629717 - Blocklist 'Browser Update' extension

Status: RESOLVED FIXED

(Toolkit :: Blocklist Policy Requests, defect)

Description

[Kevin Brosnan]

This is an extension that a user on irc reported seeing at http://www.new-firefox.com From a quick look at the code it seems to screw with the user agent, replace Google ads and display popups. From what I can tell there are no beneficial aspects to this extension.

Going to check this on a VM in a bit.

Comment 1

[Kevin Brosnan]

Attachment: Extension in question

Comment 2

[Justin Scott [:fligtar]]

Will investigate.

Comment 3

[Justin Scott [:fligtar]]

I've looked at the source and played around with the add-on in a VM. As far as I can tell it:

* Sends every page URL you visit to a remote server
* Shows banner ads in Google search results
* Shows ads on your Facebook wall that look exactly like wall posts with a Facebook application authorization request (it's just a single image ad) -- would post screenshot but it has an inappropriate picture.

Given that it provides no value and is only adware/spyware, and that it is obtained from new-firefox.com with the likelyhood of making users think they're getting a Firefox update, I recommend we block it.

Does anyone disagree?

GUID is [e-mail]

Comment 4

[Kev Needham [:kev]]

Block +

Comment 5

[LegNeato]

Totally agree, let's hardblock it. Additionally, new-firefox.com and update-firefox.com redirect to scammy sites / parked pages so I don't think it would be worth it trying to reach out.

Comment 6

[Fred Wenzel [:wenzel]]

(In reply to comment #5)
> Totally agree, let's hardblock it. Additionally, new-firefox.com and
> update-firefox.com redirect to scammy sites / parked pages so I don't think it
> would be worth it trying to reach out.

You want to notify Legal though so they can claim these domains for trademark violation.

Comment 7

[Kev Needham [:kev]]

legal is aware on a separate bug.

Comment 8

[Justin Scott [:fligtar]]

Tested the XML below on staging and the block is ready to go as soon as bug 629808 updates mozilla.com.

<emItem id="[e-mail]"/>

Comment 9

[Soumya Deb [:Debloper]]

After the blocking is done, it'd be convenient to also post a blog for general awareness to stay away from installing suspicious extensions/plugins. These blocked ones can also be mentioned as example with BIG RED NOTICE : "MALWARE, DON'T INSTALL". :P

Comment 10

[mrezaei]

In addition to new-firefox.com and update-firefox.com, a quick search on domain registrations shows other domains registered at the same time:
http://www.domaincom.org/view/90237.html

new-browser.com (also serves a firefox addon)
new-chrome.com (redirects to new-browser.com)
new-explorer.com
new-safari-update.com

as well as http://daily.domain-names-registered.com/2010-12-17-p99.html

www.update-explorer.com
www.update-chrome.com
www.update-safari.com

Comment 11

[Justin Scott [:fligtar]]

The add-on has been hard-blocked.

Comment 12

[mikey.s]

hi i hate to be a pain but how do you get rid of this bug for my dad didnt realise it was a fake and clicked on it. i have deleted all downloads and checked add-ons but cant find it anywhere please help

Comment 13

[Matthias Versen [:Matti]]

This extension is already blocked and you have a different issue and it's not related to this one.
Please use http://support.mozilla.com if you need help.

Comment 14

[ahmed hamdy]

This is an extension that a user on irc reported seeing at http://www.bramjtech.com From a quick look at the code it seems to screw with the user agent, replace Google ads and display popups. From what I can tell there are no beneficial aspects to this extension.

Going to check this on a VM in a bit.