The record
Written from the 1 report below. Nothing here is unsourced.
- A malicious Twitch browser extension called JeetBot leaked the OAuth tokens of nearly 31,000 users to proxy servers run by a Russian commercial bot service.
- The extension was listed on both the Chrome Web Store and Firefox Add-Ons store, with about 30,000 users on Chrome and 604 on Firefox.
- The leaked token could allow access to a user's Twitch chat, private messages, and account settings, and was logged in cleartext on the proxy servers.
- The developer, a Cyprus-based programmer named Aleksandr Popov, called the token forwarding an oversight and released version 85.8.7 of the Firefox add-on that stops the token from being sent.
- Updating or disabling the extension does not revoke tokens already transmitted, so affected users remain at risk until they take action on their accounts.
What to watch next
- Chrome version 85.8.7 is still awaiting Chrome Web Store review, so Chrome users may remain exposed.
- Users should check whether updating removes the risk or whether Twitch should force-revoke the leaked tokens.
- Both extensions were still available for download at the time of the report, so watch whether the stores remove or suspend the listings.
Who said what1
Only words found exactly in the article are shown, attributed and linked to the line they came from.
Kush Pandya
Socket security researcher
1 quote · 1 outlet
“Current builds (v85.x) forward the token inline as an &auth= query parameter on a network-layer redirect to the operator's proxy”
In the article
…listing description states: "JeetBot is a modern tool for streamers and viewers who appreciate quality, convenience, and control," adding it "expands Twitch capabilities: 1080p stream for regions with constraints." " Current builds (v85.x) forward the token inline as an &auth= query parameter on a network-layer redirect to the operator's proxy ," Socket security researcher Kush Pandya said. "The token is forwarded for every channel the user watches, except a hardcoded allowlist of ten Russian streamer channels, whose sessions are exempted from forwarding."…
Coverage1
All filed from India
Named Russia · Cyprus · Google Chrome · Mozilla Firefox · Twitch · Aleksandr Popov · HISHIMIRO · JeetBot · Kush Pandya · Socket
The 1 report is listed beside the record.
Ask this story
Answers cite the reports above, or say they can't.