1170047 - istartsurf crapware ignores the homepage change and addon installation barriers

Status: RESOLVED WONTFIX

(Toolkit :: Blocklist Policy Requests, defect)

Description

[Martin Pecka]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Firefox/38.0
Build ID: 20150513174244

Steps to reproduce:

Installed Burn4Free from http://www.burn4free.com/download-dvd-burning-software.htm . 

DO NOT DO IT ON YOUR REAL SYSTEM, TRY IT INSIDE A VM INSTEAD.


Actual results:

It installed a crapware named istartsurf, which sets the homepage, the default search engine, and it also installs 2 addons (and it installs lots of non-Firefox stuff).

I haven't seen these warnings that should be shown when a 3rd-party app installs an addon or changes the homepage.


Expected results:

I'm not sure if it is even possible to protect FF against this stuff (meaning to show the warnings that should have been shown), since it is installer-crapware, so it runs with admin privileges.

Comment 1

[Jorge Villalobos [:jorgev] (he/him)]

This should be fixed once we enforce signing in Firefox, which is coming soon: https://wiki.mozilla.org/Addons/Extension_Signing. Since there isn't enough actionable info in this bug (without having to install malware in a VM and figuring out what's installed), I'm closing it.