Is SSHGate ssh client and terminal emulator safe?
SSHGate sends a persistent ID to RedCoolMedia on every new tab and can redirect the active tab to its site.
On each new tab, the extension's service worker sends a randomly generated, stored identifier to stream.redcoolmedia.net, which also sees the user's IP address. If the server's reply contains '302', the extension navigates the active tab to www.redcoolmedia.net. The extension requests only the storage permission.
Strong link to a flagged operator: 9 of the 15 other listings from the same operator are rated high or critical for malicious behaviour. Flagged: OfficeWork (high), MovieStudio (high), PhotoStudio (high).
Who publishes itRedcoolMedia - 15 other listings from the same operator, 11 of them carrying a finding
RedcoolMedia - 15 other listings from the same operator, 11 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
15 other listings published from this account, 446k+ users between them. 11 of them carry a finding.
Shared hosts - 2 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
A server reply of 302 can send your active tab to redcoolmedia.net on new tabs
Code analysis shows a new tab triggers a check to the vendor's server; if the reply contains "302", the active tab is navigated to a redcoolmedia.net page.
Whether it fires depends on the live reply.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-940
- Source
- Dynamic sandbox
You open a new browser tab.
No click on the extension is needed.
The extension asks redcoolmedia.net for a status reply and may navigate your active tab to its page.
Navigation happens only if the reply text contains "302".
Reply check and tab navigation in web.js
Every new tab runs the check
web.js// On tab creation, run the registration checkchrome.tabs.onCreated.addListener(() => checkregruser());Redirect when reply contains 302
web.jsconst reply = await fetch(STATUS_URL + '?hex=1&u=' + userId);if (reply.status === 200) { const text = await reply.text(); if (text.includes('302')) { // getCurrent() has no tab in a service worker, so the id is undefined // and tabs.update targets the active tab of the current window chrome.tabs.update(chrome.tabs.getCurrent().id, { url: 'https://www.redcoolmedia.net/api/app-sshgate.php?u=' + userId }); }}- Extension user IDk3m9x0qz1a
A random 10-character ID kept in extension storage and sent on every check.
- Query flaghex=1
A fixed flag sent with the ID in the request.
- Redirect targethttps://www.redcoolmedia.net/api/app-sshgate.php?u=k3m9x0qz1a
Fixed address in the code; the server only decides whether it opens.
- stream.redcoolmedia.net
Receives the status request; its reply decides whether the tab is redirected.
- www.redcoolmedia.net
Page the active tab is sent to when the reply contains 302.
The redirect target is fixed in the code. Whether any tab is redirected depends on the live server reply, which was not observed.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
What it can do
Permissions this extension asks for, as declared in version 1.4.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Store data in your browser
storage
Where it sends data
Destinations our analysis observed SSHGate ssh client and terminal emulator contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.redcoolmedia.net
SSHGate ssh client and terminal emulator sends data to www.redcoolmedia.net. 16 other extensions we have analysed send data here.
- stream.redcoolmedia.net
SSHGate ssh client and terminal emulator sends data to stream.redcoolmedia.net. 10 other extensions we have analysed send data here.