863387 - Blocklist Default Tab add-on

Status: VERIFIED FIXED

(Toolkit :: Blocklist Policy Requests, defect)

Description

[Kris Maglione [:kmag]]

+++ This bug was initially created as a clone of Bug #863385 +++

Adds a new search box to the end of the tab bar (fortunately does not hide the builtin one in the process), changes the new tab page to a crappy search page.

The first time I uninstall it and then restart, it's back, but without the Remove button. I can then disable it. I suppose that means they're installing it once globally and once in the profile.

It also does not restore autoDisableScopes after being installed. In fact, the default value remains set at 0, seemingly because the following have been added to my profile's defaults/preferences/prefs.js file:

pref("extensions.autoDisableScopes", 0);
defaultPref("extensions.autoDisableScopes", 0);
lockPref("extensions.autoDisableScopes", 0);

ID: [e-mail]

Comment 1

[Kris Maglione [:kmag]]

Also, this ID has an AMO listing: https://addons.mozilla.org/addon/default-tab-recovery/

Comment 2

[Kris Maglione [:kmag]]

Sorry, it looks like it was a PC Backup installer deceptively linked from the top left of that page that I installed, rather than Fun4IM.

Comment 3

[Jorge Villalobos [:jorgev] (he/him)]

(In reply to Kris Maglione [:kmag] from comment #1)
> Also, this ID has an AMO listing:
> https://addons.mozilla.org/addon/default-tab-recovery/

Mike, IIRC, you were the one who asked us to keep that AMO listing. Can you let us know if that ID still has any valid use, or if it is safe to block?

Comment 4

[Steve Wise]

Jorge - This is Steve Wise Search Results, the Default Tab addon is ours. We are not making any changes to the scopes during install as Chris mentions above, and on uninstall we are completely removed.  Let me know how we can resolve the issue.

Thanks,
Steve

Comment 5

[Steve Wise]

Also, the http://fun4im.software.informer.com/ is not associated with the Default Tab product.

Comment 6

[Mike Kaply [:mkaply]]

so looking at bug 863385, I'm unclear as to which behaviors you attribute to that obviously malicious addon versus default tab. 

did default tab have the uninstall problem or did the other add-on have the problem? 

I'm trying to figure out what specific behavior would cause Default Tab to be block listed.

Comment 7

[Mike Kaply [:mkaply]]

OK, I've looked into the installer Default Tab is using. It does not modify any Firefox preference files and it doesn't add anything to the Windows registry.

Comment 8

[Jorge Villalobos [:jorgev] (he/him)]

Kris, can you locate the installer that is silently dropping Default Tab in the profile?

Comment 9

[Steve Wise]

We are building a new installer and will have it in production in the next day or so to resolve the issue. I will follow up when it is done.

Comment 10

[Kris Maglione [:kmag]]

I can't. The original installer that I found apparently came from an ad which is not there anymore.

mkaply, do you know where this is normally distributed?

Comment 11

[Mike Kaply [:mkaply]]

It's distributing via things like w3i or other third party installers.

Comment 12

[Kris Maglione [:kmag]]

Do you know of any specific installers I can download to test?

Comment 13

[Kris Maglione [:kmag]]

The installer they sent me does not have any of the above issues. Assuming that the other installers are likewise fixed, we should only block older versions of the add-on.

Comment 14

[Jorge Villalobos [:jorgev] (he/him)]

Which version does the new installer include?

Comment 15

[Kris Maglione [:kmag]]

2.0, but I'm not sure what version the old installer included.

Comment 16

[Mike Kaply [:mkaply]]

The old installer could have been anything from 1.4.4 and down.

We went to 2.0 to make it easy to distinguish the new from the old.

Comment 17

[Jorge Villalobos [:jorgev] (he/him)]

Versions 0 - 1.4.4 have been blocked.

https://addons.mozilla.org/en-US/firefox/blocked/i362

Comment 18

[formerly wakaflocka]

they have reacted with a 2.0 version of this addon.
THIS IS NOT FIXED
https://support.mozilla.org/en-US/questions/956466

Comment 19

[Mike Kaply [:mkaply]]

kdurant,

I don't think you understand what happened here. The issue was not with the functionality of the add-on, it was with the install method.

The company that makes Default Tab has modified their install method so that version 2.0 installs the correct way.

So any version under 2.0 has been blacklisted, but versions above have not been because they do the right thing.

As far as this support.mozilla.org issue goes, if the add-on was installed, it would have been via a third party installer which was opted in as part of an install.

Comment 20

[formerly wakaflocka]

OH that is alright.

Comment 21

[Victor Carciu]

Verified as fixed . Older versions are blocklisted.