Blocklist more "FF Tool" add-ons

RESOLVED FIXED

Status

()

enhancement
RESOLVED FIXED
a year ago
9 months ago

People

(Reporter: Fallen, Unassigned)

Tracking

({sec-other})

Firefox Tracking Flags

(Not tracked)

Details

There are a few more add-ons from FF Tool that inject shady remote scripts, but also do things such as close the add-on manager to make it harder to uninstall the add-on.

It does the following to hide about:addons: 
['ab','ou','t:','ad','do','ns'].join('')

These add-ons are also all loading a config file from a few different domains: searchingkdf.com, searchprt.com, searchrmd.com, searchefl.com, searchingjdm.com, searchrq.biz, searchyt.biz, searchfd.biz

We might want to block harder by not allowing certain patterns, but for the pattern mentioned above it is easy for the dev to just use a different method to divide the string.

guids:
{ac06c6b2-3fd6-45ee-9237-6235aa347215}
{d461cc1b-8a36-4ff0-b330-1824c148f326}
{d1ab5ebd-9505-481d-a6cd-6b9db8d65977}
{07953f60-447e-4f53-a5ef-ed060487f616}
{2d3c5a5a-8e6f-4762-8aff-b24953fe1cc9}
{f82b3ad5-e590-4286-891f-05adf5028d2f}
{f96245ad-3bb0-46c5-8ca9-2917d69aa6ca}
{2f53e091-4b16-4b60-9cae-69d0c55b2e78}

addon links available via:
https://sql.telemetry.mozilla.org/queries/4857?p_q=FF%20Tool
And some more, using similar domains and the same about:addons string:

guids:
{18868c3a-a209-41a6-855d-f99f782d1606}
{47352fbf-80d9-4b70-9398-fb7bffa3da53}
{1490068c-d8b7-4bd2-9621-a648942b312c}
{d47ebc8a-c1ea-4a42-9ca3-f723fff034bd}
{83d6f65c-7fc0-47d0-9864-a488bfcaa376}
{e804fa4c-08e0-4dae-a237-8680074eba07}
{ea618d26-780e-4f0f-91fd-2a6911064204}
{ce93dcc7-f911-4098-8238-7f023dcdfd0d}
{7eaf96aa-d4e7-41b0-9f12-775c2ac7f7c0}
And some more with the name starting with "FF Helper"
(for completeness, the last was with "FF Safe")

{b019c485-2a48-4f5b-be13-a7af94bc1a3e}
{9b8a3057-8bf4-4a9e-b94b-867e4e71a50c}
{eb3ebb14-6ced-4f60-9800-85c3de3680a4}
{01f409a5-d617-47be-a574-d54325fe05d1}
There seem to be countless more if you search for unlisted add-ons starting with "FF ". more than I could reasonably check (more then 200 add-ons to check). It would be a good idea to do a code search to identify all of them.
Wezhou, I heard you are familiar with the setup of that host that has all the unpacked add-on files on it. Can you search for the pattern ['ab','ou','t:','ad','do','ns'].join('') and let us know which add-ons this is in? Normally Andreas could do this for us, but he is on PTO.
Flags: needinfo?(wezhou)
The 2 blocks are now staged and awaiting review. We're also investigating ways to prevent this behavior from preventing users from uninstalling the add-on.
Flags: needinfo?(philipp)
I've reviewed the blocks and approved. Leaving the bug open until we find the remaining add-ons with this pattern.
Flags: needinfo?(philipp)
Bug 1432560 reported a few related add-ons. I was able to find related IDs using the IP address prefix for the last login.
Using the same technique on the list on this bug, I found 74 more.

{2bb68b03-b528-4133-9fc4-4980fbb4e449}    | FF Antivirus                                               
{231e58ac-0f3c-460b-bb08-0e589360bec7}    | Defender Firefox                                           
{a506c5af-0f95-4107-86f8-3de05e2794c9}    | FF AdBlock                                                 
{8886a262-1c25-490b-b797-2e750dd9f36b}    | FF Updater                                                 
{65072bef-041f-492e-8a51-acca2aaeac70}    | FF AdBlocker                                               
{6fa41039-572b-44a4-acd4-01fdaebf608d}    | FF Antivirus                                               
{87ba49bd-daba-4071-aedf-4f32a7e63dbe}    | FF Update Checker                                          
{95d58338-ba6a-40c8-93fd-05a34731dc0e}    | FF Virus Checker                                           
{4cbef3f0-4205-4165-8871-2844f9737602}    | FF AntiVirus Check                                         
{1855d130-4893-4c79-b4aa-cbdf6fee86d3}    | FF Updater Tool                                            
{87dcb9bf-3a3e-4b93-9c85-ba750a55831a}    | FF AdBlocker Tool                                          
{d03b6b0f-4d44-4666-a6d6-f16ad9483593}    | FF Guard Tool                                              
{767d394a-aa77-40c9-9365-c1916b4a2f84}    | FF AntiVirus Save                                          
{a0ce2605-b5fc-4265-aa65-863354e85058}    | FF Checker Tool                                            
{b7f366fa-6c66-46bf-8df2-797c5e52859f}    | FF Uploader Checker                                        
{4ad16913-e5cb-4292-974c-d557ef5ec5bb}    | FF Uploader Tool                                           
{3c3ef2a3-0440-4e77-9e3c-1ca8d48f895c}    | FF Defender Guard                                          
{543f7503-3620-4f41-8f9e-c258fdff07e9}    | FF Secure Helper                                           
{98363f8b-d070-47b6-acc6-65b80acac4f3}    | FF Secure Tool                                             
{5af74f5a-652b-4b83-a2a9-f3d21c3c0010}    | FF AntiVirus Tool                                          
{484e0ba4-a20b-4404-bb1b-b93473782ae0}    | FF Save Protecter                                          
{b99847d6-c932-4b52-9650-af83c9dae649}    | FF Info Safer                                              
{30972e0a-f613-4c46-8c87-2e59878e7180}    | FF Guard Secure                                            
{0599211f-6314-4bf9-854b-84cb18da97f8}    | FF Protect Tool                                            
{4414af84-1e1f-449b-ac85-b79f812eb69b}    | FF Guard Helper                                            
{2a8bec00-0ab0-4b4d-bd3d-4f59eada8fd8}    | Firefox Antivirus                                          
{bea8866f-01f8-49e9-92cd-61e96c05d288}    | Firefox Antivirus                                          
{046258c9-75c5-429d-8d5b-386cfbadc39d}    | FF Web Defender                                            
{c5d359ff-ae01-4f67-a4f7-bf234b5afd6e}    | FF Surfing Defender                                        
{fdc0601f-1fbb-40a5-84e1-8bbe96b22502}    | FF Surfing Helper                                          
{85349ea6-2b5d-496a-9379-d4be82c2c13d}    | FF AntiVir Guard                                           
{640c40e5-a881-4d16-a4d0-6aa788399dd2}    | FF Web Protect                                             
{d42328e1-9749-46ba-b35c-cce85ddd4ace}    | FF AntiVir Surfing                                         
{f6df4ef7-14bd-43b5-90c9-7bd02943789c}    | FF Guard Surfing                                           
{ccb7b5d6-a567-40a2-9686-a097a8b583dd}    | FF Protect Web                                             
{9b8df895-fcdd-452a-8c46-da5be345b5bc}    | FF Defender Surfing                                        
{5cf77367-b141-4ba4-ac2a-5b2ca3728e81}    | FF Defender Web                                            
{ada56fe6-f6df-4517-9ed0-b301686a34cc}    | FF Guarded Info                                            
{95c7ae97-c87e-4827-a2b7-7b9934d7d642}    | FF Upload Safer                                            
{e7b978ae-ffc2-4998-a99d-0f4e2f24da82}    | FF Reliable AntiVir                                        
{115a8321-4414-4f4c-aee6-9f812121b446}    | FF Protect Checker                                         
{bf153de7-cdf2-4554-af46-29dabfb2aa2d}    | FF Trusty Surfing                                          
{179710ba-0561-4551-8e8d-1809422cb09f}    | FF Uploader Protection                                     
{9d592fd5-e655-461a-9b28-9eba85d4c97f}    | FF Web Surety                                              
{4dac7c77-e117-4cae-a9f0-6bd89e9e26ab}    | FF Antivir Protection                                      
{cc689da4-203f-4a0c-a7a6-a00a5abe74c5}    | FF Sentinel Guard                                          
{0eb4672d-58a6-4230-b74c-50ca3716c4b0}    | FF Surfing Protection                                      
{06a71249-ef35-4f61-b2c8-85c3c6ee5617}    | FF Reliable Protection                                     
{5280684d-f769-43c9-8eaa-fb04f7de9199}    | FF Trusty Protection                                       
{c2341a34-a3a0-4234-90cf-74df1db0aa49}    | FF Trusty Protecter                                        
{85e31e7e-3e3a-42d3-9b7b-0a2ff1818b33}    | FF Info Protection                                         
{b5a35d05-fa28-41b5-ae22-db1665f93f6b}    | FF AdBlock Protection                                      
{1bd8ba17-b3ed-412e-88db-35bc4d8771d7}    | FF Uploader Trusty                                         
{a18087bb-4980-4349-898c-ca1b7a0e59cd}    | FF Protect AntiVir                                         
{488e190b-d1f6-4de8-bffb-0c90cc805b62}    | FF Uploader Safety                                         
{618baeb9-e694-4c7b-9328-69f35b6a8839}    | FF Search Informer                                         
{b91fcda4-88b0-4a10-9015-9365e5340563}    | FF Reliable Surfing                                        
{04150f98-2d7c-4ae2-8979-f5baa198a577}    | FF Info Guard                                              
{4b1050c6-9139-4126-9331-30a836e75db9}    | FF Shield Surfing                                          
{1e6f5a54-2c4f-4597-aa9e-3e278c617d38}    | FF Protected AdBlock                                       
{e73854da-9503-423b-ab27-fafea2fbf443}    | FF Info Shield                                             
{a2427e23-d349-4b25-b5b8-46960b218079}    | FF Protected Info                                          
{f92c1155-97b3-40f4-9d5b-7efa897524bb}    | FF Info Defender                                           
{c8e14311-4b2d-4eb0-9a6b-062c6912f50e}    | FF Help Surfing                                            
{45621564-b408-4c29-8515-4cf1f26e4bc3}    | FF AntiVir Defender                                        
{27380afd-f42a-4c25-b57d-b9012e0d5d48}    | FF Search Protection                                       
{abec23c3-478f-4a5b-8a38-68ccd500ec42}    | FF Guarded Searching                                       
{a83c1cbb-7a41-41e7-a2ae-58efcb4dc2e4}    | FF Guarded Help                                            
{62237447-e365-487e-8fc3-64ddf37bdaed}    | FF Defender AdBlocker                                      
{b12cfdc7-3c69-43cb-a3fb-38981b68a087}    | FF Info Filter                                             
{1a927d5b-42e7-4407-828a-fdc441d0daae}    | FF Defender Blocker                                        
{dd1cb0ec-be2a-432b-9c90-d64c824ac371}    | FF Web Shield                                              
{82c8ced2-e08c-4d6c-a12b-3e8227d7fc2a}    | FF AdBlock Shield                                          
{87c552f9-7dbb-421b-8deb-571d4a2d7a21}    | FF Upload Safeguard

I staged a few blocks to cover them. Philipp, please review.
Flags: needinfo?(philipp)
Done, thanks! Wezhou, can you provide us the list of remaining add-ons that use this pattern ['ab','ou','t:','ad','do','ns'].join('') ?
Flags: needinfo?(philipp)

Comment 10

a year ago
So after about 8018 minutes (that's about 5.6 days btw), the scan finished, and here are the list of files that contains the said pattern.


$ time sudo find . -type d -name \*_unzipped -exec ag -il "\['ab','ou','t:','ad','do','ns'\].join\(''\)" \{} \;
918518/ff_protect_antivir-1.2.3-an+fx.xpi_unzipped/background.js
912398/ff_defender_web-7.0.5-an+fx.xpi_unzipped/background.js
906674/ff_info_guarded-4.6.5-an+fx.xpi_unzipped/background.js
906674/ff_info_guarded-4.6.4-an+fx.xpi_unzipped/background.js
919373/ff_shield_surfing-1.7.8-an+fx.xpi_unzipped/background.js
922766/ff_defender_blocker-7.1.1-an+fx.xpi_unzipped/background.js
903659/ff_info_helper-3.3.11-an+fx.xpi_unzipped/background.js
907736/ff_guard_helper-1.0.11-an+fx.xpi_unzipped/background.js
915359/ff_info_protection-4.6.2-an+fx.xpi_unzipped/background.js
912767/ff_web_surety-5.1.6-an+fx.xpi_unzipped/background.js
922263/ff_search_protection-6.1.5-an+fx.xpi_unzipped/background.js
899455/ff_adblocker-1.7.3-an+fx.xpi_unzipped/background.js
899455/ff_adblocker-1.7.5-an+fx.xpi_unzipped/background.js
899455/ff_adblocker-1.7.4-an+fx.xpi_unzipped/background.js
911814/ff_guard_surfing-1.2.3-an+fx.xpi_unzipped/background.js
905118/ff_secure_helper-1.8.3-an+fx.xpi_unzipped/background.js
912363/ff_defender_surfing-3.3.6-an+fx.xpi_unzipped/background.js
912363/ff_defender_surfing-3.3.5-an+fx.xpi_unzipped/background.js
920616/ff_help_surfing-2.2.3-an+fx.xpi_unzipped/background.js
911463/ff_antivir_surfing-3.3.3-an+fx.xpi_unzipped/background.js
911922/ff_protect_web-5.2.3-an+fx.xpi_unzipped/background.js
911333/ff_web_protect-3.4.2-an+fx.xpi_unzipped/background.js
920612/ff_info_defender-2.1.2-an+fx.xpi_unzipped/background.js
922744/ff_guarded_help-6.3.3-an+fx.xpi_unzipped/background.js
909811/ff_guarded_web_surfing-1.5.1-an+fx.xpi_unzipped/background.js
918541/ff_reliable_surfing-1.5.6-an+fx.xpi_unzipped/background.js
905185/ff_secure_tool-1.5.0-an+fx.xpi_unzipped/background.js
902917/ff_guard_tool-4.4.2-an+fx.xpi_unzipped/background.js
902917/ff_guard_tool-4.4.1-an+fx.xpi_unzipped/background.js
909325/ff_upload_defender-4.5.5-an+fx.xpi_unzipped/background.js
911809/ff_safe_update-3.0.3-an+fx.xpi_unzipped/background.js
912501/ff_safer_search-3.3.1-an+fx.xpi_unzipped/background.js
922759/ff_info_filter-4.3.5-an+fx.xpi_unzipped/background.js
918547/ff_info_guard-1.6.7-an+fx.xpi_unzipped/background.js
902825/ff_tool_defend-5.5.11-an+fx.xpi_unzipped/background.js
912509/ff_reliable_antivir-6.7.5-an+fx.xpi_unzipped/background.js
911933/ff_safe_web_tool-1.3.3-an+fx.xpi_unzipped/background.js
900827/ff_virus_checker-9.0.0-an+fx.xpi_unzipped/background.js
898629/ff_protecter-4.2.9-an+fx.xpi_unzipped/background.js
906128/ff_guard_secure-6.6.6-an+fx.xpi_unzipped/background.js
912761/ff_uploader_protection-8.1.1-an+fx.xpi_unzipped/background.js
912761/ff_uploader_protection-8.1.2-an+fx.xpi_unzipped/background.js
906119/ff_info_safer-3.3.3-an+fx.xpi_unzipped/background.js
897882/ff_updater-3.9.7-an+fx.xpi_unzipped/background.js
909323/ff_antivirus_helper-4.2.2-an+fx.xpi_unzipped/background.js
919649/ff_protected_adblock-1.8.9-an+fx.xpi_unzipped/background.js
912505/ff_safety_search-3.7.4-an+fx.xpi_unzipped/background.js
902999/ff_check_updater-5.7.2-an+fx.xpi_unzipped/background.js
902999/ff_check_updater-5.7.3-an+fx.xpi_unzipped/background.js
918022/ff_adblock_protection-5.8.1-an+fx.xpi_unzipped/background.js
905978/ff_tool_adblock-1.9.9-an+fx.xpi_unzipped/background.js
909875/ff_surfing_helper-8.8.1-an+fx.xpi_unzipped/background.js
908247/firefox_antivirus-5.8.7-an+fx.xpi_unzipped/background.js
908247/firefox_antivirus-5.8.6-an+fx.xpi_unzipped/background.js
909318/ff_tool_checker-1.3.3-an+fx.xpi_unzipped/background.js
902955/ff_antivirus_save-4.4.3-an+fx.xpi_unzipped/background.js
902955/ff_antivirus_save-4.4.2-an+fx.xpi_unzipped/background.js
912756/ff_trusty_surfing-4.4.4-an+fx.xpi_unzipped/background.js
912819/ff_antivir_protection-4.8.2-an+fx.xpi_unzipped/background.js
903549/ff_checker_tool-7.9.2-an+fx.xpi_unzipped/background.js
903549/ff_checker_tool-7.9.3-an+fx.xpi_unzipped/background.js
914790/ff_surfing_protection-3.1.6-an+fx.xpi_unzipped/background.js
894048/ff_antivirus-1.0.3-an+fx.xpi_unzipped/background.js
900879/ff_antivirus_check-9.0.0-an+fx.xpi_unzipped/background.js
900053/ff_security_guard-8.8.5-an+fx.xpi_unzipped/background.js
908286/firefox_antivirus-5.8.8-an+fx.xpi_unzipped/background.js
903579/ff_uploader_tool-4.11.1-an+fx.xpi_unzipped/background.js
903579/ff_uploader_tool-4.11.0-an+fx.xpi_unzipped/background.js
909834/ff_surfing_defender-3.3.9-an+fx.xpi_unzipped/background.js
922246/ff_antivir_defender-3.7.7-an+fx.xpi_unzipped/background.js
912526/ff_protect_checker-8.6.3-an+fx.xpi_unzipped/background.js
913309/ff_sentinel_guard-4.4.9-an+fx.xpi_unzipped/background.js
922255/ff_safe_protection-7.9.5-an+fx.xpi_unzipped/background.js
922255/ff_safe_protection-7.9.4-an+fx.xpi_unzipped/background.js
918511/ff_uploader_trusty-1.1.3-an+fx.xpi_unzipped/background.js
900480/ff_adblock_tool-6.6.11-an+fx.xpi_unzipped/background.js
905331/ff_save_protecter-5.5.4-an+fx.xpi_unzipped/background.js
905331/ff_save_protecter-5.5.3-an+fx.xpi_unzipped/background.js
912423/ff_checker_upload-8.0.7-an+fx.xpi_unzipped/background.js
912423/ff_checker_upload-8.0.8-an+fx.xpi_unzipped/background.js
902802/ff_updater_tool-1.1.8-an+fx.xpi_unzipped/background.js
909829/ff_web_defender-4.4.2-an+fx.xpi_unzipped/background.js
900174/ff_update_checker-8.4.4-an+fx.xpi_unzipped/background.js
899542/ff_security_checker-5.0.8-an+fx.xpi_unzipped/background.js
902910/ff_tool_update-4.4.0-an+fx.xpi_unzipped/background.js
902910/ff_tool_update-4.4.1-an+fx.xpi_unzipped/background.js
903522/ff_helper_tool-6.1.6-an+fx.xpi_unzipped/background.js
915321/ff_reliable_protection-1.9.9-an+fx.xpi_unzipped/background.js
912531/ff_helper_checker-9.1.3-an+fx.xpi_unzipped/background.js
902981/ff_save_updater-8.1.6-an+fx.xpi_unzipped/background.js
902981/ff_save_updater-8.1.7-an+fx.xpi_unzipped/background.js
918524/ff_uploader_safety-1.3.4-an+fx.xpi_unzipped/background.js
912386/ff_tool_defend-3.8.5-an+fx.xpi_unzipped/background.js
911459/ff_safe_checker-4.1.8-an+fx.xpi_unzipped/background.js
915338/ff_safe_helper-4.4.0-an+fx.xpi_unzipped/background.js
919910/ff_info_shield-1.9.0-an+fx.xpi_unzipped/background.js
915356/ff_helper_protection-6.6.0-an+fx.xpi_unzipped/background.js
922754/ff_defender_adblocker-3.1.8-an+fx.xpi_unzipped/background.js
907724/ff_protect_tool-5.8.8-an+fx.xpi_unzipped/background.js
909344/ff_upload_checker-6.1.1-an+fx.xpi_unzipped/background.js
915347/ff_trusty_protecter-2.4.2-an+fx.xpi_unzipped/background.js
911332/ff_antivir_guard-5.5.5-an+fx.xpi_unzipped/background.js
920044/ff_protected_info-2.1.0-an+fx.xpi_unzipped/background.js
923005/ff_web_shield-9.9.1-an+fx.xpi_unzipped/background.js
912412/ff_guarded_info-6.1.2-an+fx.xpi_unzipped/background.js
922266/ff_guarded_searching-5.9.3-an+fx.xpi_unzipped/background.js
912429/ff_upload_safer-7.4.7-an+fx.xpi_unzipped/background.js
903591/ff_defender_guard-6.0.10-an+fx.xpi_unzipped/background.js
903591/ff_defender_guard-6.0.11-an+fx.xpi_unzipped/background.js
922761/ff_antivir_monitoring-5.4.2-an+fx.xpi_unzipped/background.js
918540/ff_search_informer-1.4.5-an+fx.xpi_unzipped/background.js
915354/ff_safe_defend-3.2.8-an+fx.xpi_unzipped/background.js
903564/ff_uploader_checker-2.2.9-an+fx.xpi_unzipped/background.js
903564/ff_uploader_checker-2.2.10-an+fx.xpi_unzipped/background.js
900099/ff_secure_updater-7.1.9-an+fx.xpi_unzipped/background.js
912339/ff_helper_info-4.1.0-an+fx.xpi_unzipped/background.js
902853/ff_adblocker_tool-3.8.1-an+fx.xpi_unzipped/background.js
906093/ff_defender_info-4.0.9-an+fx.xpi_unzipped/background.js
912344/ff_tool_antivirus-2.2.9-an+fx.xpi_unzipped/background.js
915332/ff_trusty_protection-3.1.9-an+fx.xpi_unzipped/background.js
925034/ff_adblock_shield-9.1.4-an+fx.xpi_unzipped/background.js
910058/ff_antivir_checker-7.8.1-an+fx.xpi_unzipped/background.js
892938/ff_antifirus-15.0.7-an+fx.xpi_unzipped/background.js
905243/ff_antivirus_tool-1.6.1-an+fx.xpi_unzipped/background.js
900213/ff_ublocker-2.11.3-an+fx.xpi_unzipped/background.js
897878/ff_adblock-2.4.5-an+fx.xpi_unzipped/background.js
915745/ff_tool_informer-5.1.1-an+fx.xpi_unzipped/background.js
909805/ff_safe_web-5.5.5-an+fx.xpi_unzipped/background.js

real    8018m16.143s
user    40m2.710s
sys     192m6.636s
Flags: needinfo?(wezhou)
That maps to the following guids:

{d78d27f4-9716-4f13-a8b6-842c455d6a46}
{2bb68b03-b528-4133-9fc4-4980fbb4e449}
{a506c5af-0f95-4107-86f8-3de05e2794c9}
{8886a262-1c25-490b-b797-2e750dd9f36b}
{bd5ba448-b096-4bd0-9582-eb7a5c9c0948}
{65072bef-041f-492e-8a51-acca2aaeac70}
{0b24cf69-02b8-407d-83db-e7af04fc1f3e}
{e08d85c5-4c0f-4ce3-9194-760187ce93ba}
{1c7d6d9e-325a-4260-8213-82d51277fc31}
{87ba49bd-daba-4071-aedf-4f32a7e63dbe}
{8a0699a0-09c3-4cf1-b38d-fec25441650c}
{1e68848a-2bb7-425c-81a2-524ab93763eb}
{95d58338-ba6a-40c8-93fd-05a34731dc0e}
{4cbef3f0-4205-4165-8871-2844f9737602}
{1855d130-4893-4c79-b4aa-cbdf6fee86d3}
{07953f60-447e-4f53-a5ef-ed060487f616}
{87dcb9bf-3a3e-4b93-9c85-ba750a55831a}
{f96245ad-3bb0-46c5-8ca9-2917d69aa6ca}
{d03b6b0f-4d44-4666-a6d6-f16ad9483593}
{767d394a-aa77-40c9-9365-c1916b4a2f84}
{be5d0c88-571b-4d01-a27a-cc2d2b75868c}
{3908d078-e1db-40bf-9567-5845aa77b833}
{01f409a5-d617-47be-a574-d54325fe05d1}
{a0ce2605-b5fc-4265-aa65-863354e85058}
{b7f366fa-6c66-46bf-8df2-797c5e52859f}
{4ad16913-e5cb-4292-974c-d557ef5ec5bb}
{3c3ef2a3-0440-4e77-9e3c-1ca8d48f895c}
{5b620343-cd69-49b8-a7ba-f9d499ee5d3d}
{543f7503-3620-4f41-8f9e-c258fdff07e9}
{98363f8b-d070-47b6-acc6-65b80acac4f3}
{5af74f5a-652b-4b83-a2a9-f3d21c3c0010}
{484e0ba4-a20b-4404-bb1b-b93473782ae0}
{ac06c6b2-3fd6-45ee-9237-6235aa347215}
{fce89242-66d3-4946-9ed0-e66078f172fc}
{b99847d6-c932-4b52-9650-af83c9dae649}
{30972e0a-f613-4c46-8c87-2e59878e7180}
{0c4df994-4f4a-4646-ae5d-8936be8a4188}
{0599211f-6314-4bf9-854b-84cb18da97f8}
{4414af84-1e1f-449b-ac85-b79f812eb69b}
{2a8bec00-0ab0-4b4d-bd3d-4f59eada8fd8}
{bea8866f-01f8-49e9-92cd-61e96c05d288}
{d1ab5ebd-9505-481d-a6cd-6b9db8d65977}
{6eee2d17-f932-4a43-a254-9e2223be8f32}
{e05ba06a-6d6a-4c51-b8fc-60b461ffecaf}
{a5808da1-5b4f-42f2-b030-161fd11a36f7}
{e804fa4c-08e0-4dae-a237-8680074eba07}
{d355bee9-07f0-47d3-8de6-59b8eecba57b}
{046258c9-75c5-429d-8d5b-386cfbadc39d}
{c5d359ff-ae01-4f67-a4f7-bf234b5afd6e}
{fdc0601f-1fbb-40a5-84e1-8bbe96b22502}
{a1f8e136-bce5-4fd3-9ed1-f260703a5582}
{85349ea6-2b5d-496a-9379-d4be82c2c13d}
{640c40e5-a881-4d16-a4d0-6aa788399dd2}
{18868c3a-a209-41a6-855d-f99f782d1606}
{d42328e1-9749-46ba-b35c-cce85ddd4ace}
{83d6f65c-7fc0-47d0-9864-a488bfcaa376}
{f6df4ef7-14bd-43b5-90c9-7bd02943789c}
{ccb7b5d6-a567-40a2-9686-a097a8b583dd}
{ea618d26-780e-4f0f-91fd-2a6911064204}
{9b8a3057-8bf4-4a9e-b94b-867e4e71a50c}
{d461cc1b-8a36-4ff0-b330-1824c148f326}
{9b8df895-fcdd-452a-8c46-da5be345b5bc}
{2d3c5a5a-8e6f-4762-8aff-b24953fe1cc9}
{5cf77367-b141-4ba4-ac2a-5b2ca3728e81}
{ada56fe6-f6df-4517-9ed0-b301686a34cc}
{6cee30bc-a27c-43ea-ac72-302862db62b2}
{95c7ae97-c87e-4827-a2b7-7b9934d7d642}
{ce93dcc7-f911-4098-8238-7f023dcdfd0d}
{7eaf96aa-d4e7-41b0-9f12-775c2ac7f7c0}
{e7b978ae-ffc2-4998-a99d-0f4e2f24da82}
{115a8321-4414-4f4c-aee6-9f812121b446}
{b019c485-2a48-4f5b-be13-a7af94bc1a3e}
{bf153de7-cdf2-4554-af46-29dabfb2aa2d}
{179710ba-0561-4551-8e8d-1809422cb09f}
{9d592fd5-e655-461a-9b28-9eba85d4c97f}
{4dac7c77-e117-4cae-a9f0-6bd89e9e26ab}
{cc689da4-203f-4a0c-a7a6-a00a5abe74c5}
{0eb4672d-58a6-4230-b74c-50ca3716c4b0}
{06a71249-ef35-4f61-b2c8-85c3c6ee5617}
{5280684d-f769-43c9-8eaa-fb04f7de9199}
{1490068c-d8b7-4bd2-9621-a648942b312c}
{c2341a34-a3a0-4234-90cf-74df1db0aa49}
{47352fbf-80d9-4b70-9398-fb7bffa3da53}
{eb3ebb14-6ced-4f60-9800-85c3de3680a4}
{85e31e7e-3e3a-42d3-9b7b-0a2ff1818b33}
{f82b3ad5-e590-4286-891f-05adf5028d2f}
{b5a35d05-fa28-41b5-ae22-db1665f93f6b}
{1bd8ba17-b3ed-412e-88db-35bc4d8771d7}
{a18087bb-4980-4349-898c-ca1b7a0e59cd}
{488e190b-d1f6-4de8-bffb-0c90cc805b62}
{618baeb9-e694-4c7b-9328-69f35b6a8839}
{b91fcda4-88b0-4a10-9015-9365e5340563}
{04150f98-2d7c-4ae2-8979-f5baa198a577}
{4b1050c6-9139-4126-9331-30a836e75db9}
{1e6f5a54-2c4f-4597-aa9e-3e278c617d38}
{e73854da-9503-423b-ab27-fafea2fbf443}
{a2427e23-d349-4b25-b5b8-46960b218079}
{f92c1155-97b3-40f4-9d5b-7efa897524bb}
{c8e14311-4b2d-4eb0-9a6b-062c6912f50e}
{45621564-b408-4c29-8515-4cf1f26e4bc3}
{d47ebc8a-c1ea-4a42-9ca3-f723fff034bd}
{27380afd-f42a-4c25-b57d-b9012e0d5d48}
{abec23c3-478f-4a5b-8a38-68ccd500ec42}
{a83c1cbb-7a41-41e7-a2ae-58efcb4dc2e4}
{62237447-e365-487e-8fc3-64ddf37bdaed}
{b12cfdc7-3c69-43cb-a3fb-38981b68a087}
{e08ebf0b-431d-4ed1-88bb-02e5db8b9443}
{1a927d5b-42e7-4407-828a-fdc441d0daae}
{dd1cb0ec-be2a-432b-9c90-d64c824ac371}
{82c8ced2-e08c-4d6c-a12b-3e8227d7fc2a}

After removing the ones we already did that leaves:



{d78d27f4-9716-4f13-a8b6-842c455d6a46}
{bd5ba448-b096-4bd0-9582-eb7a5c9c0948}
{0b24cf69-02b8-407d-83db-e7af04fc1f3e}
{e08d85c5-4c0f-4ce3-9194-760187ce93ba}
{1c7d6d9e-325a-4260-8213-82d51277fc31}
{8a0699a0-09c3-4cf1-b38d-fec25441650c}
{1e68848a-2bb7-425c-81a2-524ab93763eb}
{be5d0c88-571b-4d01-a27a-cc2d2b75868c}
{3908d078-e1db-40bf-9567-5845aa77b833}
{5b620343-cd69-49b8-a7ba-f9d499ee5d3d}
{fce89242-66d3-4946-9ed0-e66078f172fc}
{0c4df994-4f4a-4646-ae5d-8936be8a4188}
{6eee2d17-f932-4a43-a254-9e2223be8f32}
{e05ba06a-6d6a-4c51-b8fc-60b461ffecaf}
{a5808da1-5b4f-42f2-b030-161fd11a36f7}
{d355bee9-07f0-47d3-8de6-59b8eecba57b}
{a1f8e136-bce5-4fd3-9ed1-f260703a5582}
{6cee30bc-a27c-43ea-ac72-302862db62b2}
{e08ebf0b-431d-4ed1-88bb-02e5db8b9443}
Removing the ones from bug 1432560 we remain with:


{d78d27f4-9716-4f13-a8b6-842c455d6a46}
{bd5ba448-b096-4bd0-9582-eb7a5c9c0948}
{0b24cf69-02b8-407d-83db-e7af04fc1f3e}
{e08d85c5-4c0f-4ce3-9194-760187ce93ba}
{1c7d6d9e-325a-4260-8213-82d51277fc31}
{8a0699a0-09c3-4cf1-b38d-fec25441650c}
{1e68848a-2bb7-425c-81a2-524ab93763eb}
{be5d0c88-571b-4d01-a27a-cc2d2b75868c}
{3908d078-e1db-40bf-9567-5845aa77b833}
{5b620343-cd69-49b8-a7ba-f9d499ee5d3d}
{6eee2d17-f932-4a43-a254-9e2223be8f32}
{e05ba06a-6d6a-4c51-b8fc-60b461ffecaf}
{a5808da1-5b4f-42f2-b030-161fd11a36f7}
{d355bee9-07f0-47d3-8de6-59b8eecba57b}
{a1f8e136-bce5-4fd3-9ed1-f260703a5582}

Thanks for running through the files for us wezhou. Amazing that it takes so long, too bad we don't have a faster way to check this.
The blocks for the IDs in comment #12 are awaiting review.
Flags: needinfo?(philipp)
Done, thanks!
Flags: needinfo?(philipp)
I suppose we're done here. Let's file new bugs for new instances of this.
Status: NEW → RESOLVED
Last Resolved: a year ago
Resolution: --- → FIXED
Group: toolkit-core-security → core-security-release
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.