1262787 - OS X startup crash in mmhk@0xd8e5 in Firefox 46 (with Premier Opinion malware)

Status: RESOLVED WONTFIX

(Core :: General, defect)

Description

[[:philipp]]

[Tracking Requested - why for this release]:
tracking to get it on the radar of release management & to keep an eye on its numbers. not sure if something can be done about it from our side though.

This bug was filed from the Socorro interface and is 
report bp-4a95e576-519f-4049-913b-ff1052160407.
=============================================================
Crashing Thread (0)
Frame 	Module 	Signature 	Source
Ø 0 	mmhk 	mmhk@0xd8e5 	
Ø 1 	mmhk 	mmhk@0xdf48 	
Ø 2 	mmhk 	mmhk@0xa422 	
3 		@0x7fff63b3bf8a 	
4 		@0x7fff63b3c103 	
5 		@0x7fff63b3873c 	
6 		@0x7fff63b385c2 	
7 		@0x7fff63b38832 	
8 		@0x7fff63b2deaf 	
9 		@0x7fff63b35187 	
Ø 10 	libdyld.dylib 	libdyld.dylib@0x279b 	
11 		@0x1248fcce9 	
12 		@0x1248fcc25 	
13 		@0x1248fc9a2 	
Ø 14 	CoreFoundation 	CoreFoundation@0xb4bc3 	
Ø 15 	CoreFoundation 	CoreFoundation@0xb4852 	
Ø 16 	CoreFoundation 	CoreFoundation@0x132e69 	
Ø 17 	CoreFoundation 	CoreFoundation@0x6fcd0 	
Ø 18 	CoreFoundation 	CoreFoundation@0x6f337 	
Ø 19 	HIToolbox 	HIToolbox@0x30934 	
Ø 20 	HIToolbox 	HIToolbox@0x3076e 	
Ø 21 	HIToolbox 	HIToolbox@0x305ae 	
Ø 22 	AppKit 	AppKit@0x8a0ed 	
Ø 23 	AppKit 	AppKit@0x456942 	
Ø 24 	CoreFoundation 	CoreFoundation@0xf723 	
Ø 25 	CoreFoundation 	CoreFoundation@0x6dc0 	
Ø 26 	CoreFoundation 	CoreFoundation@0x633a9 	
Ø 27 	CoreFoundation 	CoreFoundation@0x777e1 	
Ø 28 	AppKit 	AppKit@0x89ae3 	
Ø 29 	AppKit 	AppKit@0x4583a5 	
Ø 30 	AppKit 	AppKit@0x45837b 	
Ø 31 	AppKit 	AppKit@0x458392 	
Ø 32 	AppKit 	AppKit@0x14e9d2

the startup crash on os x installations is spiking in 46 beta builds (except beta 7 curiously), just looking at os x crashes this is the #4 signature with 4.2% of all crashes. 
the 'mmhk' module name seems to be often associated with Premier Opinion pup/malware, so i'm unsure if this report is even actionable...

Comment 1

[Liz Henry (:lizzard) (relman/hg->git project)]

This only shows up on beta. Odd. I wonder why we wouldn't see it on release.

Comment 2

[[:philipp]]

dev-edition has a handful of those crashes as well starting with 46.0a2 & 47. so likely a particular code change in 46 made that third-party greyware misbehave now. since software of that unwanted sort is probably even more widespread across users on release it will become interesting to see how the numbers develop once 46 goes to a general audience.

Comment 3

[Benjamin Smedberg]

We don't currently have a DLL blocklist for mac, so unless this is distributed via a Firefox extension there is nothing we can do short-term for this.

Comment 4

[[:philipp]]

unfortunately that 'mmhk' module doesn't seem to be loaded trough an extension.

Comment 5

[Liz Henry (:lizzard) (relman/hg->git project)]

OK, this doesn't sound actionable for 46 then. Marking as wontfix but leaving the bug open in case we can figure out what change (in 46) may have made us suddenly vulnerable to this crash.   Philipp was there a specific date in 46 aurora that the crash started happening?

Comment 6

[[:philipp]]

there have been 12 crashes spread over the whole 46.0a2 cycle, the first one with build 20160203004041 which was pretty close to start of the cycle.
so i suspect the change triggering this, was introduced regularly during the 46 nightly cycle and this crash just wasn't noticed before due to the low volume of potentially "affected" users on nightly.

Comment 7

[[:philipp]]

see the url for a removal guide (in case affected users end up reading this bug report)

Comment 8

[jscher2000]

SuMo thread with the vendor's removal instructions and a link to another third party malware removal site: https://support.mozilla.org/questions/1120260

Comment 9

[FredMcD]

(In reply to Liz Henry (:lizzard) (needinfo? me) from comment #1)
> This only shows up on beta. Odd. I wonder why we wouldn't see it on release.

FYI: https://support.mozilla.org/en-US/questions/1121872
Product Firefox
Version 46.0.1
Build ID 20160502172042
Release Channel release
OS OS X 10.11
OS Version 10.11.4 15E65

Signature: mmhk@0xd8e5

Comment 10

[[:philipp]]

fred, this was written at the time when 45 was released - this crash is regressing in 46, so it is showing up in release builds now (we are aware of that). you can point affected users to https://support.mozilla.org/kb/firefox-46-crashes-startup-os-x

Comment 11

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

This is a low volume crash in Beta47 (as of 47.0b7), I don't feel the need to track this. Please let me know if there are any concerns.

Comment 12

[Sylvestre Ledru [:Sylvestre]]

Closing because no crash reported since 12 weeks.