713050 - Malicious "Free Cheesecake Factory" Add-On

Status: RESOLVED FIXED

(Toolkit :: Blocklist Policy Requests, defect)

Description

[MarkH]

Attachment: malicious_addon.zip

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_2) AppleWebKit/535.7 (KHTML, like Gecko) Chrome/16.0.912.63 Safari/535.7

Steps to reproduce:

The third-party add-on "Free Cheesecake Factory" is malicious is actively generating spam on Facebook.  It steals the user's browser cookies for Facebook and sends out numerous messages on the users behalf.  It also takes actions to hide its activity by injecting an overlay image into the DOM when the user attempts to view their news feed in Facebook.  The malicious plugin and the JS files it loads remotely are attached.



Actual results:

Installed the malicious "Free Cheesecake Factory" add-on and it resulting in spam being posted to a Facebook account.

Comment 1

[Jorge Villalobos [:jorgev] (he/him)]

Id: [e-mail]

Comment 2

[Justin Scott [:fligtar]]

UUID [e-mail]

Comment 3

[Justin Scott [:fligtar]]

yes, I midaired you and didn't care :p

Comment 4

[Justin Scott [:fligtar]]

Blocked in production.

https://addons.mozilla.org/en-US/firefox/blocked/i47

Comment 5

[Justin Scott [:fligtar]]

Yikes, this add-on had 600,000 users and was growing about 50,000 per day until it was blocked.

Comment 6

[Justin Scott [:fligtar]]

Please file these bugs in Blocklisting component in the future.