Closed Bug 1049533 Opened 10 years ago Closed 10 years ago

Extension block request: FinFisher add-on

Categories

(Toolkit :: Blocklist Policy Requests, defect)

Product:
Toolkit
Component:
Blocklist Policy Requests
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED
Milestone:
2014-08

People

(Reporter: ttaubert, Assigned: jorgev)

References

(Blocks 1 open bug,
URL
)

Details

(Whiteboard: [extension][qa-]) 

Extension name: Java_Plugin
Extension UUID: ec8030f7-c20a-464f-9b0e-13a3a9e97384
Extension versions to block: All
Applications, versions, and platforms affected: All?
Block severity: hard

Homepage, AMO listing, other references and contact info: 

Not listed on AMO.

Reasons:

FinFisher builds trojan horses that take over computers. I inspected the XPI of their extension that fakes a Java plugin. We should block it although it won't help much if they change it in the future. We might at least prevent some attacks with older versions.
The same extension ID is used for a "Realplayer_Plugin" extension that fakes another plugin.
Also used for another fake "Flash_Plugin" extension.
FWIW some install.rdf files list the UUID {92650c4d-4b8e-4d2a-b7eb-24ecf4f6b63a} for SeaMonkey.
ID: {ec8030f7-c20a-464f-9b0e-13a3a9e97384}
Assignee: nobody → jorge
Whiteboard: [extension] → [extension][qa-]
Target Milestone: --- → 2014-08
(In reply to Jorge Villalobos [:jorgev] from comment #4)
> ID: {ec8030f7-c20a-464f-9b0e-13a3a9e97384}

No, the add-on ID in the XPI is firefox-extension@mozilla.org

{ec8030f7-c20a-464f-9b0e-13a3a9e97384} is just the application ID.
Summary: Extension block request: ec8030f7-c20a-464f-9b0e-13a3a9e97384 → Extension block request: FinFisher add-on
Blocked: https://addons.mozilla.org/en-US/firefox/blocked/i688

This unintentionally uncovered some probably malicious add-ons that use the ID {ec8030f7-c20a-464f-9b0e-13a3a9e97384}. Kris, please file a separate bug for it.
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
That ID has been blocked since 2012. https://addons.mozilla.org/blocked/i115
Product: addons.mozilla.org → Toolkit
You need to log in before you can comment on or make changes to this bug.