1553857 - Extension Block Request: Easy Screenshot, Youtube Download*

Status: RESOLVED FIXED

(Toolkit :: Blocklist Policy Requests, task)

Description

[Rob Wu [:robwu]]

Extension name	Easy Screenshot, Youtube Download*
Extension versions affected	<all versions>
Platforms affected	<all platforms>
Block severity	hard

Reason

Sends login credentials to external servers upon form submission.

Extension IDs

{e7e68020-07de-4f9f-9aec-6df29e9f64b8}
{4a0d8618-3e21-4bb8-8ae3-d04316b55a1e}
{972319b8-8dd8-4ed0-8de2-9bc6582f0560}
{efdefbd4-5c30-42c3-ad2b-4c49082ec4cd}

Additional Information

{efdefbd4-5c30-42c3-ad2b-4c49082ec4cd} is already invisible on AMO, but version 6.6.3 is still not rejected/disabled.

In the order of the above add-on IDs, the malicious code is embedded at:
content/updates.js
content/updates.js
js/youtub.js
js/zr.js

Comment 1

[Philipp Kewisch [:Fallen] [:📆][:🧩]]

I’ve reviewed the add-on and confirmed that it is collecting ancillary user data against our policies.

Comment 2

[Philipp Kewisch [:Fallen] [:📆][:🧩]]

Full list:

{5768d1b3-4e2d-4088-bd65-c7a62353ea3a}
{65b99c4e-a9bb-4bb9-913d-503fa9bcdc46}
{31ebd11b-bb60-403b-94a9-e09a3bf7d64f}
{571339cd-9f45-47be-9476-767a62cb6c97}
{ed4f9665-1851-4398-ab15-46c5e3ab8fac}
{972319b8-8dd8-4ed0-8de2-9bc6582f0560}
{4a0d8618-3e21-4bb8-8ae3-d04316b55a1e}
[e-mail]
{8df3e056-6d4f-42fa-b0ad-40ee9a79d9c4}
{e7e68020-07de-4f9f-9aec-6df29e9f64b8}

Those not mentioned here are already blocked in other bugs.

Comment 3

[Philipp Kewisch [:Fallen] [:📆][:🧩]]

The block has been staged. Jorge, can you review and push?

Comment 4

[Jorge Villalobos [:jorgev] (he/him)]

Done.