779014 - Blocklist malicious "Adobe Flash Player 12.4.0" extension

Status: RESOLVED FIXED

(Toolkit :: Blocklist Policy Requests, defect)

Description

[Jorge Villalobos [:jorgev] (he/him)]

I've received multiple reports about this add-on. It is distributed at http://www.peliculas-flv.com/ (currently down), and it tries to pass as a Flash Player installer. This add-on is using obfuscated remote scripts to conduct DDOS attacks against other video sites.

The add-on id is {ec8030f7-c20a-464f-9b0e-13a3a9e97384}, which is the same ID as Firefox. I don't think this should be a problem, but I need QA to make sure.

Comment 1

[Jorge Villalobos [:jorgev] (he/him)]

The add-on is blocked on staging: https://addons-dev.allizom.org/en-US/firefox/blocked/i113

QA, please verify that the block works correctly once I post the XPI file.

Comment 2

[MendlerPB]

Attachment: Contenido del XPI comprimido

Comment 3

[Jorge Villalobos [:jorgev] (he/him)]

Attachment: XPI file to block

I'm blocking this ID for all versions because people shouldn't be using the Firefox ID for their add-ons anyway.

Comment 4

[Jorge Villalobos [:jorgev] (he/him)]

We tested the staged block ourselves and it appears to be working correctly.

The block is now live in prod: https://addons.mozilla.org/en-US/firefox/blocked/i115

Comment 5

[MendlerPB]

No me queda nada más que decir que muchas gracias a todo equipo de Mozilla por habernos escuchado y tomado en cuenta nuestras quejas. A seguir usando el mejor navegador de todo y el más seguro.

Comment 6

[Francesco Lodolo [:flod]]

I think that this block is going to stop a lot of "messed-up" add-ons (I've just found another one that uses the same ID of Firefox as the add-on id).

Comment 7

[juan becerra [:juanb]]

I've verified this in production. I've tested this by installing the XPI attached in this bug, installing the Timer Fire 1.6 extension, restarting, and firing the blocklist timer. When I fire the timer I get a dialog prompting me to restart Firefox indicating it has blocked the extension in question. When I restart it is disabled.

Comment 8

[brichter]

Hey guys, you also blocked the valid Adobe Flash plugin needed for virtually every website that carries video content... Who tests this stuff anyway?

We all know Adobe hasn't released Flash 12.4 yet, the version you're blocking isn't limited to 12.4... You're also blocking the legit version 11.3., and I'm on a Mac, not a Winblows box.

Comment 9

[Jorge Villalobos [:jorgev] (he/him)]

No, we didn't block the Flash plugin with this block. This a malicious extension that uses the Adobe Flash name, but uses an id that has nothing to do with Adobe.

I recommend that you go to our support site for help with this: http://support.mozilla.com/

Comment 10

[ganesha.rajanaidu]

I have just switched back to Firefox (from Chrome) and I believe think this blacklist has just blocked a legitimate add-on which I actively use for http://www.monsterdivx.com/

Please investigate.

Comment 11

[ganesha.rajanaidu]

Please re-open ticket.

Comment 12

[Jorge Villalobos [:jorgev] (he/him)]

I don't know if the add-on distributed on that website is the same being blocked here. However, as noted in comment #0, the id corresponds to the Firefox application id, which is wrong for any add-on to use. You can contact the owners of that website and let them know that they need to use a different id for their add-on.