Game of Chromes - Owning the Web with Zombie Chrome Extensions

Explore a Black Hat conference talk detailing a massive botnet attack orchestrated through malicious Chrome extensions. Delve into the investigation of attack patterns, extension capabilities, and the attackers' objectives in using Wix as a distribution platform. Examine the characteristics of effective bots, command and control structures, and methods to streamline attacks. Analyze specific case studies, including Adobe Acrobat and AVG Web Tuneup extension vulnerabilities, and discuss the role of Content Security Policy in mitigating such threats. Gain insights into the evolving landscape of web-based attacks and defense strategies in this 46-minute presentation by Tomer Cohen.

Intro
Investigating Attack Patterns
Extension Course of Action
The Objective: Use Wix as a distributor to form a botnet
This Magical Bot...
What Makes A Good Bot
What An Extension Can Do
Command & Control
Too Much Work...
How Can We Make It Easier?
Adobe Acrobat extension XSS
Nothing New Here...
Content Security Policy
AVG Web Tuneup extension XSS