14

I found a site called https://alibonus.com/ - they are offering to install Google Chrome extension, to shop with cash-back.

What risks could there be with a service like this? Their Google Chrome Extension asks for access for all pages that I visit.

screenshot of the extension page

How do they make a profit and what of scam type is this called?

18

It's not necessarily a scam. I've used several of those types of services to different degrees of success. Just be sure to only use a reputable service.

They make money by essentially acting as a referral to the site you're shopping through. They get a commission from the site you're purchasing through and pass a small portion of that commission back to you in the form of cash back. They're also likely selling your browsing history to services that need info on trends.

If you're really concerned about them seeing things you don't want them to see, install the plugin on a browser you don't use often rather than your primary browser. Also, disable the plugin or use incognito mode (Chrome) to browse to sensitive sites like banks.

  • 1
    Thank you very much. Nice idea about browsing history and referral system. – Arthur Jan 20 '17 at 19:48
  • "sensitive sites like banks" – Mark Segal Jan 21 '17 at 19:18
27

The risk is that you are installing software on your browser than can see everything you do. Which means they can get all your credit card and banking information, they can capture all your logins, and they can send your browsing history back to a central site.

The ability to change the data means that they can also inject additional advertisements into what you see. Those ads make them money. Do you really want to see even more ads? Those ads can be the source of the risk.

Yes browsing with incognito enabled will mitigate some of the risks, but you can also specify that an extension still works while incognito: so make sure you don't open the risk back up again while browsing.

Also remember that just because a site/product is not a scam now, it doesn't mean that in the near future won't become a scam.

6

Installing untrusted addons into a browser is a bad idea. It's like installing malware directly. They can potentially escape from the browser through exploits that are way easier with more rights.

In this case they could do just about anything.

They could commit fraud in your name by stealing from websites you visit through YOUR computer, YOU could be prosecuted for hacking.

Or they could steal from you by changing your information (shipping adress) or steal your credit card/banking data directly.

additonal source and info: https://security.stackexchange.com/a/98278/77793

On a note, you can read the java/javascript code of the extension afaik, by decompiling it. So if there is a real author and a big community using the plugin it's unlikely to be a security thread as the author would potentially risk prosecution and have his malware open source.

  • 3
    In general, this is really bad advice. Can the average person really read code and figure out what it is doing? Down voted for that reason. – Pete B. Jan 20 '17 at 15:20
  • It's much, much more likely the plugin is written in JavaScript than in Java. – ChrisInEdmonton Jan 20 '17 at 15:34
  • My point is, if it's a big plugin, with many many users someone most likely would discover a plugin spying on it's users. I'm aware that most people can't read code or detect it, and reading decompiled code or deobfuscated code in itself is a challenge. – HopefullyHelpful Jan 20 '17 at 15:49
2

The legitimate way such things are supposed to make money us by tracking your purchases and other browser use, so they can target you with ads for things you are more likely to buy, and/or so they can sell that info to others for similar purposes. At the very least you are explicitly giving them info about any purchase you want cash back from.

0

They're not scamming you, they're scamming the companies.

They modify the headers so it looks like they referred you to the site and thus collect the commission for what is actually just you visiting the site.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.