Last Comment Bug 629717 - Blocklist 'Browser Update' extension
: Blocklist 'Browser Update' extension
Status: RESOLVED FIXED
:
Product: Toolkit
Classification: Components
Component: Blocklisting (show other bugs)
: unspecified
: All All
: -- critical (vote)
: ---
Assigned To: Justin Scott [:fligtar]
:
Mentors:
Depends on: 629808
Blocks:
  Show dependency treegraph
 
Reported: 2011-01-28 10:21 PST by Kevin Brosnan
Modified: 2016-03-07 15:30 PST (History)
13 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
Extension in question (18.96 KB, application/octet-stream)
2011-01-28 10:22 PST, Kevin Brosnan
no flags Details

Description Kevin Brosnan 2011-01-28 10:21:55 PST
This is an extension that a user on irc reported seeing at http://www.new-firefox.com From a quick look at the code it seems to screw with the user agent, replace Google ads and display popups. From what I can tell there are no beneficial aspects to this extension.

Going to check this on a VM in a bit.
Comment 1 Kevin Brosnan 2011-01-28 10:22:54 PST
Created attachment 507897 [details]
Extension in question
Comment 2 Justin Scott [:fligtar] 2011-01-28 11:16:31 PST
Will investigate.
Comment 3 Justin Scott [:fligtar] 2011-01-28 12:17:50 PST
I've looked at the source and played around with the add-on in a VM. As far as I can tell it:

* Sends every page URL you visit to a remote server
* Shows banner ads in Google search results
* Shows ads on your Facebook wall that look exactly like wall posts with a Facebook application authorization request (it's just a single image ad) -- would post screenshot but it has an inappropriate picture.

Given that it provides no value and is only adware/spyware, and that it is obtained from new-firefox.com with the likelyhood of making users think they're getting a Firefox update, I recommend we block it.

Does anyone disagree?

GUID is support@update-firefox.com
Comment 4 Kev Needham [:kev] 2011-01-28 12:20:50 PST
Block +
Comment 5 christian 2011-01-28 12:22:16 PST
Totally agree, let's hardblock it. Additionally, new-firefox.com and update-firefox.com redirect to scammy sites / parked pages so I don't think it would be worth it trying to reach out.
Comment 6 Fred Wenzel [:wenzel] 2011-01-28 12:30:48 PST
(In reply to comment #5)
> Totally agree, let's hardblock it. Additionally, new-firefox.com and
> update-firefox.com redirect to scammy sites / parked pages so I don't think it
> would be worth it trying to reach out.

You want to notify Legal though so they can claim these domains for trademark violation.
Comment 7 Kev Needham [:kev] 2011-01-28 12:33:03 PST
legal is aware on a separate bug.
Comment 8 Justin Scott [:fligtar] 2011-01-28 15:51:08 PST
Tested the XML below on staging and the block is ready to go as soon as bug 629808 updates mozilla.com.

<emItem id="support@update-firefox.com"/>
Comment 9 Soumya Deb [:Debloper] 2011-01-29 03:31:59 PST
After the blocking is done, it'd be convenient to also post a blog for general awareness to stay away from installing suspicious extensions/plugins. These blocked ones can also be mentioned as example with BIG RED NOTICE : "MALWARE, DON'T INSTALL". :P
Comment 10 mrezaei 2011-01-29 16:41:22 PST
In addition to new-firefox.com and update-firefox.com, a quick search on domain registrations shows other domains registered at the same time:
http://www.domaincom.org/view/90237.html

new-browser.com (also serves a firefox addon)
new-chrome.com (redirects to new-browser.com)
new-explorer.com
new-safari-update.com

as well as http://daily.domain-names-registered.com/2010-12-17-p99.html

www.update-explorer.com
www.update-chrome.com
www.update-safari.com
Comment 11 Justin Scott [:fligtar] 2011-01-31 16:24:34 PST
The add-on has been hard-blocked.
Comment 12 mikey.s 2011-06-09 05:16:48 PDT
hi i hate to be a pain but how do you get rid of this bug for my dad didnt realise it was a fake and clicked on it. i have deleted all downloads and checked add-ons but cant find it anywhere please help
Comment 13 Matthias Versen [:Matti] 2011-06-09 05:44:16 PDT
This extension is already blocked and you have a different issue and it's not related to this one.
Please use http://support.mozilla.com if you need help.
Comment 14 ahmed hamdy 2016-02-21 02:44:49 PST
This is an extension that a user on irc reported seeing at http://www.bramjtech.com From a quick look at the code it seems to screw with the user agent, replace Google ads and display popups. From what I can tell there are no beneficial aspects to this extension.

Going to check this on a VM in a bit.

Note You need to log in before you can comment on or make changes to this bug.