1628844 - Suspicious and inconsistent "Changes to Device" request

Status: RESOLVED INCOMPLETE

(Toolkit :: Application Update, defect, P3)

Description

[jdgeci]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0

Steps to reproduce:

Open firefox, after unexpected lapse in traffic

Actual results:

A windows notification "requesting permission to make changes to this device" prompt appears, tabbing away from or closing the prompt still triggers approve option. No subsequent observable behavior.

Expected results:

Firefox already has permission it needs, not configured to prompt on future updates, should not prompt as it did. Logo on "Firefox Software Updater" was not standard Firefox logo.

Suspicious behavior, suspected infection within/utilizing Firefox install files

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Bugbug thinks this bug should belong to this component, but please revert this change in case of error.

Comment 2

[Rachel Tublitz [:rachel]]

Attachment: Screen Shot 2020-04-09 at 5.31.58 PM.png

Thanks for reporting! To confirm, did the notification you saw look something like this one?

Comment 3

[jdgeci]

(In reply to Rachel Tublitz [:rachel] from comment #2)

Created attachment 9139604 [details]
Screen Shot 2020-04-09 at 5.31.58 PM.png

Thanks for reporting! To confirm, did the notification you saw look something like this one?

Yes, thats the correct Icon. It was not Nightly Software Updater, it just said "Firefox Software Updater"

Comment 4

[Firefox Bug Husbandry Bot]

Because this bug's Severity has not been changed from the default since it was filed, and it's Priority is -- (Backlog,) indicating it has has not been previously triaged, the bug's Severity is being updated to -- (default, untriaged.)

Comment 5

[Adam Gashlin (he/him) [:agashlin] (ex-moco)]

I have a few questions to try figure out what's going on here. This prompt shows up if the updater isn't able to write to the Firefox installation directory. Normally it will try to use the maintenance service, which uses the permission that you granted when installing to perform those writes. Sometimes this doesn't work, though, in which case the updater will ask for permission again.

Does this occur before starting Firefox, or does the message show up when Firefox is already running?

Where is Firefox installed? If you don't know this offhand you can find it by entering about:support in the location bar and looking at the "Application Binary" row, mine says "C:\Program Files\Mozilla Firefox\firefox.exe".

Please look in the C:\ProgramData\Mozilla\updates folder, it will have a folder named something like 308046B0AF4A39CB, and that should itself contain a folder called updates (so the whole path is something likeC:\ProgramData\Mozilla\updates\308046B0AF4A39CB\updates). In that folder please find the last-update.log and backup-update.log files and attach them to this bug.

Also please attachC:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log. These logs may indicate what errors the maintenance service or updater encountered.

Comment 6

[Adam Gashlin (he/him) [:agashlin] (ex-moco)]

There are a few reasons why this could have been appearing, some of which were resolve in bug 1682810. As we don't have more information about this particular report I'm closing it.