Last year, Bojan wrote a short diary about how data exfiltration could use Google Chrome extension syncing. The advantage of such a scheme would be pretty obvious: Google Chrome is “normal” software, and traffic to the Chrome Web Store is also expected. The use of Chrome’s cloud infrastructure makes detection of such an exfiltration very difficult.
Article Link: InfoSec Handlers Diary Blog - SANS Internet Storm Center