Nano Adblocker + Defender now malware

Orcvader · 16 Oct 2020 at 13:26

Just a heads up for those who uses Nano adblocker and Nano defender, it is now managed by new owners who immediately pushed out an update with malicious code: https://github.com/NanoAdblocker/NanoCore/issues/362#issuecomment-709428210

This update is so far only on the Chrome extension store. The Firefox port is managed by a different developer and they plan to rename it and will try to maintain it to the best of their abilities. The Edge listing is still managed by the old developer, and they immediately delisted both adblocker and defender. They are now recommending everyone to move over to uBlock Origin.

Nick1881 · 20 Oct 2020 at 10:34

I can't believe they turned this into malware, I wasn't aware until Chrome alerted me and disabled it.

Scary stuff, I hope it hadn't already done something.

V_R · 20 Oct 2020 at 12:25

I've just found about this myself.

https://www.reddit.com/r/Adblock/comments/jc447f/nano_adblocker_nano_defender_was_sold_and_should/

Looks like its mainly aimed at Instagram. See if you have a bunch of random likes.

Nick1881 · 20 Oct 2020 at 13:54

V_R said:
I've just found about this myself.

https://www.reddit.com/r/Adblock/comments/jc447f/nano_adblocker_nano_defender_was_sold_and_should/

Looks like its mainly aimed at Instagram. See if you have a bunch of random likes.

Yep, loads of them.

More worryingly I'm not sure I've used IG on desktop, I have lastpass installed though, I hope it didn't access all my passwords.

V_R · 20 Oct 2020 at 14:19

Passwords are apparently safe.

jpaul · 20 Oct 2020 at 16:14

V_R said:
I've just found about this myself.

https://www.reddit.com/r/Adblock/comments/jc447f/nano_adblocker_nano_defender_was_sold_and_should/

interesting

"uBO has it's own anti-blocker defusing filters in its default lists. It's where most of the fixes against anti-blockers are made, many people wrongly attributed this to Nano Adblocker -- while it's just the filter lists maintainers investing their free time and doing all the work behind-the-scene and receiving too little credit for their work."

Tip: If you want to get rid of some more anti-adblock messages, then enable the uBlock filters – Annoyances filter in uBlock Origin's settings > Filter lists > Annoyances (click to expand it.)

I just use Ublocko, and, am finding the filters can be a mixed blessing.
you can have sites that don't work and leave a grey overlay or blurred images because the gdpr test has not completed correctly,
so, you then have to disable some filters globally to get sites to function at the level you need.

V_R · 20 Oct 2020 at 23:14

Good write up on it here.

https://chris.partridge.tech/2020/extensions-the-next-generation-of-malware/help-for-users/

Orcvader · 22 Oct 2020 at 14:58

Nick1881 said:
Yep, loads of them.

More worryingly I'm not sure I've used IG on desktop, I have lastpass installed though, I hope it didn't access all my passwords.

It seems to be using session cookies to access accounts so passwords should be fine. Best way to fix this is remove the extensions, then log out and in from every affected site that's logged in to recreate the cookie.

It may not be limited to Instagram, a list can be found here: https://github.com/jspenguin2017/Snippets/issues/5

Nick1881 · 22 Oct 2020 at 15:09

Orcvader said:
It seems to be using session cookies to access accounts so passwords should be fine. Best way to fix this is remove the extensions, then log out and in from every affected site that's logged in to recreate the cookie.

It may not be limited to Instagram, a list can be found here: https://github.com/jspenguin2017/Snippets/issues/5

Thanks, looks like only Instagram for me, already deleted the extension, changed my IG password and removed all the random likes.

loftie · 25 Oct 2020 at 02:09

I just got warned by Opera about this, odd that it took so long to pop up. Same with Vivaldi. Luckily I use Firefox as my main browser and that was unaffected by this.
Annoyingly I don't really check this sub forum often so I missed the thread, only saw it when I searched the site to see if a thread had been created already.