Netcraft has updated its browser extension to add protection against malicious JavaScript, including shopping site skimmers and web miners.

The Netcraft Extension now protects against malicious JavaScript

Shopping site skimmers are malicious JavaScript programs that steal your payment card information when you checkout on a compromised online store, and send it back to a fraudster to use later. These attacks have affected a large number of online shops, and are invisible to even the most vigilant shoppers as there is no visual change to the page.

Web miners are malicious JavaScript programs inserted by fraudsters into a website that let them steal your CPU power to mine for cryptocurrency using your browser without your consent. Browsing a website with a web miner can often slow down your computer by consuming its resources.

Netcraft proactively scans for new shopping site skimmers, web miners, and other malicious JavaScript on the web. In the past six months, we have found malicious JavaScript affecting over 70,000 sites on over 29,000 distinct IPs. We have identified these attacks on high-profile sites such as Cleor (a large French jewellery retailer), Misfit (a wearable devices brand), and Arctic (a PC components and accessories retailer), as well as on the personalized merchandise stores for dozens of sports clubs, including Southampton's and Swansea's.

A well-hidden shopping site skimmer

By using the Netcraft Extension you can get protection from these types of attack as soon as we detect them. It was first made available for Internet Explorer in 2004, Firefox in 2005, Chrome in 2012, Opera in 2013, and Microsoft Edge earlier this year.

Select your browser to download the Netcraft Extension now:

If you already have the Netcraft Extension installed your browser will update it automatically.

The Netcraft app for Android also provides protection against these attacks, while the Netcraft app for iOS provides protection against phishing attacks.

The Netcraft Anti-Phishing Extension is now available for Microsoft Edge.

Netcraft anti-phishing extension on Microsoft Edge.

The Netcraft Anti-Phishing Extension provides phishing and XSS protection as well as informing you about the websites you visit. It was first made available for Internet Explorer in December 2004, followed by Firefox in 2005, Chrome in 2012 and Opera in 2013. Microsoft Edge is now supported with the arrival of the extension in the Windows Store. The extension is compatible with the current version of Microsoft Edge (34+) as well as the preview version available at Microsoft Edge Insider.

The extension displays a website's hosting provider, country, longevity and popularity, along with an abstracted risk rating for each site. Its key features are:

• Protection against phishing sites — the Netcraft anti-phishing community is effectively a giant neighbourhood watch scheme, empowering the most alert and most expert members to defend everyone within the community. As soon as the first recipients of a phishing mail report it, Netcraft blocks it for all users of the extension, providing an additional level of protection from phishing. Netcraft processes reports of fraudulent URLs from a variety of sources and proactively searches for new fraudulent sites.
• Detailed site reports — simply click the Netcraft logo to access a wealth of information about the sites you visit, helping you to make informed choices about their safety.
• Risk ratings — we evaluate the characteristics of the site compared against those depicted by fraudulent sites. The result is a simple visual summary displayed on the site report.
• Convenient reporting for suspected phishing & fraudulent sites — at the click of the button you can report suspected web forgeries to Netcraft, helping to protect the community. Netcraft operates an incentive scheme for phishing site submissions, including iPads, backpacks, mugs, and more. As of July 2019, over 65 million phishing sites have been detected and blocked by Netcraft since its anti-phishing service was launched.
• Protection against cross site scripting (XSS) — the extension optionally traps XSS and other suspicious URLs which contain characters highly likely to deceive.

Left: Microsoft Edge without the Extension - Right: The Netcraft Extension blocking page

The extension is now available to download from the Microsoft Store and once installed will automatically start blocking malicious sites. It is also available from the Google Chrome Store, Opera add-ons page and the Firefox add-ons page.

Netcraft has also released apps for iOS and Android, which protect your mobile device from phishing attacks.

Netcraft's new anti-phishing app, already available in the Google Play store, has just been released to the Amazon Appstore. The iOS app is with Apple for review.

Android web browsers lack comprehensive protection against malicious websites, and in most cases only block a small fraction of the sites blocked by their desktop counterparts. The Netcraft app solves this problem by extending our industry-leading phishing protection services to your mobile device. The app equips your Android device with Netcraft's continuously updated feed of phishing websites, and will alert you whenever you visit a site that's included in this blacklist.

The Netcraft app works with the most popular mobile web browsers on Android — including Amazon's Silk browser, Chrome, and Firefox — and other apps, such as Facebook, Twitter, and Slack.

The app's malicious site warning page in Amazon's Silk browser.

See our original post about the app for more information.

Download the app on Google Play or the Amazon Appstore now to protect yourself from phishing threats on your Android device. Subscribe to our mailing list to be among the first to hear when the Netcraft app for iOS is available, along with other news items from Netcraft.

Netcraft has developed a new anti-phishing app for Android to defend against fraudulent sites. The Netcraft app is available now on Google Play and at the Amazon Appstore. The Netcraft app for iOS is with Apple for review.

Netcraft's new Android app provides rapid protection against phishing threats, with new attacks blocked as soon as they're determined to be fraudulent by Netcraft. It offers free protection during a one-month trial, after which a monthly or annual subscription can be purchased. You can use the app to report phish to Netcraft without a subscription.

Phishing is not confined to the desktop: in an analysis of a month's worth of log files recovered from phishing sites, Netcraft found that two thirds of visits came from mobile browsers. Some fraudsters also add mobile-specific user interfaces to their phishing attacks, making them even more effective against phone and tablet users.

Despite this, mobile browsers lack comprehensive anti-phishing protection, unlike their desktop counterparts. In a study performed last year, Netcraft found that iOS and Android browsers block only a fraction of the sites that are blocked by their desktop equivalents, leaving mobile users more exposed.

The app makes use of Netcraft's industry-leading anti-phishing feed, which is licensed to the leading web browser vendors, as well as anti-virus, firewall, intrusion detection and content filtering companies. Every day Netcraft processes millions of suspicious URLs to identify phishing attacks. Over 56 million unique phishing sites have been detected and blocked by Netcraft’s community to date.

The Netcraft app works with the most popular mobile web browsers on Android – including Chrome and Firefox – and other apps such as Facebook, Twitter, and Slack. In addition to blocking phish across the web, the app automatically detects phishing URLs in SMS messages, and will alert you to the danger with a notification.

The app allows you to report phishing websites and SMS phishing attacks to Netcraft with just a few taps, protecting other users and making you part of a global safeguarding community.

Download the app on Google Play now to benefit from Netcraft's comprehensive mobile phishing protection on your Android devices. Desktop browser protection is also available in the Netcraft extension for Firefox, Google Chrome, and Opera. Subscribe to our mailing list to be amongst the first to hear when the Netcraft app for iOS is available, along with other news items from Netcraft.

An update to the Netcraft Anti-Phishing Extension for Mozilla Firefox is now available. This release replaces the Toolbar interface with a modern Button interface to sit alongside the browser's address bar.

The upcoming Firefox 57 — to be released on the 14^th November — represents a major overhaul of the browser, and removes support for legacy XUL extensions. Future versions of Firefox will only support the new cross-browser WebExtensions API.

The Netcraft Anti-Phishing Extension (known then as the Netcraft Toolbar) was first made available for Internet Explorer in December 2004. A Firefox version followed in May 2005. The current button-style Anti-Phishing Extension was released for Google Chrome and the Opera browser in 2012 and 2013 respectively. The new extension enjoys a 4.5 star rating on the Google Chrome Store.

The Extension runs on any operating system supported by the desktop version of Mozilla Firefox and displays the hosting location, country, longevity, popularity, and an abstracted risk rating for each site visited. In particular its key features are:

• Protection against phishing sites — The Netcraft anti-phishing community is effectively a giant neighbourhood watch scheme, empowering the most alert and most expert members to defend everyone within the community. As soon as the first recipients of a phishing mail report it, we can block it for all users of the extension providing an additional level of protection from Phishing. Netcraft processes reports of fraudulent URLs from a diverse variety of sources and proactively searches for new fraudulent sites.
• Detailed site reports — simply click the Netcraft logo to access a wealth of information about the sites you visit, helping you to make informed choices about their safety.
• Risk Ratings — we evaluate the characteristics of the site compared against those depicted by fraudulent sites. The result is a simple visual summary displayed on the site report.
• Conveniently report suspected phishing & fraudulent sites — At the click of the button you can report suspected web forgeries to Netcraft, helping to protect the community. Netcraft operates an incentive scheme for Phishing site submissions, including iPads, backpacks, mugs, and more... Over 38.4 million phishing sites have been detected and blocked by Netcraft since the anti-phishing service was launched (November 2017).
• Protection against cross site scripting (XSS) — The extension optionally traps XSS and other suspicious URLs which contain characters highly likely to deceive.

The Extension is available for download from the Firefox add-ons page and requires no special administrator privileges to install. Users of the existing Netcraft Anti-Phishing Toolbar will be upgraded automatically to the latest version.

Versions of the Extension are available for other browsers on the Google Chrome Store and Opera add-ons page.

Customised versions with corporate branding and navigation are also available.

Web shells are an overlooked aspect of cyber crime and do not attract the level of attention of either phishing or malware. Nevertheless, Netcraft found more than 6,000 web shells during April 2017, which works out at around 1 new shell installation every 5 minutes. When web shells first appeared, the limit of their functionality was to transfer files and execute arbitrary shell commands. However, the best engineered web shells now provide well presented, sophisticated toolkits for diverse crimes, with facilities for password cracking, privilege elevation, network reconnaissance, phishing, spamming and DDoS, not solely available through a web based user interface but also accepting commands as part of a botnet.

An example of the hugely popular and feature-rich WSO (Web Shell by Orb) shell.

A number of shells offer the creation of a botnet in as little as a click, launching standalone processes that either connect to a command and control server or listen for commands over an insecure TCP connection. Some allow performing port scans to find potentially exploitable services. Others enable fraudsters to schedule denial of service attacks. There are shells dedicated to sending bulk spam emails, testing stolen credentials against popular websites (such as PayPal or Amazon), cracking passwords, and automatically defacing websites. With such a wide array of powerful features, it is unsurprising how popular web shells are with cyber criminals.

WSO offers both bind shell and back connect options. Selecting one of these options will launch a standalone process that will connect to or listen for a connection from a remote command and control server - an easy method for the creation of a botnet.

The prevalence of these backdoors allows easy—and potentially persistent—access to thousands of compromised machines. If the web shell is missed during the webmaster's cleanup after an attack, removing the original phishing or malware content will be in vain, as the fraudster can use the web shell to upload new malicious material, or re-purpose the machine as an accessory to alternative forms of cyber crime.

Continue reading