[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Starting analysis...

Proctor360

Version 5.1 View in Chrome Web Store

Last scanned: about 1 month ago | force re-scan

Extension Details

Developer: https://proctor360.com/

Rating: 3.4 ★ (14 ratings)

Users: 50,000

Context-Aware Verdict

CRITICAL

Overall Risk

Trust Factors:

Proctor360 appears to be a legitimate proctoring service with 50,000 users, suggesting some level of market acceptance. However, the relatively low rating of 3.4 stars from only 14 reviews raises concerns about user satisfaction. The company has an established website, which adds some credibility, but the limited review data makes it difficult to assess overall user experience and reliability.

Concerns:

The extension's permission set is extremely invasive and concerning for a proctoring tool. The combination of tabs, webRequest, webNavigation, and management permissions creates a powerful surveillance toolkit that extends far beyond typical exam monitoring needs. The broad host permissions and content script injection capabilities mean this extension can monitor, intercept, and modify all web traffic across every website you visit. The management permission is particularly alarming as it allows control over other extensions, which could disable security tools. The system.display permission suggests screen monitoring capabilities, which while expected for proctoring, adds another layer of privacy invasion.

Recommendations:

Given the critical risk level, only install this extension if absolutely required for academic or professional obligations. Create a dedicated Chrome profile exclusively for proctored activities and remove the extension immediately after use. Never use this profile for personal browsing, banking, or accessing sensitive information. Consider using a separate computer or virtual machine if possible. Verify the extension is genuinely required by your institution and not a malicious imposter.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: management

This extension has the management permission. Can manage other extensions. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webNavigation

This extension has the webNavigation permission. Can track your web navigation. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequest

This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

tabs
system.display
scripting
webRequest
activeTab
webNavigation
storage
management

Host Permissions:

http://*/*
https://*/*
<all_urls>

Embedded URLs (324 total):

https://prod1studentapi.proctor360.com/api	https://prod1studentapi.proctor360.com/api/exam-pass
https://proctor360.com/extension-uninstall	https://prod1student.proctor360.com/#/exam
https://prod1student.proctor360.com/#/exam/completed	https://proctor360.s3.us-east-1.amazonaws.com/general/Icon1.png
https://sbprod1student.proctor360.com/#/iframe-new/0JoBVLhDjGauzTuXbjsd	https://prod1student.proctor360.com
https://prod1.proctor360.com/#/exam	https://prod1student.proctor360.com/#/exam/early
https://prod1student.proctor360.com/128.png	https://pbs.twimg.com/profile_images/1322124113410957312/FEtybUCG_400x400.png
https://clients2.google.com/service/update2/crx	https://secure.travis-ci.org/beatgammit/base64-js.png
http://travis-ci.org/beatgammit/base64-js	https://ci.testling.com/beatgammit/base64-js.png
https://ci.testling.com/beatgammit/base64-js	https://npmjs.org
http://bluebirdjs.com/docs/changelog.html	http://goo.gl/MqrFmX
http://goo.gl/rRqMUw	https://github.com/petkaantonov/bluebird
http://github.com/petkaantonov/bluebird/issues	http://github.com/petkaantonov/
http://promisesaplus.com/	http://promisesaplus.com/assets/logo-small.png
https://travis-ci.org/petkaantonov/bluebird.svg?branch=master	https://travis-ci.org/petkaantonov/bluebird
https://img.shields.io/badge/coverage-98%25-brightgreen.svg?style=flat	http://petkaantonov.github.io/bluebird/coverage/debug/index.html
http://stackoverflow.com/questions/tagged/bluebird	https://groups.google.com/forum/#
https://webchat.freenode.net/?channels=#promises	http://bluebirdjs.com/docs/getting-started.html
http://bluebirdjs.com/docs/api-reference.html	https://github.com/petkaantonov/bluebird/tree/2.x
https://github.com/petkaantonov/bluebird/issues	https://img.shields.io/npm/v/exeq.svg?style=flat
https://npmjs.org/package/exeq	https://img.shields.io/travis/afc163/exeq.svg?style=flat
https://travis-ci.org/afc163/exeq	https://img.shields.io/david/afc163/exeq.svg?style=flat
https://david-dm.org/afc163/exeq	http://img.shields.io/npm/dm/exeq.svg?style=flat
http://ecma-international.org/ecma-262/6.0/#sec-samevaluezero	https://en.wikipedia.org/wiki/Symmetric_difference
https://en.wikipedia.org/wiki/Fisher-Yates_shuffle	http://peter.michaux.ca/articles/lazy-function-definition-pattern
http://drupalmotion.com/article/debounce-and-throttle-visual-explanation	http://ecma-international.org/ecma-262/6.0/#sec-properties-of-the-map-prototype-object
https://developer.mozilla.org/Web/JavaScript/Reference/Functions/rest_parameters	https://es5.github.io/#x15.3.4.3
https://developer.mozilla.org/Web/JavaScript/Reference/Operators/Spread_operator	https://lodash.com/
http://dojofoundation.org/	http://underscorejs.org/LICENSE
https://lodash.com/license	http://ecma-international.org/ecma-262/6.0/#sec-patterns
http://ecma-international.org/ecma-262/6.0/#sec-escaperegexppattern	https://en.wikipedia.org/wiki/Combining_Diacritical_Marks
http://ecma-international.org/ecma-262/6.0/#sec-template-literal-lexical-components	https://github.com/jashkenas/underscore/issues/1621
https://github.com/jashkenas/underscore/pull/1247	https://code.google.com/p/v8/issues/detail?id=90
https://es5.github.io/#x11.1.5	http://ecma-international.org/ecma-262/6.0/#sec-object.prototype.tostring
http://ecma-international.org/ecma-262/6.0/#sec-number.max_safe_integer	https://es5.github.io/#JO.
http://ecma-international.org/ecma-262/6.0/#sec-ecmascript-function-objects-call-thisargument-argumentslist	https://es5.github.io/#x13.2.2
https://es5.github.io/#x15.10.6.4	https://bugs.webkit.org/show_bug.cgi?id=142792
http://ecma-international.org/ecma-262/6.0/#sec-tolength	https://code.google.com/p/v8/issues/detail?id=2070
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Functions/rest_parameters	https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/Spread_operator
http://www.w3.org/TR/html5/infrastructure.html#internal-structured-cloning-algorithm	http://ecma-international.org/ecma-262/6.0/#sec-number.isfinite
https://es5.github.io/#x8	https://code.google.com/p/v8/issues/detail?id=2291

Page 1 of 5

Raw Manifest

{
  "name": "Proctor360",
  "icons": {
    "32": "/assets/img/lock_32.png",
    "64": "/assets/img/lock_64.png",
    "128": "/assets/img/lock_128.png"
  },
  "action": {
    "default_icon": {
      "32": "/assets/img/lock_32.png",
      "64": "/assets/img/lock_64.png",
      "128": "/assets/img/lock_128.png"
    }
  },
  "version": "5.1",
  "background": {
    "service_worker": "background.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Secure Testing Anywhere",
  "permissions": [
    "tabs",
    "system.display",
    "scripting",
    "webRequest",
    "activeTab",
    "webNavigation",
    "storage",
    "management"
  ],
  "content_scripts": [
    {
      "js": [
        "content.js"
      ],
      "matches": [
        "http://*/*",
        "https://*/*",
        "<all_urls>"
      ]
    }
  ],
  "host_permissions": [
    "http://*/*",
    "https://*/*",
    "<all_urls>"
  ],
  "manifest_version": 3
}

by ✦ Astarte

Proctor360

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Embedded URLs (324 total):

Raw Manifest

Detections

Manifest Findings