360 Internet Protection
🔍 Security Report Available View on Chrome Web StoreChrome will indicate if you already have this installed.
Blocks web threats in real-time with cloud-based malicious URL detection, protecting you from phishing, malware, and online tracking. With 360 Internet Protection, individuals who frequently browse online can enjoy a safer browsing experience, shielding their personal data from targeted advertising and potential leaks. Note: Latest version of 360 Total Security must be installed for full functionality.
Overview
This extension is web threat protection of 360 Total Security for Chrome. It's based on the cloud malicious URL database of 360 cloud security center. It can identify malicious URL in real-time and protect you from web threats. The capabilities of anti-fraud, anti-phishing and anti-malicious URL will be enabled once installed. Integrated privacy anti-tracking, disguise your online information, away from the risk of targeted advertising and privacy leakage, so that you have a safe online environment.
Note:
1. You need to install latest 360 Total Security to have the above functions.
2. Support Windows Version of 360 Total Security only.
Official Website: http://www.360totalsecurity.com/
Tags
Privacy Practices
Security Analysis — 360 Internet Protection
Permissions
Code Patterns Detected
External Connections
Package Contents 117 files · 489KB
What This Extension Does
The 360 Internet Protection extension claims to provide web threat protection, anti-fraud, anti-phishing, and anti-malicious URL capabilities. It integrates privacy features such as anti-tracking and disguises online information to prevent targeted advertising and data leakage. This extension is suitable for users seeking enhanced security and privacy while browsing the internet.
Permissions Explained
- scriptingexpected: This permission allows the extension to run scripts on your device, which can access sensitive data and perform actions without user interaction.
Technical: The scripting permission grants access to Chrome's JavaScript engine, enabling the extension to execute arbitrary code. This poses a risk if the extension is compromised or contains malicious code. - tabsexpected: This permission allows the extension to access and manipulate your browsing history, including tabs you have open.
Technical: The tabs permission grants access to Chrome's tab management API, enabling the extension to read and modify tab data. This could be used for tracking or malicious activities if exploited. - nativeMessagingcheck this: This permission allows the extension to communicate with native applications on your device, potentially accessing sensitive system data.
Technical: The nativeMessaging permission grants access to Chrome's Native Messaging API, enabling the extension to interact with native apps. This poses a critical risk if exploited, as it can lead to unauthorized data access or manipulation. ⚠ 1 - storageexpected: This permission allows the extension to store and retrieve data on your device, including sensitive information such as login credentials.
Technical: The storage permission grants access to Chrome's storage API, enabling the extension to read and write data. This could be used for tracking or malicious activities if exploited. - activeTabexpected: This permission allows the extension to access the currently active tab, including its content and metadata.
Technical: The activeTab permission grants access to Chrome's tab API, enabling the extension to read data from the active tab. This poses a risk if exploited, as it can lead to unauthorized data access or manipulation. - webRequestcheck this: This permission allows the extension to intercept and modify web requests, potentially altering the content you see on the internet.
Technical: The webRequest permission grants access to Chrome's request API, enabling the extension to manipulate HTTP requests. This poses a high risk if exploited, as it can lead to unauthorized data access or manipulation. ⚠ 1 - <all_urls>check this: This permission allows the extension to access all URLs visited on your device, including sensitive information such as login credentials and personal data.
Technical: The <all_urls> permission grants access to Chrome's URL API, enabling the extension to read and write data. This poses a critical risk if exploited, as it can lead to unauthorized data access or manipulation. ⚠ 1 - declarativeNetRequestWithHostAccessexpected: This permission allows the extension to define rules for blocking or modifying web requests based on hostnames.
Technical: The declarativeNetRequestWithHostAccess permission grants access to Chrome's request API, enabling the extension to manipulate HTTP requests. This poses a risk if exploited, as it can lead to unauthorized data access or manipulation. - alarmsexpected: This permission allows the extension to schedule and manage alarms on your device, potentially accessing sensitive system data.
Technical: The alarms permission grants access to Chrome's alarm API, enabling the extension to interact with native apps. This poses a risk if exploited, as it can lead to unauthorized data access or manipulation.
Your Data
The extension accesses sensitive data such as browsing history, login credentials, and personal information. It sends this data to various domains, including its own servers (www.360totalsecurity.com, info.url.cloud.360safe.com) and third-party services (github.com, ssl.google-analytics.com).
Technical Details
- www.360totalsecurity.com
- info.url.cloud.360safe.com
- github.com
- ssl.google-analytics.com
- HTTP
- HTTPS
- cookies
- tokens
- page content
Code Findings
The extension uses the Function constructor to execute dynamic code, which can lead to unauthorized data access or manipulation.
Technical: The extension uses the Function constructor (e.g., new Function('code')) to execute arbitrary JavaScript code. This poses a high risk if exploited, as it can lead to unauthorized data access or manipulation.
💡 Legitimate extensions may use dynamic code execution for legitimate purposes such as content injection or script loading.
The extension uses innerHTML assignment, which can lead to cross-site scripting (XSS) attacks if exploited.
Technical: The extension assigns innerHTML values to elements without proper sanitization, potentially leading to XSS attacks. This poses a medium risk if exploited, as it can lead to unauthorized data access or manipulation.
💡 Legitimate extensions may use innerHTML assignment for legitimate purposes such as content injection or script loading.
The extension uses String.fromCharCode and charCodeAt to obfuscate code, making it difficult to analyze.
Technical: The extension uses String.fromCharCode and charCodeAt (e.g., String.fromCharCode(104) instead of 'd') to obfuscate code. This poses a medium risk if exploited, as it can lead to unauthorized data access or manipulation.
💡 Legitimate extensions may use obfuscation techniques for legitimate purposes such as code compression or protection.
The extension has broad host permissions, allowing it to access sensitive data and perform actions without user interaction.
Technical: The extension has <all_urls> permission, granting access to all URLs visited on your device. This poses a critical risk if exploited, as it can lead to unauthorized data access or manipulation.
💡 Legitimate extensions may require broad host permissions for legitimate purposes such as content injection or script loading.
The extension uses postMessage to communicate with other origins, potentially leading to unauthorized data access or manipulation.
Technical: The extension uses postMessage (e.g., window.postMessage) to communicate with other origins. This poses a medium risk if exploited, as it can lead to unauthorized data access or manipulation.
💡 Legitimate extensions may use cross-origin communications for legitimate purposes such as content injection or script loading.
The 360 Internet Protection extension poses significant security risks due to its broad host permissions, dynamic code execution, and potential XSS vector. While it provides some legitimate security features, the extension's behavior raises concerns about data exposure and unauthorized access. Users should exercise caution when installing this extension and consider alternative security solutions.
