[vnLoader]

After nearly 3 years of working with extension code, starting from scratch, now mature and experienced enough, I want to share the extension I'm working on with everyone.

People may think I'm promoting myself, but I really put a lot of effort into coding the best functions for everyone to use. This extension is also in the development stage so it's FREE to use, I hope everyone will try it and rate it. 🥹
This extension is called Facebook All in One, containing many automation functions/management functions/small utilities when using Facebook/Instagram.
Outstanding functions such as:
Bulk download: all photos/videos/reels/stories/groups/pages of anyone on fb/insta
Download all photos/videos in any post on fb
Manage messages: (no end-to-end encryption) View first message, View old messages at any time in the past, Download all message content for offline viewing
Manage friends: Add/Unfriend/Poke friends in bulk, Accept/Reject/Revoke friend requests in bulk, Filter locked friends, Filter low-interaction friends (count likes/comments on all posts), Find friends who are blocking your messages
Manage groups/pages: Leave groups/Unlike/Unfollow groups/pages in bulk, Filter groups without admins
Manage stories: View all friends' stories without anyone knowing, Add various types of emojis to stories, View total interactions of stories other people's stories, Download stories in bulk, View statistics of all your saved stories
Since it is under development, new functions will be continuously updated in the near future, there will be more useful functions for everyone. Make sure it is true to the name All in One
And here is the installation link from the chrome web store: [deleted]

[Bastille]

First malicious chrome extension I'm analyzing, interesting case.

OP shared a Chrome extension with many features :


Only 5 stars reviews, all recent, most of them are Vietnamese (such as OP) :


1. The first thing to do is to click on "Add to chrome", this will list all the access the extension requires :


2. We can download the .CRX file with the following website : https://crxextractor.com/


3. Once we've downloaded the .CRX file we can get the content with the same website using the other feature : https://crxextractor.com/


4. Now you get a .zip file, when you unzip it you can access the content of the extension, the first file to check it the manifest.json :

Spoiler (Click to View)

Code

{
"update_url": "https://clients2.google.com/service/update2/crx",

  "manifest_version": 3,
  "name": "Facebook all in one",
  "description": "__MSG_extDescription__",
  "homepage_url": "https://chromewebstore.google.com/detail/facebook-all-in-one/ncncagnhhigemlgiflfgdhcdpipadmmm",
  "version": "1.4",
  "default_locale": "en",
  "icons": {
    "16": "./assets/icon16.png",
    "32": "./assets/icon32.png",
    "48": "./assets/icon32.png",
    "128": "./assets/icon128.png"
  },
  "action": {
    "default_popup": "./scripts/popup/index.html",
    "default_icon": "./assets/icon32.png"
  },
  "permissions": [
    "storage",
    "cookies",
    "activeTab",
    "scripting",
    "declarativeNetRequest",
    "declarativeNetRequestFeedback",
    "declarativeNetRequestWithHostAccess"
  ],
  "background": {
    "service_worker": "./scripts/background/index.js",
    "type": "module"
  },
  "host_permissions": ["*://*/*", "<all_urls>"],
  "content_scripts": [
    {
      "matches": ["*://*/*"],
      "js": ["./scripts/content/content.js"],
      "run_at": "document_start",
      "all_frames": true
    }
  ],
  "declarative_net_request": {
    "rule_resources": [
      {
        "enabled": true,
        "id": "ruleset_fb_aio",
        "path": "./rules.json"
      }
    ]
  },
  "web_accessible_resources": [
    {
      "resources": ["scripts/*"],
      "matches": ["<all_urls>"]
    }
  ],
  "externally_connectable": {
    "matches": [
      "https://useful-scripts-extension.github.io/*",
      "https://facebook-all-in-one.com/*",
      "http://localhost:5173/*",
      "http://127.0.0.1:5173/*",
      "http://localhost:5500/*",
      "http://127.0.0.1:5500/*"
    ]
  }
}

Many things are dangerous here in the "Permissions" :
- Cookies : Allowed to get access to all cookies from your browser
- Scripting : Can inject scripts into web pages
- declarativeNetRequest and declarativeNetRequestFeedback : can redirect traffic
- declarativeNetRequestWithHostAccess : can intercept and edit the requests

host_permissions :
- ://*/ & <all_urls> : grant access to all URLs, can read and edit all the content from these URLs

There are other scripts that are executed and also seem malicious.

It seems that the extension could do what it announces, however it's too permissive and there is definitely a risk for the user

[Dammm]

In deoxbobkbke roifioroxnrco

---

Zoo ball do so so so so cp cp do cl cl do all me bl [warn]

[cam667]

omg nice extentions your vey kindness

[Bastille]

omg nice extentions your vey kindness

I've made a detailed explanation with screenshots to show how dangerous this extension it is and you said "nice extension" ?

I don't think you even read the thread