{"id":17661,"date":"2020-02-06T14:10:03","date_gmt":"2020-02-06T22:10:03","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2020\/02\/06\/news-11396\/"},"modified":"2020-02-06T14:10:03","modified_gmt":"2020-02-06T22:10:03","slug":"news-11396","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2020\/02\/06\/news-11396\/","title":{"rendered":"Adposhel adware takes over browser push notifications administration"},"content":{"rendered":"

Credit to Author: Pieter Arntz| Date: Thu, 06 Feb 2020 18:10:02 +0000<\/strong><\/p>\n

Since late last year, our researchers have been monitoring new methods being deployed by cybercriminals to potentially abuse browser push notifications<\/a>. Now, an adware family detected by Malwarebytes as Adware.Adposhel<\/a> is doing just that, taking control of push notifications in Chrome at the administrator level.<\/p>\n

What does Adposhel adware do?<\/h3>\n

The adware uses Chrome policies to ensure that notification prompts will be shown to users ands add some of its own domains to the list of sites that are allowed to push browser notifications. So far nothing new. The recent twist, however, is that Adposhel enforces these settings as an administrator, meaning a regular Chrome user will not be able to change the settings in the notifications menu.<\/p>\n

It seems the adware family has now decided to fully deploy this tactic, as we are seeing complaints about it emerging on forums, such as Reddit. <\/p>\n

Victims have complained about being unable to remove domains from the list of domains that are allowed to show push notifications, and being unable to change the setting that control whether websites can ask you to allow notifications.<\/p>\n

\"default<\/figure>\n

Disabling that setting would stop a user from seeing prompts like these:<\/p>\n

\n
\"notifications<\/figure>\n<\/div>\n

If a user were to click Allow<\/strong> on that prompt, this domain would be added to their allowed list of URLs, with the understanding that it could be removed manually in the notifications menu. <\/p>\n

Adposhel uses the NotificationsAllowedForUrls<\/a> policy to block users from removing their entries from the Allow list. <\/p>\n

Where you would normally see the three dots (ellipsis) menu icon representing the settings menu, entries submitted to a policy by Adposhel will see an icon telling you the setting is enforced by an administrator.<\/p>\n

\n
\"settings<\/figure>\n<\/div>\n

If you hover over the icon, the accompanying text confirms it.<\/p>\n

\n
\"setting<\/figure>\n<\/div>\n

How do I undo the changes made by Adposhel adware?<\/h3>\n

This does not mean that you can change that setting just because you are the administrator of the system you are working on, by the way. But if you are the system administrator, you can fix the notification changes made by the Adposhel installer by applying a simple registry fix:<\/p>\n

Windows Registry Editor Version 5.00  [HKEY_LOCAL_MACHINESOFTWAREPoliciesGoogleChrome] \"DefaultNotificationsSetting\"=dword:00000001  [-HKEY_LOCAL_MACHINESOFTWAREPoliciesGoogleChromeNotificationsAllowedForUrls] <\/code><\/pre>\n
This is safe to do unless there were legitimate URLs in the list of URLs that were allowed to show notifications by policy, which I doubt. But we always advise to create a backup of the registry before making any changes. <\/p>\n
                                                 \u00a0Backing up Registry with ERUNT<\/strong><\/p>\n
 Modifying the registry may create unforeseen results, so we always recommend creating a backup prior to doing that<\/strong>.<\/p>\n
 Please download\u00a0ERUNT<\/a><\/strong>\u00a0and save the file to the desktop.<\/p>\n