 'Cookie: owa_v=cdh%3D%3Ee888e24d%7C%7C%7Cvid%3D%3E1609882775092400392%7C%7C%7Cfsts%3D%3E1609882775%7C%7C%7Cdsfs%3D%3E0%7C%7C%7Cnps%3D%3E0; owa_s=cdh%3D%3Ee888e24d%7C%7C%7Clast_req%3D%3E1609883437%7C%7C%7Csid%3D%3E1609882775856888878%7C%7C%7Cdsps%3D%3E0%7C%7C%7Creferer%3D%3E%28none%29%7C%7C%7Cmedium%3D%3Edirect%7C%7C%7Csource%3D%3E%28none%29%7C%7C%7Csearch_terms%3D%3E%28none%29' \
  --compressed \
  --insecure
HTTP/1.1 200 OK
Date: Tue, 05 Jan 2021 22:42:15 GMT
Server: Apache
Content-encoding: none
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Expires: Wed, 11 Jan 2000 12:59:00 GMT
Pragma: no-cache
Upgrade: h2
Connection: Upgrade, Keep-Alive
Content-Length: 42
Last-Modified: Wed, 11 Jan 2006 12:59:00 GMT
Vary: User-Agent
Keep-Alive: timeout=2, max=100
Content-Type: image/gif

And for a final quick check – looking at the real OWA’s source code, its log.php requests are meant to serve a redirect on POST requests. That makes it pretty easy to spot the fakes:

# Real OWA, redirecting as expected.
$ curl -I -X POST http://www.openwebanalytics.com/wp-content/plugins/owa/log.php
HTTP/1.1 302 Found
# Fake OWA, 200 OK.
$ curl -I -X POST https://cdn.owebanalytics.com/log.php
HTTP/1.1 200 OK
thibaudcolas picture thibaudcolas on 6 Jan 2021
👀14 👍6

Extension shops and package managers really ought to consider the option of installing from a source repo or checking the compiled/minified checksum against something generated by AppVeyor or similar whenever that's an option.

reinux picture reinux on 6 Jan 2021
👍4

Also google should stop automatic updates of extensions.

On Wed, Jan 6, 2021, 10:33 AM reinux notifications@github.com wrote:

Extension shops and package managers really ought to consider the option
of installing from a source repo or checking the compiled/minified checksum
against something generated by AppVeyor or similar whenever that's an
option.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/greatsuspender/thegreatsuspender/issues/1263#issuecomment-755369546,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AAE6H7WKLZE34YBYCZHAZQDSYR7FXANCNFSM4TI37TGQ
.

nmichaud picture nmichaud on 6 Jan 2021
👍17 👎2

Also google should stop automatic updates of extensions.

I think in general, automatic updates are good, but there should be a method of disabling updates for a specific extension.

gideontong picture gideontong on 6 Jan 2021
👍5

Saw this on The Register site. Thanks for helping raise awareness.

SoftWyer picture SoftWyer on 7 Jan 2021
👍5

Isn't this GPL/LGPL licenced software? Why doesn't some interested person clone this repository and create a new extension called "The Awesome Suspender" and relaunch it and we could maybe gain some of that trust back. Maybe some rebranding might be necessary because of copyrights. But it's not like there is a shortage of open source designers who might create a new logo for free.

Isn't that the best idea? Instead of constantly being scared that this developer will pull another malicious stunt. Of course you'd have to then put your trust in another possibly unknown third party entity that you also don't know. But perhaps if that new person/company is communicative and makes the right steps forward, trust can be gained back.

You already have zero trust right now, so even if I clone the repo, you can at least look at my work online, see my history in google etc, email me and probably I'd reply to you. Etc. etc. 1% trust is greater than 0%, right?

christhomas picture christhomas on 7 Jan 2021

@christhomas unfortunately google has declined a few people's submissions as it's "too similar". not including malware is a massive difference tho if you ask me

Poopooracoocoo picture Poopooracoocoo on 7 Jan 2021

@christhomas And even if posting a clean fork to Google Web Store was allowed by Google, that would not be of much help to the million+ current users unaware of the situation and still blindly trusting the old extension

sheepdestroyer picture sheepdestroyer on 7 Jan 2021

In an ideal dream world, there'd be a way to link an extension/app/gadget to its associated repo, and it's _really hard_ to unlink them.
Once linked, the ONLY way to push a release is through the repo.
. . Not sure how practical that would be, but it's a thought.

Willt125 picture Willt125 on 7 Jan 2021
👍2

In an ideal dream world, there'd be a way to link an extension/app/gadget to its associated repo, and it's _really hard_ to unlink them.
Once linked, the ONLY way to push a release is through the repo.
. . Not sure how practical that would be, but it's a thought.

this would be easily possible but the problem is:
1) Not all extensions want to be OS
2) You can send a release with code not built from the repo

S10MC2015 picture S10MC2015 on 7 Jan 2021

this would be easily possible but the problem is:
1) Not all extensions want to be OS
2) You can send a release with code not built from the repo

😔
Yeah, it definitely wasn't a fleshed out thought, but it at the very least makes it harder to slip them past other maintainers

Willt125 picture Willt125 on 7 Jan 2021

Isn't this GPL/LGPL licenced software?

That's... a good point, actually. This extension includes code from external contributors, which means that the original author cannot have transferred the full copyright to the buyer of the extension.

Which means that the mysterious buyer is violating the license, and therefore its copyright. Which means that any of the contributors could sue the buyer, whether their identity is known or not.

joepie91 picture joepie91 on 7 Jan 2021

That’s not a license violation unless the L/GPL was violated. If you contribute code or include other LGPL code then it’s fine.

So it depends on the circumstances. Do you know any specifics?
On 7. Jan 2021, 15:10 +0100, Sven Slootweg notifications@github.com, wrote:

Isn't this GPL/LGPL licenced software?
That's... a good point, actually. This extension includes code from external contributors, which means that the original author cannot have transferred the full copyright to the buyer of the extension.
Which means that the mysterious buyer is violating the license, and therefore its copyright. Which means that any of the contributors could sue the buyer, whether their identity is known or not.
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub, or unsubscribe.

christhomas picture christhomas on 7 Jan 2021

I think the violation is releasing a new version of TGS with additional
code (the tracking code) but not providing that code as required under the
GPL license.

On Thu, Jan 7, 2021 at 9:31 AM Christopher Thomas notifications@github.com
wrote:

That’s not a license violation unless the L/GPL was violated. If you
contribute code or include other LGPL code then it’s fine.

So it depends on the circumstances. Do you know any specifics?
On 7. Jan 2021, 15:10 +0100, Sven Slootweg notifications@github.com,
wrote:

Isn't this GPL/LGPL licenced software?
That's... a good point, actually. This extension includes code from
external contributors, which means that the original author cannot have
transferred the full copyright to the buyer of the extension.
Which means that the mysterious buyer is violating the license, and
therefore its copyright. Which means that any of the contributors could sue
the buyer, whether their identity is known or not.
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub, or unsubscribe.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/greatsuspender/thegreatsuspender/issues/1263#issuecomment-756151579,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AAE6H7RGTRQOKMXS3C73Z63SYXAUVANCNFSM4TI37TGQ
.

--

Naveen Michaud-Agrawal

nmichaud picture nmichaud on 7 Jan 2021

Google is apparently releasing a new Manifest v3 extension API that'll kill WebRequest. Anyone know what the effect of this will be on TGS or the tracker it calls?

I'm wondering if maybe this is why they aren't bothering to remove TGS from the store, or if they genuinely just don't care -- even though it still doesn't excuse the fact that they aren't immediately taking action on something this dangerous and widespread.

reinux picture reinux on 7 Jan 2021

Thanks for this detailed summary, everyone! Quick question that I'm hoping someone might be able to help resolve. I'm currently working on a project that forced me to have dozens of tabs open in chrome (so many moving parts). However now that Chrome has blocked The Great Suspender, all of my suspended tabs are broken since the extension is no longer enabled. I've downloaded the source code from this repo and loaded the extension unpacked (tag 7.1.6), however the tabs that were suspended are still broken due to the chrome extension namespace being different. I see there is an option to load sessions from within TGS's UI, but I don't know where or if TGS stores those sessions so that I can restore the suspended tabs with the unpacked extension. Does anyone know if this is even possible or am I SOL?

briantully picture briantully on 7 Jan 2021

Chrome has now blocked "The Great Suspender"?

nmichaud picture nmichaud on 7 Jan 2021
👍2

I can still search for TGS in (German) chrome web store, and add it ("Hinzufügen"):

image

sbusch picture sbusch on 7 Jan 2021

Thanks for this detailed summary, everyone! Quick question that I'm hoping someone might be able to help resolve. I'm currently working on a project that forced me to have dozens of tabs open in chrome (so many moving parts). However now that Chrome has blocked The Great Suspender, all of my suspended tabs are broken since the extension is no longer enabled. I've downloaded the source code from this repo and loaded the extension unpacked (tag 7.1.6), however the tabs that were suspended are still broken due to the chrome extension namespace being different. I see there is an option to load sessions from within TGS's UI, but I don't know where or if TGS stores those sessions so that I can restore the suspended tabs with the unpacked extension. Does anyone know if this is even possible or am I SOL?

Having Google blocked TGS the only way I can see is extract the original URL from the TGS URL in every page (query parameter 'url', if I'm not wrong).

I was lucky to replace it this morning with a local version, all I had to do was to resume every tab with the original TGS, turn original TGS off in extensions and enable the local TGS version.

cverond picture cverond on 7 Jan 2021
👍2

Having Google blocked TGS the only way I can see is extract the original URL from the TGS URL in _every_ page (query parameter 'url', if I'm not wrong).

Oh wow, how did I not see that in the address bar! Thank you so much, @cverond -- you're a lifesaver! 🍺 🍺 🍺

briantully picture briantully on 7 Jan 2021
🎉2

I kind of want to point out that you can probably use a plugin like URL Rewriter to do it semi-automatically if you have hundreds of tabs like I do, but that's another extension, so...

reinux picture reinux on 7 Jan 2021
👍1

Having Google blocked TGS the only way I can see is extract the original URL from the TGS URL in _every_ page (query parameter 'url', if I'm not wrong).

If you have a lot of tabs, here's the code I wrote to make my tab manager compatible with TGS:

https://github.com/njnmco/odinochka/blob/65d7d9775c143a0c7086b8b751fbf8e9a6bd67a2/background.js#L77-L83

You can use either use the snippet directly via the console, or load the extension, save all the tabs to it, and reopen all the tabs.

nfultz picture nfultz on 7 Jan 2021
👍1

I think the violation is releasing a new version of TGS with additional code (the tracking code) but not providing that code as required under the GPL license.

Indeed, that is what I am referring to.

joepie91 picture joepie91 on 7 Jan 2021
👍1

Having Google blocked TGS the only way I can see is extract the original URL from the TGS URL in _every_ page (query parameter 'url', if I'm not wrong).

If you have a lot of tabs, here's the code I wrote to make my tab manager compatible with TGS:

https://github.com/njnmco/odinochka/blob/65d7d9775c143a0c7086b8b751fbf8e9a6bd67a2/background.js#L77-L83

You can use either use the snippet directly via the console, or load the extension, save all the tabs to it, and reopen all the tabs.

Hey, if it is ok, can I make a mini extension out of your code and publish it as something like Great Unsuspender (if I manage to figure out how chrome extensions and js works)?

function cleanTabData() {
    if(document.URL.startsWith("chrome-extension") &&
       document.URL.indexOf("/suspended.html#") > -1) {
            unsuspendurl = document.URL.substr(document.URL.lastIndexOf("&uri=")+5);
    }
    return unsuspendurl;
}
S10MC2015 picture S10MC2015 on 7 Jan 2021
👍2

Hey, if it is ok, can I make a mini extension out of your code and publish it as something like Great Unsuspender (if I manage to figure out how chrome extensions and js works)?

Sure, feel free. You can email me if you have any questions.

nfultz picture nfultz on 7 Jan 2021

To raise attention with Google, when you remove the extension, also 'Report Abuse', select 'harmful to computer/data' and in the comments reference this issue, the Register article, and/or the Lifehacker article. A few hundred reports should count as a signal to get a human to look at it.

image

whereisaaron picture whereisaaron on 8 Jan 2021
👍6

Okay, so I made a bunch of updates to the top post, to reflect the Latest News (tm), and to help onboard people new to the issue better.

TheMageKing picture TheMageKing on 8 Jan 2021
❤3

@TheMageKing The new update looks good; however, I would not recommend OneTab to people or link to it. Although it didn't execute remote code, it does have some similar (and worse) tracking / privacy issues - I mentioned this on the other GH issue.

nfultz picture nfultz on 8 Jan 2021
👍5

I would also not recommended onetab for the fact that you can randomly lose
all of your tabs with no way to recover.

On Fri, 8 Jan 2021, 15:56 Neal Fultz, notifications@github.com wrote:

@TheMageKing https://github.com/TheMageKing The new update looks good;
however, I would not recommend OneTab to people or link to it. Although it
didn't execute remote code, it does have some similar (and worse) tracking
/ privacy issues - I mentioned this on the other GH issue.

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
https://github.com/greatsuspender/thegreatsuspender/issues/1263#issuecomment-756832316,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AHJITPBHDSYEPIPYRROG2JDSY4TLNANCNFSM4TI37TGQ
.

S10MC2015 picture S10MC2015 on 8 Jan 2021
👍2

So by precaution I am stopping to use the extension deployed on Chrome Store. But what about building the extension by myself and installing myself. Did anyone audit the current source code? Good or no good?

PxSonny picture PxSonny on 9 Jan 2021

i didn't do a full audit, but looked at the git commits since the owner transfer, and i didn't see anything fishy in there.

mind my comment if you want to switch while having suspended tabs (use session buddy or some such to carry over that session).

ossilator picture ossilator on 9 Jan 2021

Apparently it is already removed/deactivated for some users on chrome (possibly by region?), but the best way to let new people know is by seeing/leaving a review.

BUT the only way to get these negative reviews actually _seen_ is to rate them helpful. If you have time, go to the reviews tab, sort by recent, and mark the reviews helpful if they point out it's malware: https://chrome.google.com/webstore/detail/the-great-suspender/klbibkeccnjlkjkiokjodocebajanakg

Hopefully this prevents new people from installing the extension if it hasn't been blocked yet in their region.

RachelScodes picture RachelScodes on 14 Jan 2021
👍7 ❤5

While we’re at it, here is a list of related malicious extensions I’ve been putting together, in case people here are using them / want to report more:

All of these have their own tracking domain set up, all serving the same fake owa.tracker-combined-latest.minified.js as described in https://github.com/greatsuspender/thegreatsuspender/issues/1263#issuecomment-754683847.

I don’t think there is a way to batch-search the source of many extensions unfortunately, aside from Google doing it themselves. If they do I’m sure they should have no problem finding even more. The list above are only the ones I’ve confirmed to contain the same malicious code in their latest version as of today. All in all so far I found 12 extensions that seem to be maintained by this same group.

If you’re wondering how they work, someone on reddit described the type of malware/adware they got with the Ratings Preview extension. This description matches the findings from @joepie91 https://github.com/greatsuspender/thegreatsuspender/issues/1263#issuecomment-754683847 on another (now unpublished) extension that appears to have been built by the new maintainers of TGS.

thibaudcolas picture thibaudcolas on 15 Jan 2021
👍23 ❤5

@thibaudcolas That's fantastic, thank you for sharing that. I did a writeup for the UAS compromise but I think it was a different group.

Like I wrote in my doc, more of this could get detected earlier and easier if Google allowed peer review for extensions rather than keeping it in house, where submissions often sit in the review queue for weeks. You've clearly put more effort into figuring out what the extensions actually do than they have.

nfultz picture nfultz on 15 Jan 2021
❤2

Not sure if anything changed but still comes up for me in the web store (including in incognito tab just searching by name). Possibly reinstated with the version update?
https://chrome.google.com/webstore/detail/the-great-suspender/klbibkeccnjlkjkiokjodocebajanakg

Honestly, I look at the code of all extensions before I install them now, and so many of them have tracking code it's rediculous. And I'm not talking about just small amounts, many of them, the amount of tracking code exceeds the actual functionality of the extension's code.

While it won't be a permanent replacement for TGS, Chrome's new Tabs Groups Collapse Freezing seems like a pretty interesting substitute (warning still experimental and not stable for daily use yet: chrome://flags/#tab-groups-collapse-freezing)

minig0d picture minig0d on 15 Jan 2021

For what it's worth, I've been running the notrack version of this plugin that I published without any reported issues since its release - on a corporate network.

Github API shows over 600 downloads so I am happy to have provided, to those who could not do without this plugin, a no-nonsense version that is without tracking or "anonymous" statistical data collection.

aciidic picture aciidic on 17 Jan 2021
🚀2

For what it's worth, I've been running the notrack version of this plugin that I published without any reported issues since its release - on a corporate network.

Github API shows over 600 downloads so I am happy to have provided, to those who could not do without this plugin, a no-nonsense version that is without tracking or "anonymous" statistical data collection.

Also worth noting that I included instructions, on my readme, on how to automatically install the plugin to your Windows clients via group policy.

aciidic picture aciidic on 17 Jan 2021
🚀1

For what it's worth, I've been running the notrack version of this plugin that I published without any reported issues since its release - on a corporate network.

Github API shows over 600 downloads so I am happy to have provided, to those who could not do without this plugin, a no-nonsense version that is without tracking or "anonymous" statistical data collection.

I definitely applaud the effort! Unfortunately, I think the vast majority won't switch over unless it's in the chrome store

I skimmed the code for the latest version and it does look like it was reverted to Google Analytics... and the analytics do appear to be correctly disabled when you check the box in preferences... My only qualm with it is that once this kind of thing happens its hard to trust them ever again...

But honestly, have you tried chrome lately without this ext? I've been running it the past few days and the built in memory management is MUCH better than it used to be. With TGS, suspended tabs seem to use about 30MB ram (without screenshots enabled)... unsuspended now in chrome they are hovering at 45MB... not great and not as good as Chromium Edge... but better than I've ever seen Chrome.

minig0d picture minig0d on 17 Jan 2021
👍1

I appreciate the notrack version, but I need something easy-to-install from the Chrome Webstore as well for friends/family. Could this version be viable?

https://github.com/gioxx/MarvellousSuspender
https://chrome.google.com/webstore/detail/the-marvellous-suspender/noogafoofpebimajpfpamcfhoaifemoa

skoshy picture skoshy on 20 Jan 2021

For what it's worth, I've been running the notrack version of this plugin that I published without any reported issues since its release - on a corporate network.

Github API shows over 600 downloads so I am happy to have provided, to those who could not do without this plugin, a no-nonsense version that is without tracking or "anonymous" statistical data collection.

I appreciate the notrack version, but I need something easy-to-install from the Chrome Webstore as well for friends/family. Could this version be viable?

https://github.com/gioxx/MarvellousSuspender
https://chrome.google.com/webstore/detail/the-marvellous-suspender/noogafoofpebimajpfpamcfhoaifemoa

@aciidic considering marvelous managed to get through you may be able to publish by calling your thing something like "notrack suspender"

S10MC2015 picture S10MC2015 on 20 Jan 2021
👍3

I appreciate the notrack version, but I need something easy-to-install from the Chrome Webstore as well for friends/family. Could this version be viable?

https://github.com/gioxx/MarvellousSuspender
https://chrome.google.com/webstore/detail/the-marvellous-suspender/noogafoofpebimajpfpamcfhoaifemoa

I'm really surprised they allowed it... would have to diff the extension with the original to confirm if anything has been altered but it may be. I guess the question is whether the fork and republication is permitted under the licensure terms, or if the author is just planning on reporting it and it being taken back down.

Side rant: I wish Google permitted third party repositories (aside from GPO)... As much stuff as I've found validating published extensions, the chrome store can't be much better than nothing...

IMO I will either
1) probably just pack my own .crx with known good code and sideload it for a handful of family... (i.e. no chrome store url in the manifest so it can't auto update) OR
2) setup a site monitor on the webstore page to get notified if the new publisher decides to update the extension in the future so the code can be reviewed...

Side question: has there been any indication that the new owner actually intends to ever update this? Or was it just one of those attempts to acquire a bunch of users for another reason? I suspect chrome's internal memory handling will continue to be much better given the latest changes and so hopefully one of these routes holds us over until then...

minig0d picture minig0d on 20 Jan 2021

FWIW I snatched the crx (compiled extension) off the chrome webstore and it does appear to be identical to what you see on github (in the top 2 screenshots the left is the zip from github, right is the extracted crx).

I have NOT done a thorough review, of the code, but third screenshot is a diff of gsAnalytics.js from The Marvelous ext and right is from 7.1.9 of TGS that's currently on the chrome store... you can see where TGS does implement an opt out. (the GA token doesn't appear to have been changed so whoever forked it doesn't seem like this was intentional, it was just forked from a version prior to the opt out. Again I have NOT done a thorough review and the analytics may be neutered in a different part of the script and the script was included in the package is all I can say about the fork.

2021-01-20_11h20_37
2021-01-20_11h22_13
2021-01-20_11h27_03

minig0d picture minig0d on 20 Jan 2021
👍1

Side rant: I wish Google permitted third party repositories (aside from GPO)... As much stuff as I've found validating published extensions, the chrome store can't be much better than nothing...

The Chrome Extension Store is chronically under-staffed, can often take several weeks to get a review. After they turn off payment processing at the end of the month, basically admitting they will never make money on it, I hope they open it up to community peer review instead. And to be fair, addons.mozilla.org is not really any better.

nfultz picture nfultz on 20 Jan 2021

For anyone looking for an alternative (and who isn't completely anti Microsoft), MS Edge is actually chromium based, and has this feature built in, it's called "sleeping tabs", and is available in Edge 88 (currently beta channel I believe). You can also now install all your other favorite extensions because they allow installing from the Chrome Web store

figadore picture figadore on 23 Jan 2021

RE: https://github.com/greatsuspender/thegreatsuspender/issues/1263#issuecomment-766141562 some more details on 'tab sleeping'/'tab freezing':

https://www.tenforums.com/tutorials/165231-how-enable-disable-sleeping-tabs-microsoft-edge-chromium.html

Sleeping tabs builds upon the core of Chromium’s “freezing” technology. Freezing pauses a tab’s script timers to minimize resource usage. A sleeping tab resumes automatically when clicked, which is different than discarded tabs, which require the page to fully be reloaded.

Microsoft built upon the freezing technology to create sleeping tabs. This feature allows inactive background tabs to “go to sleep,” releasing system resources after a set amount of time. These resources include both memory and CPU and can be used for new or existing tabs or other applications running on your device.

By default, Microsoft set tabs to go to sleep after two hours of inactivity. If two hours isn’t right for you, you can choose a different time interval. Tabs that are asleep will fade to let you know they’ve released resources. To resume a sleeping tab, click on it like a normal tab. The tab will un-fade and your content will be there immediately. You can also add sites you never want to sleep to a block list in Settings.

https://www.zdnet.com/article/microsoft-heres-how-edges-new-sleeping-tabs-will-save-your-laptop-battery-life/

In Chrome, tab freezing works by unloading all tabs that have been inactive for more than five minutes. This frees up CPU and RAM system resources for other tabs or other locally-running apps.

Users will be able to see if a tab is asleep because the tab will be faded. In Edge, the default is for tabs to go to sleep after two hours of inactivity but users can set a different time and set sites they never want to go to sleep in edge://settings/system.

The feature is coming soon to the Canary and Dev Channels [87.0.649.0]. Before rolling it out to Stable channel, Microsoft is looking for feedback.

https://www.howtogeek.com/444481/how-chromes-tab-freezing-will-save-cpu-and-battery/

Google is working on a new “Tab Freeze” feature for Chrome, which will pause (freeze) tabs you’re not using. That means lower CPU usage, a faster browser, and longer battery life on a laptop or convertible.

Tab freezing is different from tab discarding. When a tab is frozen, its contents stay in your system’s memory. However, the tab’s contents will be “frozen.” The web page in the tab won’t be able to use CPU or perform actions in the background. For example, let’s say you have a heavy web page open in a tab somewhere, and it’s continually running scripts. After a while, Chrome will automatically “freeze” it and stop it from performing actions until you interact with it again.

Tab Freezing is an experimental feature. It’s built into current stable versions of Chrome 77, but can only be initiated manually. In Chrome Canary builds of the upcoming Chrome 79, Chrome will be able to automatically freeze tabs just like it can automatically discard them.

In Chrome Canary, several options are available for tab freezing if you head to chrome://flags and search for “Tab Freeze.” With this option enabled, Chrome will automatically freeze “eligible” tabs after they’ve been in the background for five minutes. Depending on which option you choose, Chrome can either leave them frozen or unfreeze them for ten seconds every fifteen minutes—just enough time to sync with a server or get a bit of work done if they need it. Google is clearly testing which option is best.

The current stable version of Chrome lets you play with both features if you want to know how they work. Just type chrome://discards in Chrome’s Omnibox and press Enter.

You’ll see a diagnostic page with a list of your open tabs and whether they can be frozen or discarded. On the right side of the page, you’ll see action links to “Freeze” and “Discard” each tab.

https://www.zdnet.com/article/chrome-79-released-with-tab-freezing-back-forward-caching-and-loads-of-security-features/

0xdevalias picture 0xdevalias on 24 Jan 2021
👍2

For everyone lazy, can anyone in the discussion tell in short - is the latest version of this extension NOW, at the time of writing, IS of any concern to security or privacy (please, don't say something like "there is no software without privacy issues nowadays") or IS NOT?
Edge seems to keep it on their add-ons site just fine
https://microsoftedge.microsoft.com/addons/detail/the-great-suspender/engadpfihlijamplpleppgjofcmemdfe

soberich picture soberich on 28 Jan 2021

For everyone lazy, can anyone in the discussion tell in short - is the latest version of this extension NOW, at the time of writing, IS of any concern to security or privacy (please, don't say something like "there is no software without privacy issues nowadays") or IS NOT?
Edge seems to keep it on their add-ons site just fine
https://microsoftedge.microsoft.com/addons/detail/the-great-suspender/engadpfihlijamplpleppgjofcmemdfe

1) you sound a bit annoyed there why?
2) If you are using edge, USE SLEEPING TABS AND NOT TGS.
3) If you are on any other browser, do not use TGS. They seem to have removed the malicious component but they can add it back anytime and it isn't safe. It really isn't safe. Find something else or just nothing.

S10MC2015 picture S10MC2015 on 28 Jan 2021

Google is testing a native read-later button, which some may want to try out:

https://lifehacker.com/you-can-finally-save-articles-to-read-later-in-chrome-1846145758

nfultz picture nfultz on 28 Jan 2021
👍1

Google is testing a native read-later button, which some may want to try out:

https://lifehacker.com/you-can-finally-save-articles-to-read-later-in-chrome-1846145758

That's still not more than a bookmark, very far from a tab.

Luckz picture Luckz on 29 Jan 2021
👍2

While Chrome has great discarding and freezing and Edge builds upon that, neither have TGS's session management features or manual sleeping functionality. Vivaldi has similar manual tab sleeping functionality to TGS. Vivaldi also has sessions but I don't know how well it works. Unfortunately Vivaldi has many issues such as performance, and is missing some features present in Chrome. We discussed a few extensions for session management earlier. Session Buddy is the best non-TGS-based extension IMO.

Poopooracoocoo picture Poopooracoocoo on 29 Jan 2021

FWIW, have been kind of digging into some of the memory issues I've been putting up with (that have really necessitated TGS and they seem to boil down to one of two things, which are both compounded by ad blocking:
1) websites that are excessive on third party resources (ex. when you're on a tech news site or food site and they have a few videos on the page... This is especially true if you're like me and just use a lot of cosmetic rules and not as much dynamic network filtering. And because the elements are hidden, you don't even realize they are actually on that site. Being cognizant of that, it was easy to look in the chrome task manager and find all the tabs that had subframes (iframes) and add network blocking filters on them.
2) Sites that have poorly coded(?) service-workers/XHR requests, that basically "flip out" (bad memory leaks) when you block them from being able to phone home (haven't dug TOO far in, but from what I've seen) seems like a lot of the time, blocking the spying/logging blocks the cleanup functions that occur after the phone home occurs, so they just expand in size forever. Obviously it's a bit much to figure out on every site, but played around with injecting JS to nullify their logging functions and that has definitely tamed down memory usage on certain sites (like FB for example). A combination of blocking service workers altogether (which seem like on the vast majority of sites are just used for logging) + ensuring logging functions are killed has SIGNIFICANTLY cut my memory usage in chrome. (

(Also if you use multiple profiles in chrome, enabling the "Destroy Profile on browser close" flag saves even more (and Tab Groups Collapse Freezing helps).

Sorry I know the above is probably a bit much for typical end users to do anything with, but it may help some tinkerers...

After figuring those couple things out... memory usage is about cut in half, with

minig0d picture minig0d on 29 Jan 2021

While Chrome has great discarding and freezing and Edge builds upon that, neither have TGS's session management features or manual sleeping functionality. Vivaldi has similar manual tab sleeping functionality to TGS. Vivaldi also has sessions but I don't know how well it works.

Well. Vivaldi is the only modern browser that actually has tab sessions. TGS, Session Buddy and others all just have grouped bookmarks. URLs, not tabs.
The only real browser session manager otherwise is Session Manager for Firefox, which you can only use on old tech stacks with support for Firefox's ancestral addon system: Pale Moon or Waterfox. Last I tried Github didn't work nicely (which might or might not be fixable with a user agent override).
The UI for this in Vivaldi pales (no pun intended) in comparison to Session Manager, and you can't have auto-saving window sessions or other advanced setups (which might not always work on Firefox either), but it DOES persist all sorts of window-specific options:
"windowType":"normal","visibleUI":{"bookmarksBar":true,"addressBar":true,"panelToggle":false,"tabs":true,"statusBar":"on"
As well as site thumbnails, and the other features of real tab persistence: after you restore the session, back & forward history for the tab as well as scroll positions for the past and previous tabs are all there.

Unfortunately Vivaldi has many issues such as performance, and is missing some features present in Chrome.

It also has features Chrome doesn't have, like being able to style the UI. I for example made discarded tabs present differently, in both of the available vertical tab implementations.
image
^ Greyed out being discarded, italics being not clicked yet or notification. As you can see there's also grouped/stacked tabs (instead of full tab trees); I don't like the UI for those.

I'm not sure how atrocious performance is these days (I believe I mostly had issues with responsivity in the past, and haven't used it much in a long time).

Luckz picture Luckz on 29 Jan 2021
👍1

@Luckz Yeah I've had to change my workflow so that I open new tabs instead of continuing from the current tab. It's not that bad of change. I've been using windows and virtual desktops more since then too.

Poopooracoocoo picture Poopooracoocoo on 29 Jan 2021

@Luckz I believe that Simple Tab Groups for Firefox also supports tab unloading (and it works on recent Firefox).

joepie91 picture joepie91 on 29 Jan 2021

Maybe we can fork The Great Suspender and take it's place in the Chrome web store. There had been cases in which a fork had practically replaced the original project that had become dysfunctional.
image

A similar name, something like "The private Great Suspender" can serve this purpose on the Chrome store.

carpben picture carpben on 30 Jan 2021

@carpben that already exists and was linked above: https://chrome.google.com/webstore/detail/the-marvellous-suspender/noogafoofpebimajpfpamcfhoaifemoa

TheCleric picture TheCleric on 30 Jan 2021
👍11 ❤1

I just got a notice saying that The Great Suspender has malware by Google Chrome itself.

image

I am going to use The Marvellous Suspender from the Chrome Web Store and see if that fork is safe.

devxan picture devxan on 4 Feb 2021
👍50 🎉9 😕3 🚀1

Same for me, I got a malware notification for the great suspender, what is going on?

nachoal picture nachoal on 4 Feb 2021

Here goes another round...

It's a shame, but I guess also a good reminder that just because something claims it's using the Open Source code doesn't mean that the binary will be based on that.

chrismin13 picture chrismin13 on 4 Feb 2021

Same here. im going to install a new alternative. What do you recommend, guys? The Marvellous Suspender?

crisflashin picture crisflashin on 4 Feb 2021
👀8

The Great Suspender was removed from the Chrome Web Store

image

image

carpben picture carpben on 4 Feb 2021
👍5

Chrome extensions page now 404s:

https://chrome.google.com/webstore/detail/the-great-suspender/klbibkeccnjlkjkiokjodocebajanakg?hl=en

chrismin13 picture chrismin13 on 4 Feb 2021
👍4

@TheCleric how is better? It has some unrelated site as a source and 0 review. It could contain even more malicious code for all we know.

It's going to suck to unsuspend all the tabs now, though.

danilaml picture danilaml on 4 Feb 2021

I got a malware notification so I jumped straight in here. Any suggestions for a better alternative and the same experience?

nikhiljainlive picture nikhiljainlive on 4 Feb 2021
👍17

I've tried a bunch of alternatives. The marvelous suspender is still the
only thing that solves me needs.

On Thu, Feb 4, 2021 at 10:07 AM crisflashin notifications@github.com
wrote:

Same here. Goin gto install a new alternative. What do you recommend,
guys? The Marvellous Suspender?

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
https://github.com/greatsuspender/thegreatsuspender/issues/1263#issuecomment-773502263,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AAULCYPCMX3M4MATLKAZFKLS5LO5HANCNFSM4TI37TGQ
.

senorsmile picture senorsmile on 4 Feb 2021

Screen Shot 2021-02-04 at 1 10 15 PM
Any alternatives people?

NotMoni picture NotMoni on 4 Feb 2021
👍15

Gonna start using The Marvellous Suspender (source) until and unless this whole thing is settled.

Seems this keeps happening to my browser extensions. 🙄

BenLeggiero picture BenLeggiero on 4 Feb 2021
👍6

image

Luc45 picture Luc45 on 4 Feb 2021
😄19

Took Google too long to flag this as Malware.

speeddragon picture speeddragon on 4 Feb 2021
👍18

How do I recover all of my suspended tabs?

diomidov picture diomidov on 4 Feb 2021

I need some help. The extension was forced off by Chrome and I lost all of my tabs. I'm perfectly okay with removing the extension but I want to enable the extension long enough to unsuspend my tabs. How can I recover them? I am at a total loss here.

Maximus-42 picture Maximus-42 on 4 Feb 2021
👍5

rip

chiumax picture chiumax on 4 Feb 2021

KODUS to al those in the community who were alert to the suspicious actions by the new owner! And who reported it here (@TheMageKing and others). 👏
Hopefully we can return this repository to the community, or move this great community to a different repository.

carpben picture carpben on 4 Feb 2021
👍14

@Maximus-42 Had the same issue. Go to your history and the suspended tabs should be there. They wouldn't load, but from the URL you can figure out what the suspended tabs were about.

Those who use The Marvellous Suspender, please let us know how your experience goes with it.

alkalox picture alkalox on 4 Feb 2021

@alkalox Where in my history? I don't see suspended tabs there. They have shown up before, just not now

Maximus-42 picture Maximus-42 on 4 Feb 2021

oof.. I actually don't know what tabs I had suspended now :(

stoiven picture stoiven on 4 Feb 2021
👍3

I have started using The Marvellous Suspender, the experience is good for me as of now. can give a try.

nikhiljainlive picture nikhiljainlive on 4 Feb 2021

Is this as serious as Nano Adblocker and Defender? A bit worried that this could've happened again.

exurd picture exurd on 4 Feb 2021

I lost my suspended tabs too. The original post says that the urls can be "extracted from the extension query's". Anyone know how to do that?

ajunkins picture ajunkins on 4 Feb 2021

@Maximus-42 @ajunkins the actual URL of the site is in the suspended URL, just go to the very end, it's after uri=, copy it out

pynner picture pynner on 4 Feb 2021
👍8

I just pressed back on my suspended tabs, it worked ok.

madepolli picture madepolli on 4 Feb 2021
👍2

looks like everyone just got the notification from chrome

daniandl picture daniandl on 4 Feb 2021
👍10 😕2

yep, pretty everyone

mixeden picture mixeden on 4 Feb 2021

@Maximus-42 @ajunkins the actual URL of the site is in the suspended URL, just go to the very end it's after uri=, copy it out

Can confirm this works.

csoto09 picture csoto09 on 4 Feb 2021

@Maximus-42 @ajunkins the actual URL of the site is in the suspended URL, just go to the very end it's after uri=, copy it out

But where do I find the suspended URLs? All of my suspended tabs got closed and they are not in "recently closed".

diomidov picture diomidov on 4 Feb 2021
👍1

@Maximus-42 You might have to scroll down to find it. The URL for suspended tabs should be something like chrome-extension://, as another comment said, the website URL of the suspended tab is after uri=

alkalox picture alkalox on 4 Feb 2021

@Maximus-42 @ajunkins the actual URL of the site is in the suspended URL, just go to the very end, it's after uri=, copy it out

The tabs disappear the minute you remove the extension. Is there a way to get them back

ajunkins picture ajunkins on 4 Feb 2021

@diomidov Mine seemed to be in yesterday's history, a few scrolls down.

Maximus-42 picture Maximus-42 on 4 Feb 2021

How do we extract all previously saved links (not open ones)?

JJCUBER picture JJCUBER on 4 Feb 2021

Updated top post, please see #526 for URL recovery help

TheMageKing picture TheMageKing on 4 Feb 2021
👍7 ❤3

You can recover the tabs by navigating to your history (chrome://history) and searching for the extension prefix URLs: "chrome-extension://klbibkeccnjlkjkiokjodocebajanakg/suspended.html

chrome://history/?q=chrome-extension%3A//klbibkeccnjlkjkiokjodocebajanakg/suspended.html

lukepereira picture lukepereira on 4 Feb 2021
❤26 👍9 🚀4 🎉1 😄1

Also got the notification this was malware and removed from chrome, store page is 404, found some posts on reddit and articles, one linked to this conversation.

Marvellous Suspender seems like a fork from great suspender without tracking, I'll wait a few days before adding it though, but it's probably fine:

https://github.com/gioxx/MarvellousSuspender

(has 20 stars at time of writing on github, we'll see how fast that shoots up by tomorrow lol)

justingolden21 picture justingolden21 on 4 Feb 2021
👍1

The extension being blocked just completely nuked every tab I had suspended.

Atomika picture Atomika on 4 Feb 2021

The extension being blocked just completely nuked every tab I had suspended.

https://github.com/greatsuspender/thegreatsuspender/issues/1263#issuecomment-773514532

justingolden21 picture justingolden21 on 4 Feb 2021

Ha. The sudden influx of people due to the active blocking during a workday.

zphensley42 picture zphensley42 on 4 Feb 2021
😄7 👍3

For those asking for alternatives, I might recommend https://workona.com/tab-manager/. It does more than just suspend tabs (that you may find useful), but it's a good tab suspender too. (Full disclosure: I work for Workona, but I was a long-time user of its tab suspension before I started working there :-) )

pwightman picture pwightman on 4 Feb 2021
👍4

Does this mean any of my passwords or personal data could be compromised? Should I take any actions?
I stopped using it a few weeks back since Edge's new suspender feature was introduced.

i've muted this. please @ me to get my attention

LewisSpring picture LewisSpring on 4 Feb 2021
👍8 👀1

All I see are comments about getting tabs back, and not what data was stolen

yakschuss picture yakschuss on 4 Feb 2021
👍20 👎1

@Atomika, just click the back button, it'll bring your page back

taxpayer picture taxpayer on 4 Feb 2021
❤1 🎉1 👍1

This has happened so many times when an independent developer sells a browser extension.

If you (the reader of this comment) ever find yourself in a situation of being offered a substantial sum of money for an extension that you don't really want to maintain anymore, you have to understand that it is extremely unethical to transfer ownership without very thorough vetting of the party control is being transferred to.

This same thing has played out time and time again. _Please_, let's all work together to spread this information and do our part to prevent it from happening again. It makes me sick to see that history just keeps repeating itself here.

No offense to the original maintainer; I am just very frustrated this continues happen when it is avoidable and should not ever happen.

thesmiley1 picture thesmiley1 on 4 Feb 2021
👍24

Yes, people could stop complaining about tabs as they're recoverable by pressing back button or by looking into the URL that still has the the original URL.

Now, what data could have been stolen by this?

TheThor picture TheThor on 4 Feb 2021
👍19

what do you guys think about The Great Discarder https://chrome.google.com/webstore/detail/the-great-discarder/jlipbpadkjcklpeiajndiijbeieicbdh
?

snekbaev picture snekbaev on 4 Feb 2021

You guys are life (tab!) savers. Thank you

Maximus-42 picture Maximus-42 on 4 Feb 2021
❤2

I can't believe this -- I WAS SOUNDING THE ALARM ABOUT THIS MONTHS AGO

mike9k1 picture mike9k1 on 4 Feb 2021

Hey @TheMageKing !

I had this extension installed but turned off in a disabled state. Am I affected?

barbarossa22 picture barbarossa22 on 4 Feb 2021

Wish I had known about this sooner, I really should check out all other extensions I have 🤔

Fede-debug picture Fede-debug on 4 Feb 2021

I can't believe this -- I WAS SOUNDING THE ALARM ABOUT THIS MONTHS AGO

That's the problem. How would any user of TGS know about the issues? There's simply no way to notify extension's users...

Discipe picture Discipe on 4 Feb 2021
👍9 👀2

Now, what data could have been stolen by this?

Pretty much what I'm wondering right now

WarningHPB picture WarningHPB on 4 Feb 2021
👍1

Sick to my stomach thinking about all the personal data that was surreptitiously stolen from me over the last few months.

rex picture rex on 4 Feb 2021
👍16

Hey @TheMageKing !

I had this extension installed but turned off in a disabled state. Am I affected?

Probably not

LewisSpring picture LewisSpring on 4 Feb 2021
👍5 👀2

Do I need to worry about any of my data or passwords being stolen?

superluig164 picture superluig164 on 4 Feb 2021
👀20 👍17 😕4

@superluig164 they say it was advertising fraud, but who knows...

bdrtsky picture bdrtsky on 4 Feb 2021

Yes, people could stop complaining about tabs as they're recoverable by pressing back button or by looking into the URL that still has the the original URL.

Now, what data could have been stolen by this?

Not necessarily. Refreshing twice makes Chrome overwrite the URL with some generic "invalid" URL thing.

Was bitten by this _literally just now_ and am _not_ looking forward to the pain of killing the extension and restoring the tab. At the very least, I'll lose the back button.

And if the session crashes for any reason...

munael picture munael on 4 Feb 2021

this is worrying

Steadyx picture Steadyx on 4 Feb 2021

@deanoemcke You and I have been together a long time, you know? This extension has been part of my daily life for years. I respect you for having made such an incredible piece of software, one I have relied on without issue for as long as I care to remember. But why, _why_ would you sell it to someone who was so clearly shady? Was it not shady at first and became that way, or was it shady from the beginning? We could be talking about the mass harvesting of identity and banking information from millions of people here.

rex picture rex on 4 Feb 2021
👍7

@thibaudcolas @joepie91 @zanglang y'all got further into the analysis than I, can you help enlighten everyone on the details of what the remote JS did?

TheMageKing picture TheMageKing on 4 Feb 2021

Do Chromium extensions have access to the filesystem in general, or is the scope limited to just browser stuff?

luke-jr picture luke-jr on 4 Feb 2021

This is sad and unfortunate

JobaDiniz picture JobaDiniz on 4 Feb 2021

It seems like all the decent extensions slowly devolve into shady stuff/scams these days...

JJCUBER picture JJCUBER on 4 Feb 2021
😕3 👍2

Chrome just forcibly removed the extension on my client. Didn't know this have security concerns.

RexYuan picture RexYuan on 4 Feb 2021

Now is there an extension that disables extensions like these (taken over from original maintainer) that are possibly malware long before Google takes them down?

1oh1 picture 1oh1 on 4 Feb 2021
👀8

Chrome just forcibly removed the extension on my client. Didn't know this have security concerns.

Same, I didn't get a chance to prepare :(

JJCUBER picture JJCUBER on 4 Feb 2021

I just pressed back on my suspended tabs, it worked ok.

all of the suspended tabs disappeared when Chrome Web Store yanked the extension and marked it malware

cowbert picture cowbert on 4 Feb 2021

I was incredibly alarmed by not knowing this until Google removed it and prompt me 10 min ago. Now I am worried about information theft/security breach. Any suggestions on knowing in advance? (e.g. had I seen this GitHub issue 2 months ago I would have removed TGS from chrome back then).

sgyzetrov picture sgyzetrov on 4 Feb 2021
👀4 👍3

Genuine question for those who know (could be useful for everyone)

What info does this extension have malicious access too? Could it, in theory, have got access to unencrypted passwords stored in Chrome?

TrainerGamer picture TrainerGamer on 4 Feb 2021
👍3 👀2

Genuine question for those who know (could be useful for everyone)

What info does this extension have malicious access too? Could it, in theory, have got access to unencrypted passwords stored in Chrome?

Yeah my concern too

Jc7tee picture Jc7tee on 4 Feb 2021

It was only for analytics propose or was it also a password stealer/cpu mining or something else?

Jarda-H picture Jarda-H on 4 Feb 2021

When it doubt... change it out.

tmountain picture tmountain on 4 Feb 2021

Do Chromium extensions have access to the filesystem in general, or is the scope limited to just browser stuff?

They can access the filesystem if they request those permissions, but I do not think that's the case here.

Genuine question for those who know (could be useful for everyone)
What info does this extension have malicious access too? Could it, in theory, have got access to unencrypted passwords stored in Chrome?

Yeah my concern too

AFAIK there is no permission set for passwords, I believe those are kept at the browser level and there is no API to access them.

rex picture rex on 4 Feb 2021
🎉1 👍1

what is happening with this extension I was using it till just now and delete it because chrome says this extension is malicious. and try to find prove as google saying true or not and found this post and what I see is this post was posted on November 3 2020 and
I am now is confuse what to do without this extension is there any alternative?

faraidoon123 picture faraidoon123 on 4 Feb 2021

what is happening with this extension I was using it till just now and delete it because chrome says this extension is malicious. and try to find prove as google saying true or not and found this post and what I see is this post was posted on November 3 2020 and
I am now is confuse what to do without this extension is there any alternative?

I'll be using The Marvellous Suspended - a track free fork of TGS

TrainerGamer picture TrainerGamer on 4 Feb 2021

As posted in the OP, user @aciidic went ahead and created a repo without the tracking. It has 190 stars. Can't speak for it though, just letting people know about it as an alternative.

https://github.com/aciidic/thegreatsuspender-notrack

alkalox picture alkalox on 4 Feb 2021

shoutout to @aciidic for creating his own version, works great.

CodyMcNeill picture CodyMcNeill on 4 Feb 2021

@faraidoon123 If you are looking to restore lost tabs try https://github.com/greatsuspender/thegreatsuspender/issues/1263#issuecomment-773514532

Maximus-42 picture Maximus-42 on 4 Feb 2021

It was only for analytics propose or was it also a password stealer/cpu mining or something else?

If it was CPU mining you'd know it because the CPU would stay pegged. As for password stealing, there is a reasonable likelihood that was taking place. The research by others in this thread unearthed an onKeyPress listener that would capture every keystroke, not difficult to assemble keystrokes into passwords from there.

This is a nightmare.

rex picture rex on 4 Feb 2021

I was sounding the alarm on this back in May of last year -- https://github.com/greatsuspender/thegreatsuspender/issues/1147

mike9k1 picture mike9k1 on 4 Feb 2021

As posted in the OP, user aciidic went ahead and created a repo without the tracking. It has 190 stars. Can't speak for it though, just letting people know about it as an alternative.

aciidic/thegreatsuspender-notrack

Need to post it as a separate, new repo. Forking on Github is dangerous in case the owners decide to kill things or something...
@aciidic

munael picture munael on 4 Feb 2021

@rex Any way to confirm what permissions it has/had? (I have backups I can analyse...)

luke-jr picture luke-jr on 4 Feb 2021

Is a complete password reset of all the websites I use a good way to mitigate the damage from possible data theft by the extension or is it overkill? Any suggestions? I wasn't even aware that I was still using this extension but I guess it was attached to my Google profile and got installed when I logged into Chrome and turned on sync.

1oh1 picture 1oh1 on 4 Feb 2021
👍4

I might just be blind, but https://github.com/greatsuspender/thegreatsuspender/issues/526 doesn't seem to actually tell you how to recover all saved sessions and tabs from IndexedDB externally (like getting a list of all the links in plaintext).

Does anyone know how to actually do that?

JJCUBER picture JJCUBER on 4 Feb 2021

Can we assume that passwords are compromised? What about CC data entered on websites/saved in chrome?

nierardi picture nierardi on 4 Feb 2021
👍2

executed code from an untrusted third-party on your computer, with the power to modify any and all websites that you see

Could this mean that passwords or other sensitive data was scraped?

Blindmikey picture Blindmikey on 4 Feb 2021

FYI I've running an anti-malware scan as we speak - its already detected 2x malicious tracking cookies. I imagine these are linked to TGS however cannot confirm.

Although tracking cookies in themselves are generally safe and normal to have, if you have malicious ones your anti-virus will probably pick up on them (as in this case).

image

To be on the safe side I recommend you all run an anti-malware scan

TrainerGamer picture TrainerGamer on 4 Feb 2021
👍3

how to recover all saved sessions and tabs from IndexedDB externally (like getting a list of all the links in plaintext).
Does anyone know how to actually do that?

https://github.com/greatsuspender/thegreatsuspender/issues/1263#issuecomment-773514532

Kebap picture Kebap on 4 Feb 2021

@rex Any way to confirm what permissions it has/had? (I have backups I can analyse...)

Look at manifest.json to permissions

Jarda-H picture Jarda-H on 4 Feb 2021

WTF? Is there a summary on what kinds of data may have been compromised? Should we be changing passwords?

Why did it take Google 3-4+ mo to remove this?

itsaphel picture itsaphel on 4 Feb 2021
👍8

how to recover all saved sessions and tabs from IndexedDB externally (like getting a list of all the links in plaintext).
Does anyone know how to actually do that?

#1263 (comment)

That does not help. I'm talking about the saved sessions, not all the suspended tabs ever (I have probably 10s of thousands of those).

JJCUBER picture JJCUBER on 4 Feb 2021

@rex Any way to confirm what permissions it has/had? (I have backups I can analyse...)

Unfortunately not that I'm aware of. Obviously you could look at the manifest.json in this repo but once it became clear they were deploying updates packaged from code outside this repo the only way would be to get one of those tarballs and unpack it and look.

rex picture rex on 4 Feb 2021
👍1

I was sounding the alarm on this back in May of last year -- #1147

You've said it about 10 times already mate. I don't honestly think people care who raised the alarm when - people just wanna make sure their stuff is safe and secure :)

TrainerGamer picture TrainerGamer on 4 Feb 2021
👍4 ❤1

Is a complete password reset of all the websites I use a good way to mitigate the damage from possible data theft by the extension or is it overkill? Any suggestions? I wasn't even aware that I was still using this extension but I guess it was attached to my Google profile and got installed when I logged into Chrome and turned on sync.

It's a start, to be sure, but unfortunately it all depends on whether this was an actual _harvesting campaign_ or not. If it was, and our identity information was harvested, then we've all got a lot bigger problems than passwords.

Edit: To be clearer, I am suggesting that if our identities were stolen then we're looking at locking credit files, monitoring for usage of our social security numbers, applications for credit cards, the works.

rex picture rex on 4 Feb 2021
👍3 😕2

This is still in my Chromium profile for the (now disabled) extension:

    "permissions": [
        "tabs",
        "storage",
        "history",
        "unlimitedStorage",
        "webRequest",
        "webRequestBlocking",
        "http://*/*",
        "https://*/*",
        "file://*/*",
        "chrome://favicon/*",
        "https://greatsuspender.github.io/",
        "contextMenus",
        "cookies"
    ],
luke-jr picture luke-jr on 4 Feb 2021
👍5

how to recover all saved sessions and tabs from IndexedDB externally (like getting a list of all the links in plaintext).
Does anyone know how to actually do that?

#1263 (comment)

That does not help. I'm talking about the saved sessions, not all the suspended tabs ever (I have probably 10s of thousands of those).

I don't think that's possible. But history is sorted by date, and you probably aren't interested in recovering tabs that you had suspended for over a year. So just look at the last few hundred urls.

diomidov picture diomidov on 4 Feb 2021

As a quick workaround to recover your tabs, just look in the URL bar and delete everything up to and including &uri= :
image

JakeSc picture JakeSc on 4 Feb 2021
👍3

Chrome disabled it but then it came right back up a few minutes later while I was reading this thread! So I manually removed the extension. Thanks all for documenting the issue.

qyz915 picture qyz915 on 4 Feb 2021

This is still in my Chromium profile for the (now disabled) extension:

    "permissions": [
        "tabs",
        "storage",
        "history",
        "unlimitedStorage",
        "webRequest",
        "webRequestBlocking",
        "http://*/*",
        "https://*/*",
        "file://*/*",
        "chrome://favicon/*",
        "https://greatsuspender.github.io/",
        "contextMenus",
        "cookies"
    ],

Good thinking. The good news is that that doesn't allow filesystem access. The bad news is of course that it can still have harvested every keystroke on every website we visited.

rex picture rex on 4 Feb 2021

The good news is that that doesn't allow filesystem access.

Not even the "file://*/*" part?

luke-jr picture luke-jr on 4 Feb 2021

I have updated the top post once more. For those hoping to analyze the extension, please do read through it: it may be long, but it is detailed. Posts further up in this history have more details on the analyses that they attempted. We do not believe that most users of Great Suspender, especially those who only used it recently, are severely impacted.

I hope that Google will do a press release of some sort soon, explaining if there are any harmful behaviors not described here. For those who have been with this issue since May, October, or January (the three big spikes in people noticing), we know you knew for a while. We don't need to rub it in even more: we can just live with the knowledge that we were ahead of the curve.

TheMageKing picture TheMageKing on 4 Feb 2021
👍23 ❤1

how to recover all saved sessions and tabs from IndexedDB externally (like getting a list of all the links in plaintext).
Does anyone know how to actually do that?

#1263 (comment)

That does not help. I'm talking about the saved sessions, not all the suspended tabs ever (I have probably 10s of thousands of those).

I don't think that's possible. But history is sorted by date, and you probably aren't interested in recovering tabs that you had suspended for over a year. So just look at the last few hundred urls.

Once again I have no use for the "latest" suspended tabs, I have saved sessions from a long time ago that I find useful. So it sounds like what I need isn't possible?

JJCUBER picture JJCUBER on 4 Feb 2021

The good news is that that doesn't allow filesystem access.

Not even the "file://*/*" part?

Negative. Filesystem access requires a specific permission in manifest.json. file://*/* just means the extension can execute code on pages that start with file://, so if you were browsing files through your browser (which is possible, try it out). Nothing to worry about there.

rex picture rex on 4 Feb 2021
👍12

It was only for analytics propose or was it also a password stealer/cpu mining or something else?

The key-press handler appears to explicitly skip over any input or password tags, but add events for other keypresses (which are likely intended to be tab/enter/spacebar outside of text input).

Concerningly, doesn't exclude