{"id":605,"date":"2016-11-04T14:39:13","date_gmt":"2016-11-04T14:39:13","guid":{"rendered":"http:\/\/www.adlice.com\/?p=605"},"modified":"2022-12-21T10:36:00","modified_gmt":"2022-12-21T10:36:00","slug":"google-chrome-secure-preferences","status":"publish","type":"post","link":"https:\/\/www.adlice.com\/de\/google-chrome-secure-preferences\/","title":{"rendered":"Google Chrome: How to Bypass Secure Preferences"},"content":{"rendered":"\n<p><strong>Google Chrome protects its user preferences<\/strong> using a hashing (HMAC SHA256) mechanism. However, <strong>there&#8217;s a way to bypass it and it&#8217;s quite used by malware<\/strong> in the wild.<\/p>\n\n\n\n<p>We will first study <strong>the way Chrome protects its user settings<\/strong> (Secure Preferences), then we will see <strong>how it can be defeated by rewriting the needed hashes<\/strong>. In the end, we will <strong>study a malware that uses that technique<\/strong> and we will see how <a href=\"https:\/\/www.adlice.com\/download\/roguekiller\/\">RogueKiller Anti-malware<\/a> can defeat it using that technique as well.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><br>Secure Preferences<\/h2>\n\n\n\n<p>Each user profile (located in <strong>%localappdata%\/Google\/Chrome\/User Data\/ProfileName<\/strong>) has a bunch of <strong>configuration files for storing bookmarks, history, and preferences<\/strong>. Among those files, two of them (Preferences, Secure Preferences) are storing the <strong>user settings like homepage, search engine<\/strong>, etc&#8230;<\/p>\n\n\n\n<p><strong>Secure Preferences<\/strong> implements (as its name suggests) some <strong>securing mechanism to ensure no malware comes to modify the file<\/strong> manually. This is achieved by <strong>hashing some of the json nodes<\/strong> with a custom hashing protocol, based on <strong>HMAC SHA256<\/strong>, each time a setting is modified by Google Chrome.<\/p>\n\n\n\n<p>At startup, Chrome then <strong>verifies all the hashes<\/strong> and if something doesn&#8217;t match it <strong>asks for a restore<\/strong>.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/www.adlice.com\/wp-content\/uploads\/2016\/11\/corrupted.png\"><img decoding=\"async\" width=\"822\" height=\"546\" src=\"https:\/\/www.adlice.com\/wp-content\/uploads\/2016\/11\/corrupted.png\" alt=\"corrupted\" class=\"wp-image-606\" srcset=\"https:\/\/www.adlice.com\/wp-content\/uploads\/2016\/11\/corrupted.png 822w, https:\/\/www.adlice.com\/wp-content\/uploads\/2016\/11\/corrupted-300x199.png 300w, https:\/\/www.adlice.com\/wp-content\/uploads\/2016\/11\/corrupted-330x220.png 330w\" sizes=\"(max-width: 822px) 100vw, 822px\" \/><\/a><\/figure>\n\n\n\n<p>This is how (an infected) Secure Preferences file looks like:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>{\n  \"browser\": {\n    \"show_home_button\": true\n  },\n  \"default_search_provider\": {\n    \"enabled\": true,\n    \"encodings\": \"UTF-8\",\n    \"prepopulate_id\": 0\n  },\n  \"default_search_provider_data\": {\n    \"template_url_data\": {\n      \"keyword\": \"trotux\",      \n      \"url\": \"http:\\\/\\\/www.trotux.com\\\/search\\\/?q={searchTerms}&amp;z=63239075972bb5d9d70da35g4zdm9zdeacac3q6oct&amp;from=icb&amp;uid=VBOXXHARDDISK_VB3d33e4ab-f149eb42&amp;type=sp\",\n      ...\n    }\n  },\n  \"extensions\": {\n    \"known_disabled\": &#91;\n      \n    ],\n    \"settings\": {\n        ...\n    }\n  },\n  \"homepage\": \"http:\\\/\\\/www.trotux.com\\\/?z=63239075972bb5d9d70da35g4zdm9zdeacac3q6oct&amp;from=icb&amp;uid=VBOXXHARDDISK_VB3d33e4ab-f149eb42&amp;type=hp\",\n  \"homepage_changed\": true,\n  \"homepage_is_newtabpage\": false,\n  \"pinned_tabs\": &#91;    \n  ],\n  \"protection\": {\n    \"macs\": {\n      \"browser\": {\n        \"show_home_button\": \"D72D3A4AE301492E30C5840566DCCD9EE5F2066E792805D5F59B7DFC056B2F83\"\n      },\n      \"default_search_provider\": {\n        \"keyword\": \"4E70E531D9FE35B77433ED7CBB36F9A72701C928679E49F64F71E63D3813EF86\",\n        \"name\": \"2C12B4EE800F1C223FDF8B2D24967192C55841015DBE6F3602538E75B2209075\",\n        \"search_url\": \"7AB9E5FCF7FF91530B1F36B3D593EA9D48DE74BB228B8F566BBC4E74C4E97705\"\n      },\n      \"default_search_provider_data\": {\n        \"template_url_data\": \"14C800C1FB62974BB653070FEABEC06A4F91ED01773354C03B5C2456DCC3B78A\"\n      },\n      \"extensions\": {\n        \"known_disabled\": \"3B2D6F2EE0DE5BB99976E4DE120B6C6E9E8AE6D50BA6665CF4D7A617783CA5B9\",\n        \"settings\": {\n          ...\n        }\n      },\n      \"google\": {\n        \"services\": {\n          \"account_id\": \"B06F39E76B49B24DE765021EBB621EC88FD029F86F4FE2A588360110A7DF4EA1\",\n          \"last_account_id\": \"2CE2762DD69EB763602E6D67F063A9A3302909B0080C6962F7E4BBE1F3AC1861\",\n          \"last_username\": \"C1E45A7D2667A3CFE15B5F1BA572E51554F5BB35AC5ABB709DC3EC0E83596FC3\",\n          \"username\": \"C9139E29A994D7131018AF8C6520A3EFBE59BB3555D3CE5B6F07906CCD10456D\"\n        }\n      },\n      \"homepage\": \"6D5A2725E3385B12610051F2019FDC7452CFF7863DF5C4A202CFACF5AE166ACF\",\n      \"homepage_changed\": true,\n      \"homepage_is_newtabpage\": \"8CD33E8A34AD6F5F8341702ED482FD16020BBBA37972D958168D8334945CA533\",\n      \"pinned_tabs\": \"6443846DA531F6BDFFE87F17E1AFF9739D4A816CABCAAAF35C0A0EF0E81D9162\",\n      \"prefs\": {\n        \"preference_reset_time\": \"DE6810A8F6703E3EDEABD407E27612F88E9DBA3B0318692F57A71005142C2B69\"\n      },\n      \"profile\": {\n        \"reset_prompt_memento\": \"7122E3BBEDDBEC92FDBBD0899A15E3D0B6F8C546195045E571405DFB99C8B82D\"\n      },\n      \"safebrowsing\": {\n        \"incidents_sent\": \"DA02CC41A2157A273538A127A693AF1AB06329276766E7A0BFA1DCCED5720D4A\"\n      },\n      \"search_provider_overrides\": \"C623DCD793B7DE76BEE45387932E1D245150D190F5322680F0F0E88F73698487\",\n      \"session\": {\n        \"restore_on_startup\": \"F1AD6F4A7E65CBCA6683C30586F2F14B958729A1A2E89231DF300F245B5923DD\",\n        \"startup_urls\": \"CCFD36CED4675FF0817C0847AFE300476D804E7AAE437CB2B074F5E8477A4C2D\"\n      },\n      \"software_reporter\": {\n        \"prompt_seed\": \"FED73C26AAD4579B62F8793895CBEC2ECFBE59199C79AB68F486A29AAC51B220\",\n        \"prompt_version\": \"623DD568AFD8A981E71A63CD11663071E151C2B96171AD56D3C58558A6776133\"\n      }\n    },\n    \"super_mac\": \"3AA7590924852A9F2A55AC29641D603DDF1EAC8D96E72B0582770B5BC49CD47B\"\n  },\n  \"session\": {\n    \"restore_on_startup\": 4,\n    \"startup_urls\": &#91;\n      \"http:\\\/\\\/www.trotux.com\\\/?z=63239075972bb5d9d70da35g4zdm9zdeacac3q6oct&amp;from=icb&amp;uid=VBOXXHARDDISK_VB3d33e4ab-f149eb42&amp;type=hp\"\n    ]\n  },\n  \"sync\": {    \n  }\n}<\/code><\/pre>\n\n\n\n<p><br><strong>We can see a few interesting fields<\/strong> regarding startup urls and homepage (highlighted). For each field, we have a <strong>corresponding entry in the &#8220;protection.macs&#8221;<\/strong> node. If some program modifies (manually) one of the settings above it <strong>will need to update the corresponding hash<\/strong> in the macs, as well as the &#8220;super_mac&#8221; entry.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><br>Custom HMAC<\/h2>\n\n\n\n<p>The custom HMAC hash is fortunately <a href=\"https:\/\/cs.chromium.org\/chromium\/src\/rlz\/lib\/machine_id.cc?sq=package:chromium\">documented from the Chromium sources<\/a>. With a little bit of reverse, guesses and code reading,<strong> we&#8217;ve been able to reproduce the algorithm<\/strong>:<\/p>\n\n\n\n<p>The HMAC SHA256 is a hashing mechanism that <strong>produces a SHA256 from a key (or seed) and a message<\/strong>. Let&#8217;s see how to obtain them:<\/p>\n\n\n\n<h4 class=\"has-accent-color has-text-color wp-block-heading\"><br>HMAC Seed<\/h4>\n\n\n\n<p><strong>The seed is unique to a machine<\/strong> where Chrome is installed (or per Chrome version?). It&#8217;s stored in Chrome&#8217;s installation path (<strong>C:\\Program Files (x86)\\Google\\Chrome\\Application\\ChromeVersion\\resources.pak<\/strong>). This format is quite known now, <a href=\"http:\/\/stackoverflow.com\/questions\/10633357\/how-to-unpack-resources-pak-from-google-chrome\">and well explained here<\/a>.<\/p>\n\n\n\n<p>All you need to do is to look for the <strong>first resource with a length of 64<\/strong>.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/www.adlice.com\/wp-content\/uploads\/2016\/11\/seed.png\"><img decoding=\"async\" width=\"940\" height=\"616\" src=\"https:\/\/www.adlice.com\/wp-content\/uploads\/2016\/11\/seed.png\" alt=\"seed\" class=\"wp-image-607\" srcset=\"https:\/\/www.adlice.com\/wp-content\/uploads\/2016\/11\/seed.png 940w, https:\/\/www.adlice.com\/wp-content\/uploads\/2016\/11\/seed-300x197.png 300w\" sizes=\"(max-width: 940px) 100vw, 940px\" \/><\/a><\/figure>\n\n\n\n<h4 class=\"has-accent-color has-text-color wp-block-heading\"><br>HMAC Message<\/h4>\n\n\n\n<p><strong>To build the message, we first need to get a Machine ID<\/strong> (unique identifier per machine). We can follow the logic once again <a href=\"https:\/\/kaimi.io\/2015\/04\/google-chrome-and-secure-preferences\">in the Chromium sources<\/a>, but basically it looks like this:<\/p>\n\n\n\n<h5 class=\"wp-block-heading\">Obtain machine SID<\/h5>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Get machine name with <a href=\"https:\/\/msdn.microsoft.com\/fr-fr\/library\/windows\/desktop\/ms724295(v=vs.85).aspx\">GetComputerName<\/a> (<strong>JOHN-PC<\/strong>)<\/li>\n\n\n\n<li>Get SID for machine name with <a href=\"https:\/\/msdn.microsoft.com\/fr-fr\/library\/windows\/desktop\/aa379159(v=vs.85).aspx\">LookupAccountName<\/a><\/li>\n\n\n\n<li>Convert SID to string with <a href=\"https:\/\/msdn.microsoft.com\/fr-fr\/library\/windows\/desktop\/aa376399(v=vs.85).aspx\">ConvertSidToStringSid<\/a> (<strong>S-1-5-21-1650828501-840997873-2917006960<\/strong>)<\/li>\n<\/ul>\n\n\n\n<h5 class=\"wp-block-heading\">Obtain volume ID<\/h5>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Get system drive letter with <a href=\"https:\/\/msdn.microsoft.com\/en-us\/library\/windows\/desktop\/ms724373(v=vs.85).aspx\">GetSystemDirectory<\/a> (<strong>C:<\/strong>)<\/li>\n\n\n\n<li>Get serial number with <a href=\"https:\/\/msdn.microsoft.com\/en-us\/library\/windows\/desktop\/aa364993(v=vs.85).aspx\">GetVolumeInformation<\/a> (<strong>1551496638<\/strong>)<\/li>\n<\/ul>\n\n\n\n<h5 class=\"wp-block-heading\">Create machine ID<\/h5>\n\n\n\n<p><strong>The machine ID can then be obtained with the following pseudo-code<\/strong> (please note everything is performed as binary operations):<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>machine_id = SHA1(machine_sid) + volume_id\nmachine_id += CRC8(machine_id)\nmachine_id = ToString(machine_id)\n\nLooks like: 6C91392A619A18390D101846C1656CC6812CA02D5C79F5BE89<\/code><\/pre>\n\n\n\n<h5 class=\"wp-block-heading\"><br>Obtain the message<\/h5>\n\n\n\n<p>The message can be obtained using the following pseudo-code:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>message = machine_id (6C91392A619A18390D101846C1656CC6812CA02D5C79F5BE89)\nmessage += json_path (extensions.settings.aapocclcgogkmnckokdopfmhonfmgoek)\nmessage += json_content ({\"ack_external\":true,\"app_launcher_ordinal\":\"z\",...,\"was_installed_by_oem\":false})\n\nLooks like: 6C91392A619A18390D101846C1656CC6812CA02D5C79F5BE89extensions.settings.aapocclcgogkmnckokdopfmhonfmgoek{\"ack_external\":true,\"app_launcher_ordinal\":\"z\",...,\"was_installed_by_oem\":false}<\/code><\/pre>\n\n\n\n<p><br><strong>Please note that the Json content needs to be modified<\/strong> a little bit by <strong>removing the empty arrays and objects<\/strong>, and that the &#8220;&lt;&#8221; character (for some reason) needs to be replaced by its unicode hexadecimal representation. &nbsp;<\/p>\n\n\n\n<h4 class=\"has-accent-color has-text-color wp-block-heading\"><br>Hashing the Message<\/h4>\n\n\n\n<p><strong>Find below the code (shortened) we use to hash a json node<\/strong>, given its path and required machine ID and seed. It&#8217;s using a HMAC 256 method <a href=\"https:\/\/www.cryptopp.com\/\">from cryptopp<\/a>, but you can use any method you like (works with OpenSSL).<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>wstring Chrome::GetContentHmac( wstring const&amp; json_path, JsonDB&amp; db, json_t* node ) const\n{\n    \/\/ We need to remove empty arrays and objects\n    json_t* clean = db.Clone( node );\n    if ( clean == NULL ) return L\"\";\n    JsonDB::RemoveEmpty( clean );\n\n    string json_content     = db.StrAnsi( false, clean, true );\n    json_content            = mstring::replacestr( json_content, \"&lt;\", \"\\\\u003C\" );\n\n    JsonDB::Release( clean );\n\n    string key           = mstring( hmac_seed ).to_utf8();\n    string path          = mstring( json_path ).to_utf8();\n    string content_str   = json_content;\n    string msg           = mstring( machine_id ).to_utf8() + path + content_str;\n\n    Buffer key_buff     = Buffer::FromHexString( mstring::from_utf8( key ) );\n    wstring hmac        = Encrypt::HMACSHA256String( (const char*) key_buff.Data(), key_buff.Size(), msg );\n\n    return hmac;\n}<\/code><\/pre>\n\n\n\n<p><br>Once you have that HMAC, it&#8217;s <strong>easy to replace the corresponding entry in the protection.macs node<\/strong>. After that, <strong>you need to get and replace the super_mac<\/strong> as well with the following information:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>message = machine_id (6C91392A619A18390D101846C1656CC6812CA02D5C79F5BE89)\nmessage += json_path (empty)\nmessage += json_content (content of the protection.macs node)<\/code><\/pre>\n\n\n\n<p><br>We have developed <strong>a small script able to check and replace all the broken macs<\/strong> from the secure preferences, here&#8217;s some screenshots:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/www.adlice.com\/wp-content\/uploads\/2016\/11\/fix.png\"><img decoding=\"async\" width=\"641\" height=\"727\" src=\"https:\/\/www.adlice.com\/wp-content\/uploads\/2016\/11\/fix.png\" alt=\"fix\" class=\"wp-image-609\" srcset=\"https:\/\/www.adlice.com\/wp-content\/uploads\/2016\/11\/fix.png 641w, https:\/\/www.adlice.com\/wp-content\/uploads\/2016\/11\/fix-265x300.png 265w\" sizes=\"(max-width: 641px) 100vw, 641px\" \/><\/a><\/figure>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/www.adlice.com\/wp-content\/uploads\/2016\/11\/fixed.png\"><img decoding=\"async\" width=\"640\" height=\"437\" src=\"https:\/\/www.adlice.com\/wp-content\/uploads\/2016\/11\/fixed.png\" alt=\"fixed\" class=\"wp-image-610\" srcset=\"https:\/\/www.adlice.com\/wp-content\/uploads\/2016\/11\/fixed.png 640w, https:\/\/www.adlice.com\/wp-content\/uploads\/2016\/11\/fixed-300x205.png 300w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/><\/a><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\"><br>In the Wild<\/h2>\n\n\n\n<p><strong>Some malware are using that trick<\/strong> to bypass Chrome protection and install themselves in the user settings.<\/p>\n\n\n\n<p><strong>This the case of the adware Trotux\/Elex<\/strong>, which replaces the homepage, startup urls and the search engine. The infected secure preferences given as example <strong>comes from this malware<\/strong>.<\/p>\n\n\n\n<p><a href=\"https:\/\/www.adlice.com\/roguekiller\/\" target=\"_blank\" rel=\"noreferrer noopener\">RogueKiller is able to remove it<\/a>, as well as cleanup the browser.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/www.adlice.com\/wp-content\/uploads\/2016\/11\/trotux.png\"><img decoding=\"async\" width=\"1045\" height=\"684\" src=\"https:\/\/www.adlice.com\/wp-content\/uploads\/2016\/11\/trotux.png\" alt=\"trotux\" class=\"wp-image-608\" srcset=\"https:\/\/www.adlice.com\/wp-content\/uploads\/2016\/11\/trotux.png 1045w, https:\/\/www.adlice.com\/wp-content\/uploads\/2016\/11\/trotux-300x196.png 300w, https:\/\/www.adlice.com\/wp-content\/uploads\/2016\/11\/trotux-1024x670.png 1024w\" sizes=\"(max-width: 1045px) 100vw, 1045px\" \/><\/a><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\"><br>Detection and Removal<\/h2>\n\n\n\n<p><strong>Starting with version 12.8.0, <a href=\"https:\/\/www.adlice.com\/roguekiller\/\" target=\"_blank\" rel=\"noreferrer noopener\">RogueKiller is able<\/a> to detect infectious Chrome settings, and remove them<\/strong>. It&#8217;s also able to <strong>update the protection.macs settings<\/strong> so that the cleanup will be totally transparent for the Chrome browser, and it won&#8217;t restore the infected setup.<\/p>\n\n\n\n<p>It&#8217;s really important, because <strong>any setting restored without updating the HMAC hashes<\/strong> will result in a <strong>restoration of the infectious state by the Chrome browser iteself<\/strong>.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/www.adlice.com\/wp-content\/uploads\/2016\/11\/chrom_scn.png\"><img decoding=\"async\" width=\"997\" height=\"583\" src=\"https:\/\/www.adlice.com\/wp-content\/uploads\/2016\/11\/chrom_scn.png\" alt=\"chrom_scn\" class=\"wp-image-611\" srcset=\"https:\/\/www.adlice.com\/wp-content\/uploads\/2016\/11\/chrom_scn.png 997w, https:\/\/www.adlice.com\/wp-content\/uploads\/2016\/11\/chrom_scn-300x175.png 300w\" sizes=\"(max-width: 997px) 100vw, 997px\" \/><\/a><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\"><br>Links<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/kaimi.io\/2015\/04\/google-chrome-and-secure-preferences\">https:\/\/kaimi.io\/2015\/04\/google-chrome-and-secure-preferences<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/cs.chromium.org\/chromium\/src\/rlz\/lib\/machine_id.cc?sq=package:chromium\">https:\/\/cs.chromium.org\/chromium\/src\/rlz\/lib\/machine_id.cc?sq=package:chromium<\/a><\/li>\n\n\n\n<li><a href=\"http:\/\/stackoverflow.com\/questions\/10633357\/how-to-unpack-resources-pak-from-google-chrome\">http:\/\/stackoverflow.com\/questions\/10633357\/how-to-unpack-resources-pak-from-google-chrome<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/blog.malwarebytes.com\/threat-analysis\/2015\/05\/winyahoo-pup-modifies-chrome-secure-preferences\/\">https:\/\/blog.malwarebytes.com\/threat-analysis\/2015\/05\/winyahoo-pup-modifies-chrome-secure-preferences\/<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Google Chrome protects its user preferences using a hashing mechanism. However, there&#8217;s a way to bypass this, and it&#8217;s quite used by malware in the wild.<\/p>\n","protected":false},"author":1,"featured_media":606,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[36],"tags":[7,472,471,433,474,8,475,473],"class_list":["post-605","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-analysis","tag-analysis","tag-chrome","tag-google","tag-hash","tag-hmac","tag-malware","tag-preferences","tag-settings","category-36","description-off"],"views":11419,"yoast_score":67,"yoast_readable":60,"featured_image_src":"https:\/\/www.adlice.com\/wp-content\/uploads\/2016\/11\/corrupted.png","author_info":{"display_name":"tigzy","author_link":"https:\/\/www.adlice.com\/de\/author\/tigzy\/"},"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.1.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Google Chrome: How to Bypass Secure Preferences \u2022 Adlice Software<\/title>\n<meta name=\"description\" content=\"Google Chrome protects its user secure preferences using a hashing mechanism. Discover how to bypass it, and how it&#039;s used by malware.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.adlice.com\/google-chrome-secure-preferences\/\" \/>\n<meta property=\"og:locale\" content=\"de_DE\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Google Chrome: How to Bypass Secure Preferences \u2022 Adlice Software\" \/>\n<meta property=\"og:description\" content=\"Google Chrome protects its user secure preferences using a hashing mechanism. Discover how to bypass it, and how it&#039;s used by malware.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.adlice.com\/google-chrome-secure-preferences\/\" \/>\n<meta property=\"og:site_name\" content=\"Adlice Software\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/RogueKiller\" \/>\n<meta property=\"article:published_time\" content=\"2016-11-04T14:39:13+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-12-21T10:36:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.adlice.com\/wp-content\/uploads\/2016\/11\/corrupted.png\" \/>\n\t<meta property=\"og:image:width\" content=\"822\" \/>\n\t<meta property=\"og:image:height\" content=\"546\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"tigzy\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@AdliceSoftware\" \/>\n<meta name=\"twitter:site\" content=\"@AdliceSoftware\" \/>\n<meta name=\"twitter:label1\" content=\"Verfasst von\" \/>\n\t<meta name=\"twitter:data1\" content=\"tigzy\" \/>\n\t<meta name=\"twitter:label2\" content=\"Gesch\u00e4tzte Lesezeit\" \/>\n\t<meta name=\"twitter:data2\" content=\"6\u00a0Minuten\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.adlice.com\/google-chrome-secure-preferences\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.adlice.com\/google-chrome-secure-preferences\/\"},\"author\":{\"name\":\"tigzy\",\"@id\":\"https:\/\/www.adlice.com\/#\/schema\/person\/a02b30804320a4059d268dc2567a307d\"},\"headline\":\"Google Chrome: How to Bypass Secure Preferences\",\"datePublished\":\"2016-11-04T14:39:13+00:00\",\"dateModified\":\"2022-12-21T10:36:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.adlice.com\/google-chrome-secure-preferences\/\"},\"wordCount\":800,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.adlice.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.adlice.com\/google-chrome-secure-preferences\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.adlice.com\/wp-content\/uploads\/2016\/11\/corrupted.png\",\"keywords\":[\"analysis\",\"chrome\",\"google\",\"hash\",\"hmac\",\"malware\",\"preferences\",\"settings\"],\"articleSection\":[\"Analysis\"],\"inLanguage\":\"de\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.adlice.com\/google-chrome-secure-preferences\/\",\"url\":\"https:\/\/www.adlice.com\/google-chrome-secure-preferences\/\",\"name\":\"Google Chrome: How to Bypass Secure Preferences \u2022 Adlice Software\",\"isPartOf\":{\"@id\":\"https:\/\/www.adlice.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.adlice.com\/google-chrome-secure-preferences\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.adlice.com\/google-chrome-secure-preferences\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.adlice.com\/wp-content\/uploads\/2016\/11\/corrupted.png\",\"datePublished\":\"2016-11-04T14:39:13+00:00\",\"dateModified\":\"2022-12-21T10:36:00+00:00\",\"description\":\"Google Chrome protects its user secure preferences using a hashing mechanism. Discover how to bypass it, and how it's used by malware.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.adlice.com\/google-chrome-secure-preferences\/#breadcrumb\"},\"inLanguage\":\"de\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.adlice.com\/google-chrome-secure-preferences\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"de\",\"@id\":\"https:\/\/www.adlice.com\/google-chrome-secure-preferences\/#primaryimage\",\"url\":\"https:\/\/www.adlice.com\/wp-content\/uploads\/2016\/11\/corrupted.png\",\"contentUrl\":\"https:\/\/www.adlice.com\/wp-content\/uploads\/2016\/11\/corrupted.png\",\"width\":822,\"height\":546},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.adlice.com\/google-chrome-secure-preferences\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.adlice.com\/de\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Google Chrome: How to Bypass Secure Preferences\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.adlice.com\/#website\",\"url\":\"https:\/\/www.adlice.com\/\",\"name\":\"Adlice Software\",\"description\":\"Anti-malware and analysis tools\",\"publisher\":{\"@id\":\"https:\/\/www.adlice.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.adlice.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"de\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.adlice.com\/#organization\",\"name\":\"Adlice Software\",\"url\":\"https:\/\/www.adlice.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"de\",\"@id\":\"https:\/\/www.adlice.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.adlice.com\/wp-content\/uploads\/2020\/05\/B1rTNpTG_400x40_10.png\",\"contentUrl\":\"https:\/\/www.adlice.com\/wp-content\/uploads\/2020\/05\/B1rTNpTG_400x40_10.png\",\"width\":276,\"height\":276,\"caption\":\"Adlice Software\"},\"image\":{\"@id\":\"https:\/\/www.adlice.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/RogueKiller\",\"https:\/\/x.com\/AdliceSoftware\",\"https:\/\/fr.linkedin.com\/company\/adlice-software\",\"https:\/\/www.youtube.com\/channel\/UC4CQ-gIZMGWxl-auf0QqYhQ\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.adlice.com\/#\/schema\/person\/a02b30804320a4059d268dc2567a307d\",\"name\":\"tigzy\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"de\",\"@id\":\"https:\/\/www.adlice.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d81e380961b1b69969fa84994ad1e4cba26afe93a49d8dd3148e9c33ffe4ccac?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d81e380961b1b69969fa84994ad1e4cba26afe93a49d8dd3148e9c33ffe4ccac?s=96&d=mm&r=g\",\"caption\":\"tigzy\"},\"description\":\"Founder and owner of Adlice Software, Tigzy started as lead developer on the popular Anti-malware called RogueKiller. Involved in all the Adlice projects as lead developer, Tigzy is also doing research and reverse engineering as well as writing blog posts.\",\"url\":\"https:\/\/www.adlice.com\/de\/author\/tigzy\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Google Chrome: How to Bypass Secure Preferences \u2022 Adlice Software","description":"Google Chrome protects its user secure preferences using a hashing mechanism. Discover how to bypass it, and how it's used by malware.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.adlice.com\/google-chrome-secure-preferences\/","og_locale":"de_DE","og_type":"article","og_title":"Google Chrome: How to Bypass Secure Preferences \u2022 Adlice Software","og_description":"Google Chrome protects its user secure preferences using a hashing mechanism. Discover how to bypass it, and how it's used by malware.","og_url":"https:\/\/www.adlice.com\/google-chrome-secure-preferences\/","og_site_name":"Adlice Software","article_publisher":"https:\/\/www.facebook.com\/RogueKiller","article_published_time":"2016-11-04T14:39:13+00:00","article_modified_time":"2022-12-21T10:36:00+00:00","og_image":[{"width":822,"height":546,"url":"https:\/\/www.adlice.com\/wp-content\/uploads\/2016\/11\/corrupted.png","type":"image\/png"}],"author":"tigzy","twitter_card":"summary_large_image","twitter_creator":"@AdliceSoftware","twitter_site":"@AdliceSoftware","twitter_misc":{"Verfasst von":"tigzy","Gesch\u00e4tzte Lesezeit":"6\u00a0Minuten"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.adlice.com\/google-chrome-secure-preferences\/#article","isPartOf":{"@id":"https:\/\/www.adlice.com\/google-chrome-secure-preferences\/"},"author":{"name":"tigzy","@id":"https:\/\/www.adlice.com\/#\/schema\/person\/a02b30804320a4059d268dc2567a307d"},"headline":"Google Chrome: How to Bypass Secure Preferences","datePublished":"2016-11-04T14:39:13+00:00","dateModified":"2022-12-21T10:36:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.adlice.com\/google-chrome-secure-preferences\/"},"wordCount":800,"commentCount":0,"publisher":{"@id":"https:\/\/www.adlice.com\/#organization"},"image":{"@id":"https:\/\/www.adlice.com\/google-chrome-secure-preferences\/#primaryimage"},"thumbnailUrl":"https:\/\/www.adlice.com\/wp-content\/uploads\/2016\/11\/corrupted.png","keywords":["analysis","chrome","google","hash","hmac","malware","preferences","settings"],"articleSection":["Analysis"],"inLanguage":"de"},{"@type":"WebPage","@id":"https:\/\/www.adlice.com\/google-chrome-secure-preferences\/","url":"https:\/\/www.adlice.com\/google-chrome-secure-preferences\/","name":"Google Chrome: How to Bypass Secure Preferences \u2022 Adlice Software","isPartOf":{"@id":"https:\/\/www.adlice.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.adlice.com\/google-chrome-secure-preferences\/#primaryimage"},"image":{"@id":"https:\/\/www.adlice.com\/google-chrome-secure-preferences\/#primaryimage"},"thumbnailUrl":"https:\/\/www.adlice.com\/wp-content\/uploads\/2016\/11\/corrupted.png","datePublished":"2016-11-04T14:39:13+00:00","dateModified":"2022-12-21T10:36:00+00:00","description":"Google Chrome protects its user secure preferences using a hashing mechanism. Discover how to bypass it, and how it's used by malware.","breadcrumb":{"@id":"https:\/\/www.adlice.com\/google-chrome-secure-preferences\/#breadcrumb"},"inLanguage":"de","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.adlice.com\/google-chrome-secure-preferences\/"]}]},{"@type":"ImageObject","inLanguage":"de","@id":"https:\/\/www.adlice.com\/google-chrome-secure-preferences\/#primaryimage","url":"https:\/\/www.adlice.com\/wp-content\/uploads\/2016\/11\/corrupted.png","contentUrl":"https:\/\/www.adlice.com\/wp-content\/uploads\/2016\/11\/corrupted.png","width":822,"height":546},{"@type":"BreadcrumbList","@id":"https:\/\/www.adlice.com\/google-chrome-secure-preferences\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.adlice.com\/de\/"},{"@type":"ListItem","position":2,"name":"Google Chrome: How to Bypass Secure Preferences"}]},{"@type":"WebSite","@id":"https:\/\/www.adlice.com\/#website","url":"https:\/\/www.adlice.com\/","name":"Adlice Software","description":"Anti-malware and analysis tools","publisher":{"@id":"https:\/\/www.adlice.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.adlice.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"de"},{"@type":"Organization","@id":"https:\/\/www.adlice.com\/#organization","name":"Adlice Software","url":"https:\/\/www.adlice.com\/","logo":{"@type":"ImageObject","inLanguage":"de","@id":"https:\/\/www.adlice.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.adlice.com\/wp-content\/uploads\/2020\/05\/B1rTNpTG_400x40_10.png","contentUrl":"https:\/\/www.adlice.com\/wp-content\/uploads\/2020\/05\/B1rTNpTG_400x40_10.png","width":276,"height":276,"caption":"Adlice Software"},"image":{"@id":"https:\/\/www.adlice.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/RogueKiller","https:\/\/x.com\/AdliceSoftware","https:\/\/fr.linkedin.com\/company\/adlice-software","https:\/\/www.youtube.com\/channel\/UC4CQ-gIZMGWxl-auf0QqYhQ"]},{"@type":"Person","@id":"https:\/\/www.adlice.com\/#\/schema\/person\/a02b30804320a4059d268dc2567a307d","name":"tigzy","image":{"@type":"ImageObject","inLanguage":"de","@id":"https:\/\/www.adlice.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/d81e380961b1b69969fa84994ad1e4cba26afe93a49d8dd3148e9c33ffe4ccac?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d81e380961b1b69969fa84994ad1e4cba26afe93a49d8dd3148e9c33ffe4ccac?s=96&d=mm&r=g","caption":"tigzy"},"description":"Founder and owner of Adlice Software, Tigzy started as lead developer on the popular Anti-malware called RogueKiller. Involved in all the Adlice projects as lead developer, Tigzy is also doing research and reverse engineering as well as writing blog posts.","url":"https:\/\/www.adlice.com\/de\/author\/tigzy\/"}]}},"_links":{"self":[{"href":"https:\/\/www.adlice.com\/de\/wp-json\/wp\/v2\/posts\/605","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.adlice.com\/de\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.adlice.com\/de\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.adlice.com\/de\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.adlice.com\/de\/wp-json\/wp\/v2\/comments?post=605"}],"version-history":[{"count":0,"href":"https:\/\/www.adlice.com\/de\/wp-json\/wp\/v2\/posts\/605\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.adlice.com\/de\/wp-json\/wp\/v2\/media\/606"}],"wp:attachment":[{"href":"https:\/\/www.adlice.com\/de\/wp-json\/wp\/v2\/media?parent=605"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.adlice.com\/de\/wp-json\/wp\/v2\/categories?post=605"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.adlice.com\/de\/wp-json\/wp\/v2\/tags?post=605"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}