Closed
Bug 755443
Opened 12 years ago
Closed 12 years ago
Malicious "Lastest Flash PLayer" add-on
Categories
(Toolkit :: Blocklist Policy Requests, defect)
Toolkit
Blocklist Policy Requests
Tracking
()
RESOLVED
FIXED
People
(Reporter: mhammell, Assigned: jorgev)
Details
Attachments
(1 file)
210.73 KB,
application/octet-stream
|
Details |
User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_3) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5 Steps to reproduce: Downloaded play.xpi from a third-party website. Actual results: Loads overlay.js from the add-on which loads http://mio98/.hk/j.php which loads http://mio98/.hk/js_f.php Overlay.js highlights: packed JS stores its config via the Components.interfaces.nsIPrefService uses a custom encoding/crypt function to obfuscate the C2 URL generates a random GUID to uniquely ID victims j.php highlights: needs to be called with query params ?u=<guid>&v=0.04&r=<random_num> injects a <script> tag to load http://mio98.hk/js_f.php?v=0.04 js_f.php highlights: packed JS steals tokens/cookies for FB session supports captcha solving sets cookies "fb_bbip_*", px_<uid>, "fb_oo1_*" can use our links, photos, and events apps to post spam injects ads via an iframe (all hosted on iwanktube.com) steals Yahoo login creds Expected results: It should not steal your cookies/tokens for your Facebook session and then post as you, without your consent.
Assignee | ||
Comment 1•12 years ago
|
||
Id: play5@vide04flash.com
Assignee: nobody → jorge
Status: UNCONFIRMED → ASSIGNED
Ever confirmed: true
Assignee | ||
Comment 2•12 years ago
|
||
Blocked: https://addons.mozilla.org/en-US/firefox/blocked/i92
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Updated•8 years ago
|
Product: addons.mozilla.org → Toolkit
You need to log in
before you can comment on or make changes to this bug.
Description
•