1329994 - Blocklist hmpalert.dll (Hitman Pro Alert)

Status: RESOLVED WONTFIX

(Toolkit :: Blocklist Policy Requests, defect)

Description

[Benjamin Smedberg]

For injecting into our process and causing crashes tracked in bug 1300480, this adds hmpalert.dll to our DLL blocklist.

Comment 1

[[:philipp]]

i think i tried this once in the past but our blocklisting mechanism wasn't successful with this dll unfortunately...
https://bugzilla.mozilla.org/show_bug.cgi?id=1268025#c14

Comment 2

[Benjamin Smedberg]

Attachment: Bug 1329994 - block hmpalert.dll (Hitman Pro Alert),

Review commit: https://reviewboard.mozilla.org/r/103580/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/103580/

Comment 3

[Benjamin Smedberg]

[Tracking Requested - why for this release]: Crashes as identified in bug 1300480 could potentially be explosive.

Comment 4

[Julien Cristau [:jcristau]]

Tracking for 51 and up.  Setting qe-verify, we'll need to make sure this actually works.

Comment 5

[Jim Mathies [:jimm]]

Comment on attachment 8825417 [details]
Bug 1329994 - block hmpalert.dll (Hitman Pro Alert),

fyi, I think jeff is on pto.

Comment 6

[Peter Dolanjski [:pdol]]

Let's go ahead with the block and we'll attempt reaching out to Sophos in parallel.

Comment 7

[Kev Needham [:kev]]

Just a note that our blocklisting policy requires outreach to try and resolve before effecting a block, unless there's a major impact. Given comment #3 around it being potentially explosive and not yet explosive, is this something we can try outreach on first?

Comment 8

[Peter Dolanjski [:pdol]]

(In reply to Kev Needham [:kev] from comment #7)
> Just a note that our blocklisting policy requires outreach to try and
> resolve before effecting a block, unless there's a major impact. Given
> comment #3 around it being potentially explosive and not yet explosive, is
> this something we can try outreach on first?

Thanks for pointing that out, Kev.  Let's try the outreach first.
I did ask a Sophos employee if he can put me in touch with the right team.

Comment 9

[Desigan Chinniah [:cyberdees] [:dees] [London - GMT]]

Update: Via the CTO of Sophos, I have been connected with the CTO of SurfRight, the Sophos HitmanPro vendor — and they have engaged via email. These threads should include all relevant folks from both sides.

Comment 10

[Jim Mathies [:jimm]]

This dll has been an issue for a while, and has impacted numerous releases. I don't think we should hold back on blocklisting it. It's clearly having a negative impact on the stability of the browser for users who have this software package installed. 

https://crash-stats.mozilla.com/search/?signature=~hmpalert&product=Firefox&date=%3E%3D2016-12-01T15%3A42%3A00.000Z&date=%3C2017-01-13T15%3A42%3A00.000Z&_sort=-date&_facets=signature&_facets=version&_facets=user_comments&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#facet-user_comments

Some user comments - 
3-4 crashes a day if this isn't resolved Chrome will end up my main browser
Again?
Again? Fix this!
2ND CRASH IN 2 DAYS!!!!!!! WHAT GOING ON??????
These crashes are getting worse and worse!!!!! More and more frequent!! Please fix?
Browsing for 2 miinutes this is happeneing 2-3 times a day usually when I first start it 
Crashes even in Safe Mode since last Windows update. Also using HitManPro Alert.
EVERYTIME I LOAD FIREFOX IT CRASHES
..

The fact that we are getting lots of user comments indicate this is something people are really annoyed with.

Comment 11

[Jeff Griffiths (:canuckistani) (:⚡︎)]

Comment on attachment 8825417 [details]
Bug 1329994 - block hmpalert.dll (Hitman Pro Alert),

Please tell me you shipped this while I was gone.

Comment 12

[Benjamin Smedberg]

Kev, can you provide a decision? With the new blocklisting policy, it seems this should ride the 53 train regardless of what we do for 52.

Comment 13

[Kev Needham [:kev]]

In comment #9 dees mentioned we had engaged, but I'm not sure what the outcome was.

Given that we're 3 weeks past initial engagement, if we don't have a fix by now I agree they're a BL candidate. Do we have an idea of extent of impact?

Dees, can you provide an update on outcome of discussions?

Comment 14

[Desigan Chinniah [:cyberdees] [:dees] [London - GMT]]

I've just asked via the email thread, :kev. The last known update was that :marco had connected them with a user willing to share crash data dumps.

Comment 15

[Marco Castelluccio [:marco]]

I don't have any news either.

Note that blocklisting here might not work, as mentioned in comment 1.

Comment 16

[Desigan Chinniah [:cyberdees] [:dees] [London - GMT]]

Can we confirm...

From a HitmanPro engineer via our email thread:

===

Sorry for the late reply. We have made a fix for at least some of the crashes that were reported by the FireFox users. A new version (Build 582 Beta) of HitmanPro.Alert can be downloaded here: http://test.hitmanpro.com/hmpalert3b582.exe .

It would be much appreciated  if you can send the link to users that would like to test if the crashes are indeed solved.

Hope this helps.

===

Comment 17

[Marco Castelluccio [:marco]]

Unfortunately we don't have any contact with users who are able to reproduce, so I'm waiting a while to see if the volume of the crash is reducing.

Comment 18

[Marco Castelluccio [:marco]]

Version 3.6.3.582 is unaffected, as Sophos reported.

Version 3.6.3.586 is crashing with a few hmpalert.dll@ signatures, but just 29 crashes over the past two weeks.

https://gist.github.com/marco-c/8e0d03c2d6abd344db09348d8be422a9

Comment 19

[charlie.siegel]

(In reply to Marco Castelluccio [:marco] from comment #17)
> Unfortunately we don't have any contact with users who are able to
> reproduce, so I'm waiting a while to see if the volume of the crash is
> reducing.

Hello,

I may be experiencing this issue.  See: https://bugzilla.mozilla.org/show_bug.cgi?id=1404298

We're running Sophos / Hitman Pro.  Both me and one of my collegues have had Firefox stop working with - "gah, your tab crashed" reports until the computers are rebooted.  We're both runnign MacOS Sierra (latest patch level).  I've seen this with both 56 & 57.

Is there anything I can provide that might help get to the bottom of this?