Feb 28, 2011 08:35 GMT  ·  By

Zscaler, a provider of cloud security services, has released a free Firefox extension that aims to protect users from fake online stores, a category of malicious websites that isn't covered by most blacklists.

Called Zscaler Safe Shopping, the extension is still going through the approval process on the official Mozilla Add-ons Repository, but it can also be installed directly from Zscaler's website.

Most Web attacks are launched from compromised legit websites which are injected with unauthorized code that loads malicious content from third party servers.

Zscaler's researchers explain that most blacklists currently used by browsers, such as Google Safe Browsing or Phishtank, block these third party sites from where malicious content is served.

However, they often miss cases where the rogue content is hosted on the compromised website itself.

For example, attackers can compromise an e-commerce site and add additional form fields to gather sensitive data from shoppers.

In other cases attackers can create fake stores on compromised servers and host them under the corresponding domain names.

"Recently, we highlighted the number of high profile, legitimate sites, that have been hijacked to lead to fake online stores.

"These stores offer up software downloads at highly discounted prices. The downloads are not blocked as malware by Google Safe Browsing, or as phishing sites by Phishtank," writes Julien Sobrier, senior security researcher at Zscaler.

The vendor tries to tackle this problem with the Zscaler Safe Shopping extension which downloads an updated list of known fake stores. The company takes different factors into account when checking websites for signs of compromise.

The data is stored on its cloud servers in order to prevent malicious individuals from attacking the vulnerable websites, the downloaded list only contains hashes, not actual URLs.

This extension comes to complement the company's Search Engine Security (SES) add-on which protects users from black hat SEO sites.

The Zscaler Safe Shopping Firefox extension can be downloaded from here.