- Socket found by Twitch extension GBot collecting OAuth tokens through proxy servers
- Tokens are excluded only for 10 Russian streaming channels, which suggests thoughtful design.
- The developer has released fixes, but users should revoke public tokens for security reasons.
A browser extension for Twitch was collecting people’s OAuth tokens and sending them to a Russian server. This move was deliberate, but determining whether it was malicious or not is not so easy.
Socket security researchers recently found an extension for Chrome and Firefox called “Twitch Enhanced Viewer | JeeBot.” It has about 30,000 Chrome users and about 600 Firefox users.
The Chrome Web Store touts it as “a modern tool for streamers and viewers who value quality, convenience, and control.” Apparently it makes streaming and browsing more intuitive, allows you to watch content in 2K, hides banner ads and unwanted elements, and even offers an AI bot to make interacting with your stream easier.
Latest videos fromTechRadar
Hard-coded exceptions
According to researchers, the extension is designed to fetch playlists of Twitch video streams through its own proxy servers. However, instead of simply forwarding requests, the extension also attached users’ OAuth tokens, and since they were placed in the URL, the token also ended up in the proxy’s request logs.
Following a call for this, the extension’s developer (HISHIMIRO/jeetbot.cc) has released a new version 85.8.7 (the Firefox Chrome version is currently under review) which appears to fix this flaw: when retrieving playlists, the user’s OAuth token is no longer sent to the proxy. It would appear that this was an honest mistake that was corrected after responsible disclosure. However, here’s what Socket had to say about the way to obtain tokens:
“Current builds (v85.x) forward the token as an &auth= request parameter when redirecting the network layer to the operator proxy,” Socket explained. “The token is forwarded for every channel the user watches, with the exception of a hard-coded whitelist of ten Russian streaming channels whose sessions are exempt from forwarding.”
If there was a list of 10 Russian streaming channels exempt from receiving OAuth tokens, it’s safe to assume that the developer knew exactly what he was doing.
It’s good that the extensions have been updated, but if you’re using them, you should also revoke your public Twitch token just in case.
By using Hacker news
The best antivirus for any budget
Follow TechRadar on Google News. And add us as your preferred source to get our expert news, reviews and opinions in your feeds.