Earth Search for Chrome: Search Hijacking and Silent Tracking

Overview

Earth Search for Chrome (extension ID: gamkifgdajnpkdjfnpplogdpjcjbhaif) is a Chrome extension with roughly 60,000 users. The extension hijacks the user's default search engine to earthsearchforchrome.com and silently tracks install and uninstall events by sending a unique random ID, action, extension version, and user agent to its own server. This behavior goes beyond what the name suggests and is not explicitly disclosed in the extension's interface; users do not get a clear choice to opt out of the search change or the tracking.

How it works

The extension's manifest.json (lines 27-35) contains a chrome_settings_overrides entry that sets earthsearchforchrome.com as the default search provider with "is_default": true. The sandbox dynamic analysis confirmed that the search provider is applied to the browser, overriding any existing setting.

In background.js (lines 22-28), on installation or update, the extension sends a POST request to https://earthsearchforchrome.com/auto-suggest/track.php with a JSON body containing trackingData. The exact fields are not fully enumerated in the source, but the evidence indicates it includes a unique random ID, an action (e.g., "install" or "update"), the extension version, and the user agent.

Additionally, background.js (lines 51-52) constructs an uninstall URL pointing to https://earthsearchforchrome.com/auto-suggest/uninstall.php with query parameters, and calls chrome.runtime.setUninstallURL(uninstallUrl). This ensures that even when the user removes the extension, the same tracking data is sent back to the server, allowing the operator to monitor uninstall events.

Payload

The primary payload is search hijacking: all searches from the omnibox are redirected to earthsearchforchrome.com, which likely monetizes the traffic through ads or affiliate links. The tracking component adds persistent surveillance across the extension's lifecycle, giving the operator a unique identifier that can correlate installs, updates, and uninstalls.

Store status

At the time of analysis, the extension remains available on the Chrome Web Store. The MalExt report classifies it as "Search Hijacking" with a malicious verdict. Users who have installed this extension should remove it immediately and reset their default search engine in Chrome settings. Additionally, the unique ID and user agent may have been collected; while not directly sensitive, it could be linked with other data by the operator. No credential theft or session hijacking was observed in the sandbox, but the search redirects could expose users to malicious content on the third-party search page.

Note: The remote search provider's behavior (e.g., whether it redirects to other search engines or displays malicious ads) was not inspected due to the absence of live network requests in the sandbox; however, the code clearly performs the tracking fetch and search override.