1527603 - Extension block request: [e-mail]

Status: RESOLVED FIXED

(Toolkit :: Blocklist Policy Requests, task)

Description

[rctgamer3]

Extension name: X Player
Extension UUID: [e-mail]
Extension versions to block: all
Block severity: hard

Reasons: fake Firefox update, remote script injection on every page, page redirection, same add-on structure as the ones in bug 1521429

Comment 1

[Andreas Wagner [:TheOne] [use NI]]

Clones/Variants that obfuscate their remote-script injection:

odnenajaeicndaeiapagpglohiklndhe@chrome-store-foxified-2174031944
akdibckdjeocfbcjaikipkhhbggcbgkg@chrome-store-foxified-699805590
{bd9f5830-bf8c-4e38-933d-09f85b24d744}
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
generated-p5qj07ef5ceqfktp5v8whw@chrome-store-foxified--505607522
generated-tuag2j5gwq73xzp8fbw3j8@chrome-store-foxified--505607522
generated-uj53d5j612ap5pz11hwgv2@chrome-store-foxified--505607522
{de47a3b4-dad1-4f4a-bdd6-8666586e29e8}
{a368025b-9828-43a1-8a5c-f6fab61c9be9}
{f51f0244-bfb0-40ce-bf9d-af49f5949e61}
{578cad7a-57d5-404d-8dda-4d30de33b0c2}
{ded6afad-2aaa-446b-b6bd-b12a8a61c945}
{5c7601bf-522b-47e5-b0f0-ea0e706af443}
{eb01dc49-688f-4a21-aa8d-49bd88a8f319}
{1a45f6aa-d80a-4317-84d2-0ce43671b08a}
{68ca8e3a-397a-4135-a3af-b6e4068a1eae}
{83ed90f8-b07e-4c45-ba6b-ba2fe12cebb6}
{59f59748-e6a8-4b41-87b5-9baadd75ddef}
{34aa433c-27e9-4c87-a662-9f82f99eb9af}
{6e449795-c545-41be-92c0-5d467c147389}
{12089699-5570-4bf6-890f-07e7f674aa6e}
{e0c3a1ca-8e21-4d1b-b53b-ea115cf59172}
{effa2f97-0f07-44c8-99cb-32ac760a0621}
{3f841cfc-de5a-421f-8bd7-2bf1d943b02a}
{026dfc8c-ecc8-41ba-b45f-70ffbd5cc672}
{23f63efb-156e-440b-a96c-118bebc21057}
{81751484-2dc9-47bf-aec3-b8e556237178}
{d89d1e20-57af-4164-82cc-650af45cf0a5}
{bdf8767d-ae4c-4d45-8f95-0ba29b910600}
{48c6ad6d-297c-4074-8fef-ca5f07683859}
{54aa688d-9504-481d-ba75-cfee421b98e0}
{e73c1b5d-20f7-4d86-ad16-9de3c27718e2}
{231dfb44-98e0-4bc4-b6ee-1dac4a836b08}
{f6e6fd9b-b89f-4e8d-9257-01405bc139a6}
{8562e48e-3723-412a-9ebd-b33d3d3b29dd}
{b9425ace-c2e9-4ec4-b564-4062546f4eca}
{edc9816b-60b4-493c-a090-01125e0b8018}
{1a3fb414-0945-405c-a62a-9fe5e1a50c69}
{e6bbf496-6489-4b48-8e5a-799aad4aa742}
{d77fed37-85c0-4b94-89bb-0d2849472b8d}
{9efdbe5f-6e51-4a35-a41b-71dc939e6221}
{2330eb8a-e3fe-4b2e-9f17-9ddbfb96e6f5}
{392f4252-c731-4715-9f8d-d5815f766abb}
{b1908b02-410d-4778-8856-7e259fbf471d}
{71beafd6-779b-4b7d-a78b-18a107277b59}
{1091c11f-5983-410e-a715-0968754cff54}
{7ebe580f-71c9-4ef8-8073-f38deaeb9dfb}
{1e369c7c-6b61-436e-8978-4640687670d6}
{ffea9e62-e516-4238-88a7-d6f9346f4955}
{d3b5280b-f8d8-4669-bdf6-91f23ae58042}
{ff87977a-fefb-4a9d-b703-4b73dce8853d}
{36f34d69-f22f-47c3-b4cd-4f37b7676107}
{a4d84dae-7906-4064-911b-3ad2b1ec178b}
{d7e388c5-1cd0-4aa6-8888-9172f90951fb}
{f1479b0b-0762-4ba2-97fc-010ea9dd4e73}
{a5e28713-14c3-4967-befe-2ec253e317cd}
{335ac35b-6c16-4304-93f0-64a418e5bf81}
{d3fdb429-ef84-40a4-b160-010745ee0098}
{d66db057-7d38-4df4-a0ba-63c272be25ee}
{ff7f7151-09e3-4e35-9052-b21e23e7e2c1}
{1479da02-e759-4a6f-8f62-c08096583806}
{42d59cda-c117-459e-b244-1b850c27ccc9}
{bec48f33-7869-4158-8cbc-5cf1606f9afa}
{08ca656c-4973-46a8-85a9-3d771399c86e}
{dc5336c8-5624-4f74-a794-bb15f3760f34}
{6a3d97de-1b42-4624-880a-1a68bc917142}
{ad965166-3a34-449d-8230-a636fb5cae57}
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]

Comment 2

[Andreas Wagner [:TheOne] [use NI]]

Turns out that some are already blocked, the remaining ones are:

odnenajaeicndaeiapagpglohiklndhe@chrome-store-foxified-2174031944
akdibckdjeocfbcjaikipkhhbggcbgkg@chrome-store-foxified-699805590
{bd9f5830-bf8c-4e38-933d-09f85b24d744}
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
generated-p5qj07ef5ceqfktp5v8whw@chrome-store-foxified--505607522
generated-tuag2j5gwq73xzp8fbw3j8@chrome-store-foxified--505607522
generated-uj53d5j612ap5pz11hwgv2@chrome-store-foxified--505607522
{f51f0244-bfb0-40ce-bf9d-af49f5949e61}
{81751484-2dc9-47bf-aec3-b8e556237178}
{d89d1e20-57af-4164-82cc-650af45cf0a5}
{a5e28713-14c3-4967-befe-2ec253e317cd}
{335ac35b-6c16-4304-93f0-64a418e5bf81}
{d3fdb429-ef84-40a4-b160-010745ee0098}
{d66db057-7d38-4df4-a0ba-63c272be25ee}
{ff7f7151-09e3-4e35-9052-b21e23e7e2c1}
{1479da02-e759-4a6f-8f62-c08096583806}
{42d59cda-c117-459e-b244-1b850c27ccc9}
{bec48f33-7869-4158-8cbc-5cf1606f9afa}
{08ca656c-4973-46a8-85a9-3d771399c86e}
{dc5336c8-5624-4f74-a794-bb15f3760f34}
{6a3d97de-1b42-4624-880a-1a68bc917142}
{ad965166-3a34-449d-8230-a636fb5cae57}
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]

Comment 3

[Andreas Wagner [:TheOne] [use NI]]

The block has been staged. Philipp, can you please review and push?

Comment 4

[Philipp Kewisch [:Fallen] [:📆][:🧩]]

Done