755635 - Malicious "Zaman Tuneli Kadir!" add-on

Status: RESOLVED FIXED

(Toolkit :: Blocklist Policy Requests, defect)

Description

[MarkH]

Attachment: 20120515_zaman.zip (password 'infected')

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_3) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.46 Safari/536.5

Steps to reproduce:

Downloaded add-on from http://zamantunelinikaldir.com/


Actual results:

Add-on injects http(s)://www.zamantunelinikaldir.com/timelineremove.js which, provided your referrer is set to Facebook, injects an iframe loading  http://www.zamantunelinikaldir/.com/onFrame.html

After the iframe loads, the user's Facebook session tokens are stolen and posted to the page loaded in the iframe.  Those stolen tokens are then used to spam Facebook.


Expected results:

It should not steal your session tokens and post them to a 3rd party server.

Comment 1

[Jorge Villalobos [:jorgev] (he/him)]

Id: {68b8676b-99a5-46d1-b390-22411d8bcd61}

Comment 2

[Jorge Villalobos [:jorgev] (he/him)]

Blocked: https://addons.mozilla.org/en-US/firefox/blocked/i93