Closed
Bug 739441
Opened 13 years ago
Closed 13 years ago
Malicious "Social Network Tools" add-on
Categories
(Toolkit :: Blocklist Policy Requests, defect)
Toolkit
Blocklist Policy Requests
Tracking
()
RESOLVED
FIXED
People
(Reporter: mhammell, Assigned: jorgev)
Details
Attachments
(1 file)
42.55 KB,
application/octet-stream
|
Details |
User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_3) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11
Steps to reproduce:
Downloaded plugin from http://niceoutlook.net/pp/profile.xpi
Actual results:
Uses http://verybigdays.net/connect.php as an update URL to download the
remote JS and configuration as a JSON blob and stores it in HTML5 local
storage.
This injects inline, base64 encoded JS, a hidden div tag, a hidden iframe,
and a hidden img tracker tag. The JS and div tag interact to create a
hidden overlay in the top left-hand corner of the webpages viewed by the
user.
The hidden layer is a series of nested tables, with embedded images and
links that are overlaid on the Facebook logo and user menu, clickjacking
the user's actions on Facebook.
Expected results:
It shouldn't inject a hidden layer on top of the web pages used by the viewer to hijack their actions.
Assignee | ||
Comment 1•13 years ago
|
||
Assignee: nobody → jorge
Status: UNCONFIRMED → ASSIGNED
Ever confirmed: true
Assignee | ||
Comment 2•13 years ago
|
||
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Updated•9 years ago
|
Product: addons.mozilla.org → Toolkit
You need to log in
before you can comment on or make changes to this bug.
Description
•