736275 - Malicious "Flash Player" add-on

Status: RESOLVED FIXED

(Toolkit :: Blocklist Policy Requests, defect)

Description

[MarkH]

Attachment: 20120315_fb_video_update.zip

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_3) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.79 Safari/535.11

Steps to reproduce:

Downloaded the add-on from http://vidsforeveryone472.com/x/FacebookVideoUpdate.xpi


Actual results:

The add-on uses the contained, obfuscated, JS file "s.js" to harvest all of your Facebook cookies and post them to a 3rd party server.

Those cookies can be, and are being, used to hijack the user's account and spam Facebook users from their own servers.



Expected results:

It shouldn't steal your Facebook cookies and send them to a third-party server.

Comment 1

[Jorge Villalobos [:jorgev] (he/him)]

ID: [e-mail]

Comment 2

[Jorge Villalobos [:jorgev] (he/him)]

Blocked: https://addons.mozilla.org/en-US/firefox/blocked/i73

Comment 3

[McDillan]

another one... kindly block this one too.

http://updates.fasttrackonlinesurveys.com/x/FacebookVideoUpdate.xpi

Comment 4

[Jorge Villalobos [:jorgev] (he/him)]

(In reply to McDillan from comment #3)
> another one... kindly block this one too.
> 
> http://updates.fasttrackonlinesurveys.com/x/FacebookVideoUpdate.xpi

That add-on was already blocked on bug 736275.