1535088 - Extension Block Request: {3fab603e-3ee1-1222-a859-5f85a3441216}

Status: RESOLVED FIXED

(Toolkit :: Blocklist Policy Requests, task)

Description

[Zitronella]

Extension name	{3fab603e-3ee1-1222-a859-5f85a3441216}
Extension versions affected	<all versions>
Platforms affected	<all platforms>
Block severity	hard

Reason

decrypted script code. Force (specific referer/cookies are necassary to reproduce it) to install extension on website from hxxp://secure-addon.org/app ...

see also: hxxps://bugzilla.mozilla.org/show_bug.cgi?id=1491312
because it seems similar

Extension GUIDs

{3fab603e-3ee1-1222-a859-5f85a3441216}

Additional Information

Name: Add ѕeϲurіty
Version:2.3.1
see also: hxxps://bugzilla.mozilla.org/show_bug.cgi?id=1491312
because it seems similar

Comment 1

[FF]

Can you provide the exact page with the installation? Where did you get this add-on?

Comment 2

[Zitronella]

no, this is not possible because it depends on the referer, cookies and possibly other stuff. Also with me it shows now only a forwarding to nexus-nt.eu

Comment 3

[FF]

Can you send a screenshot? Do you have anything to confirm your bug?

Comment 4

[Zitronella]

I wrote it above. It is similar to https://bugzilla.mozilla.org/show_bug.cgi?id=1491312#c4
Have no Screenshot.

Comment 5

[FF]

What are the similarities? Can you tell what the addon is doing? Can you describe it in some way?

Comment 6

[sensible77]

I'm watching job You are doing guys and it's great.
But i'm wondering - how can you ban extensions without any prove and any analyze. You can't reproduce potential bad behavior, there's no screenshot or xpi file or installation webpage. In this threat - only explanation is that is similar to other ext. Developers are encrypting code to protect it not only for malicious purposes, in other case - lets ban all exts with obfuscated code.

Comment 7

[Andreas Wagner [:TheOne] [use NI]]

sensible77, the information in comment 0 are sufficient to start an investigation. Reviewers have access to the file based on the extension GUID. Before a block is being applied, a reviewer will verify that it meets the requirements for being blocked.

Comment 8

[sensible77]

Andreas - thank You for Your explanation, for me it's quite obvious that comment 0 is sufficient to start review. But how Reviewers comparing exts? do they deobsfucating code? I'm just courious is encrypted code enough to start review or ban ext?

(In reply to Andreas Wagner [:TheOne] [use NI] from comment #7)

sensible77, the information in comment 0 are sufficient to start an investigation. Reviewers have access to the file based on the extension GUID. Before a block is being applied, a reviewer will verify that it meets the requirements for being blocked.

Comment 9

[Andreas Wagner [:TheOne] [use NI]]

I am sorry this is getting quite off-topic for this bug. Feel free to continue this discussion on http://discourse.mozilla.org/c/add-ons . Generally, reviewers who handle these requests have the expertise to establish whether an extension is malicious or not.

Comment 10

[sensible77]

Sorry for bodder You. I'm moving to http://discourse.mozilla.org/c/add-ons then.
Have a nice day

(In reply to Andreas Wagner [:TheOne] [use NI] from comment #9)

Comment 11

[Andreas Wagner [:TheOne] [use NI]]

This is an empty add-on that doesn't do anything.

Comment 12

[Andreas Wagner [:TheOne] [use NI]]

Oh, actually, it's not empty.

Comment 14

[Andreas Wagner [:TheOne] [use NI]]

Clones:

{00b79649-3f0e-4b12-a8f0-376a7b2db716}
{1c3b247f-2ef4-4483-93a6-0a3da7bc3548}
{1cdb403e-11c7-421b-9c87-0c0d90263626}
{1d92fc5d-5353-401f-8c5f-373b3b6dae67}
{1db94c2f-d957-4b12-a1dc-903bb28f5ff5}
{1f6913f2-dead-4f96-bf96-0e64affd46ae}
{2aa8c5cd-18fa-4991-b354-d6f459efeca9}
{2b16f4ab-a2a9-43fd-8fd6-ad6f354b0d28}
{2e689bc0-735f-445c-bcc7-2cc495f5eb40}
{2f7d887c-7d56-41fa-bf9b-eadf6e500427}
{04acd977-4c2b-4162-af33-8c585bea90c5}
{5a24385f-ada4-455d-95ad-62cb6256360d}
{6aa47f05-1f3f-4798-908a-0ed01b2361e0}
{6c5cd693-2919-4458-b776-2ac5b6ab1cb0}
{06eea1e7-a8be-4794-8cd5-ed12e5f86161}
{6f4eff89-0e32-42bd-a5c1-354adc8417fd}
{7dc6d0d2-b2f0-4334-979d-6ebeff77785a}
{9ae8269f-eea1-4097-87fd-b7d2f102184d}
{9cee5c92-eb1e-4892-86ff-d2d1c627f5b9}
{9fa797e8-d7d4-4851-b7e9-76b61ecf046f}
{12f4cde8-7d1c-4a9e-9ef7-431f5ecd53a4}
{013d3691-0dd6-471b-bf0d-2750d7406a22}
{18a93813-7deb-40cf-b3a6-402369e6d817}
{33ef0e7b-15ea-4b08-a779-173731ac20b3}
{034d2b14-29e6-42ad-b2db-2c31286f3fb7}
{042c3065-1291-4409-bae5-8d11f3c268e2}
{94d8d504-838c-4392-9971-cd2f6e21ca21}
{97f88a13-5b79-4345-a85e-2560d54f577c}
{109adc7d-f308-43a5-aa0e-07ccdc5dad2c}
{126e7fc4-bf2d-4467-88b1-f3b17bc10da4}
{219a2146-5d9b-472a-8630-4c96a0994bec}
{482c54ae-e080-4596-bf7c-ae972fdff9a3}
{598d7ac6-1789-4573-ae6a-5798ed7f6d83}
{1688ecb0-e382-481f-8c70-541d70bdd2e9}
{2436dde0-3230-4933-9020-c15b3b9e693b}
{5683f95b-2517-4ca7-9d19-83d7f309b62a}
{6574bb31-c971-454f-b08c-a75bfee00855}
{7170e23c-c706-48a7-919f-c1c22548dbfb}
{8082ff2f-2151-4281-8134-1423e5961ca1}
{9332d73d-7991-46bf-8b67-6db1a21f0167}
{13623b47-de82-4226-85f8-d3ae343e619b}
{50993bc5-011c-4322-b522-41e6f3997163}
{87178fbe-17a5-4d8d-b5ed-48d17179b101}
{89096e44-c8b4-4ce5-aad2-f5bac765f608}
{4021839d-3f4a-4866-94fb-9fa809c5245b}
{04868575-532f-4b43-9325-7e707c109c25}
{77058195-5ae1-440c-8f86-c60a96d12ca9}
{a0361564-9461-4da0-8ec0-7dc6f418f707}
{ae73a262-1a27-4d1d-9be7-4b41a84dfd23}
{b9298a4a-acca-446d-aa72-d37f5e1576cd}
{b33715d3-eff8-4186-a252-0af5094b8644}
{c0eb4d03-d18e-40bf-b21b-8237ee1bed76}
{c12631ed-993a-4c2e-9bf0-37867ae40491}
{cb1c544e-d444-4c85-8224-64aa26e82230}
{cbe9b620-fac0-407a-b3be-b0a61b319ef8}
{cea21739-b9ce-46c7-ad3e-3607b1ff6538}
{d0513185-1f20-4045-a232-f3a4252af379}
{d604961b-3a3d-4f60-87ae-35977c10b787}
{daacefee-aaba-4f10-8d4d-059904d8a153}
{db7b6ea7-2605-44c7-807b-2419d7eec531}
{dcb556aa-ef6e-4778-9f60-c5ae18a72cfb}
{e8a81b54-3728-4a9c-8c63-18ef803ef9be}
{eb7aff78-6145-4a31-a7f5-f3c353ddb312}
{f5fa0bfe-a981-48ff-b809-8faa3126f0bc}
{f7b9f777-7b01-4f73-8eb8-f2ad85d4da1c}
{f010d9e9-0878-4c83-af45-df966cbe8d26}

Blocklist reasons:

• Search hijacking
• User tracking

Comment 15

[Andreas Wagner [:TheOne] [use NI]]

The block has been staged. Jorge, can you please review and push?

Comment 16

[Jorge Villalobos [:jorgev] (he/him)]

Done.