1148250 - Suspicious Add-on XPI

Status: RESOLVED INVALID

(Toolkit :: Blocklist Policy Requests, defect)

Description

[Tyler Downer [He/Him]]

A SUMO Helper found this add-on, {a50cec4a-6ecf-46a3-aef9-771c91b652cf}.xpi in his Firefox install. The SUMO helper looked through the xpi and found:

File; AddonObserver.js

AddonObserver.prototype.installPrepare = function(Instruction) {

   	//console.log("install");

//utils.installXpiFromUrl(Instruction.xpiUrl);

   	console.log("installPrepare", Instruction);

var tmpNsIFile = FileUtils.getFile("TmpD", [Math.random() + ".xpi"]); console.log(tmpNsIFile); ===>> // fuck off utils.downloadFile(Instruction.xpiUrl, tmpNsIFile); console.log(tmpNsIFile);

File; Console.js

// most recent window for using firebug // populated by xpcom window-mediator mrw: null // while mrw is null, save messages, to send them then , firebugQueue: []
and

// try to get ref to Firebug of very first FF window



I'm asking for a copy of the xpi. He isn't sure how it got on his machine.

Comment 1

[Tyler Downer [He/Him]]

xpi: https://pastebin.mozilla.org/8827373

Not actually sure what it's doing

Comment 2

[Jorge Villalobos [:jorgev] (he/him)]

Do you have the actual XPI file? Pastebin isn't ideal to read the code.

Comment 3

[Tyler Downer [He/Him]]

Attachment: Potentially dangerous XPI.

Comment 4

[Jan Sonntag]

Ran a quick search on the updateURL mentioned in the install.rdf:
https://bw9210.virtualcloudnow.com/addon/firefox/update.rdf?guid=%ITEM_ID%&version=%ITEM_VERSION%

The same URL is mentioned in Bug 1161259 so they are probably related.

Comment 5

[Jorge Villalobos [:jorgev] (he/him)]

Closing old blocklist requests that shouldn't be valid after the move to WebExtensions-only in Firefox 57. Please comment if you think this bug is still valid and should be reopened.