Closed
Bug 759164
Opened 12 years ago
Closed 12 years ago
Malicious "FlashPlayer" add-on
Categories
(Toolkit :: Blocklist Policy Requests, defect)
Toolkit
Blocklist Policy Requests
Tracking
()
RESOLVED
FIXED
People
(Reporter: mhammell, Assigned: jorgev)
Details
Attachments
(1 file)
16.12 KB,
application/octet-stream
|
Details |
User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_3) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.52 Safari/536.5 Steps to reproduce: Downloaded extension from http://viku12.co.cc/x/play.php?id=1 Actual results: After install, the plugin injects packed JS to inject http://miko92.asia/j.php (Javascript) j.php: injects http://uhnm76.me/js_f.php js_f.php (packed JS): injects an iframe pointing to http://www.resultsz.com/search/anticheat6.php?username=mc0011 steals the Facebook user's session tokens sets cookies px_<UID> and fb_bbip_* to maintain state can like an arbitrary set of Facebook pages (currently not set to like any) posts a link to http://bit[.]ly/MTfe4S as a status update by the victim with the text "Kirst*en. Dunst mastur*bating on hidden camera" will solve captchas by posting the captcha image to http://mp56a.com/fn/cs/api/s_c.php?u posts a link to http://tol[.]co/5q, with the text "LOL Miley Cyrus got caught having s3x" Expected results: It should not steal your Facebook session information and post to Facebook as you, without your consent.
Assignee | ||
Comment 1•12 years ago
|
||
Id: support3_en@adobe122.com
Assignee: nobody → jorge
Status: UNCONFIRMED → ASSIGNED
Ever confirmed: true
Assignee | ||
Comment 2•12 years ago
|
||
Blocked: https://addons.mozilla.org/en-US/firefox/blocked/i97
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Updated•8 years ago
|
Product: addons.mozilla.org → Toolkit
You need to log in
before you can comment on or make changes to this bug.
Description
•