Chromium Defense Alert: PEEP Browser RAT Forges Secure Preferences to Turn Chrome and Edge into Host Backdoors
Executive Summary
Security researchers at SOCRadar's Threat Research Unit (STRU) have published detailed technical findings on PEEP, an advanced post-exploitation Remote Access Trojan (RAT) targeting Chromium-based web browsers, including Google Chrome and Microsoft Edge (The Hacker News, SOCRadar Blog). Masquerading as a harmless "Smart Bookmarks" browser extension, PEEP bypasses official Web Store verification and security prompts by cryptographically forging Chromium's internal Secure Preferences integrity hashes directly on disk. It then leverages Chrome's native messaging interface to achieve persistent host-level command execution, file management, and real-time session credential theft.
Deep-Dive Technical Analysis
Tamper-Proofing Bypass via Secure Preferences Forgery
Chromium implements a security mechanism known as Secure Preferences (stored as a JSON file in user profile directories) to prevent malware from silently installing malicious extensions or altering browser startup settings. Chromium validates each sensitive setting using a machine-specific HMAC-SHA256 signature calculated from the user's SID and system hardware profile. Technical breakdown of PEEP's evasion mechanics reveals:
1. Cryptographic HMAC Reconstruction: Requiring initial access on the target Windows endpoint, PEEP's installer extracts the local user's Security Identifier (SID) and system hardware identifiers. It replicates Chromium's internal hashing algorithm, recalculating valid HMAC signatures for arbitrary extension paths.
2. Silent Extension Injection: By writing directly to Preferences and Secure Preferences files on disk while forging the calculated HMAC hashes, PEEP installs its malicious extension into Chrome and Edge without triggering the browser's "Corrupted Extension" warning dialog or prompting the user for installation approval.
3. Native Messaging Host Bridge: To break out of standard browser extension sandboxing, PEEP registers a custom Windows Native Messaging host via the registry (HKCU\Software\Google\Chrome\NativeMessagingHosts\com.peep.native). This native executable serves as a bidirectional command bridge between the browser JavaScript engine and the Windows operating system.
4. C2 Beaconing & Host Execution: Once loaded, the browser extension silently polls its command-and-control (C2) server every 30 seconds over HTTP. When administrative instructions arrive, the extension relays commands through the Native Messaging bridge to execute arbitrary PowerShell/batch scripts, download files, dump memory, and manipulate local processes with the active user's permissions.
5. Continuous Credential & Session Interception: In parallel, PEEP hooks active browser tabs to capture full browsing histories, log keystrokes entered into web forms, and harvest active session authentication cookies across enterprise web applications.
Enterprise Threat Modeling & Attack Surface
PEEP demonstrates a sophisticated evolution in browser-based post-exploitation:
* Living Inside Trusted Processes: Because command-and-control communications and web monitoring originate from legitimate, signed chrome.exe and msedge.exe processes, network firewalls and proxy filters often treat the outbound HTTP traffic as normal corporate web browsing.
* Durable Enterprise Foothold: Traditional endpoint scans targeting running malicious binaries frequently overlook extension files stored within user AppData directories, allowing the backdoor to survive incident response sweeps that focus only on standard startup registry keys or services.
Actionable Recommendations & Mitigations
1. Enforce Enterprise Extension Allowlisting: Deploy Chrome Enterprise and Microsoft Intune Group Policy Objects (GPOs) to enforce strict extension allowlisting (ExtensionInstallAllowlist) while globally blocking all unapproved extensions (ExtensionInstallBlocklist = ["*"]).
2. Restrict Native Messaging Host Registration: Configure the NativeMessagingBlocklist = ["*"] policy across all corporate workstations, only allowlisting explicitly vetted and cryptographically verified native messaging executables.
3. Monitor for Direct Profile Directory Modifications: Configure EDR rules to alert on non-browser processes opening or writing to AppData\Local\Google\Chrome\User Data\Default\Secure Preferences and equivalent Edge directories.
4. Audit Native Messaging Registry Paths: Routinely scan Windows registry paths (HKCU\Software\Google\Chrome\NativeMessagingHosts and HKLM\Software\Google\Chrome\NativeMessagingHosts) for unrecognized manifest definitions.
________________
Sources & References: The Hacker News, SOCRadar Blog.