1277846 - Crash in pmls.dll/rlls.dll with premiere opinion or relevant knowledge malware

Status: VERIFIED FIXED

(External Software Affecting Firefox :: Other, defect)

Description

[[:philipp]]

This bug was filed from the Socorro interface and is 
report bp-14ebdad7-023c-4559-9000-2e43f2160527.
=============================================================

this is a crash caused by premiere opinion malware across all windows versions with ~800 weekly crashes. it is spread out over various signatures...

Comment 1

[[:philipp]]

and another 500 crashes per week are due to the rlls.dll module (those are related malware products & also seem to share the same dll versioning scheme).

Comment 2

[[:philipp]]

Attachment: bug1277846_blocklist.patch

presumptive blocklisting patch which covers a few more related .dlls - not all 64bit variants of them are showing up in our crash stats data (yet?), but i have added them as a precaution.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/233878acc14b
Add various .dlls related to PremierOpinion/RelevantKnowledge to the Windows blocklist. r=aklotz

Comment 4

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/233878acc14b

Comment 5

[[:philipp]]

Comment on attachment 8759697 [details] [diff] [review]
bug1277846_blocklist.patch

Approval Request Comment
[Feature/regressing bug #]: external malware hooking into firefox
[User impact if declined]: 1000 weekly crashes on release, 400 on beta but none in other pre-release channels. so the blocklist patch would need to go into beta, in order to validate that it is working
[Describe test coverage new/current, TreeHerder]: n/a
[Risks and why]: low, this is making use of the purpose-built .dll-blocklist
[String/UUID change made/needed]: none

Comment 6

[Sylvestre Ledru [:Sylvestre]]

Comment on attachment 8759697 [details] [diff] [review]
bug1277846_blocklist.patch

Fix a crash, taking it

Should be in 48 beta 2

Comment 7

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/395d166833b0

Comment 8

[Carsten Book [:Tomcat]]

has problems to apply to beta:

grafting 350668:395d166833b0 "Bug 1277846 - Add various .dlls related to PremierOpinion/RelevantKnowledge to the Windows blocklist. r=aklotz, a=sylvestre"
merging mozglue/build/WindowsDllBlocklist.cpp
warning: conflicts while merging mozglue/build/WindowsDllBlocklist.cpp! (edit, then use 'hg resolve --mark')
abort: unresolved conflicts, can't continue
(use 'hg resolve' and 'hg graft --continue')

Comment 9

[[:philipp]]

Attachment: bug1277846_beta.patch

this would be a patch rebased for mozilla-beta

Comment 10

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/releases/mozilla-beta/rev/0bcc9439bf8c

Comment 11

[Carsten Book [:Tomcat]]

(In reply to [:philipp] from comment #9)
> Created attachment 8763961 [details] [diff] [review]
> bug1277846_beta.patch
> 
> this would be a patch rebased for mozilla-beta

thanks! landed!

Comment 12

[[:philipp]]

this seems to have worked - those crashes are stopping with 48.0b3.