Last Comment Bug 739441 - Malicious "Social Network Tools" add-on
: Malicious "Social Network Tools" add-on
Product: Toolkit
Classification: Components
Component: Blocklisting (show other bugs)
: unspecified
: All All
-- normal (vote)
: ---
Assigned To: Jorge Villalobos [:jorgev]
: Jorge Villalobos [:jorgev]
Depends on:
  Show dependency treegraph
Reported: 2012-03-26 15:31 PDT by MarkH
Modified: 2016-03-07 15:30 PST (History)
4 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

Attachments (password 'infected') (42.55 KB, application/octet-stream)
2012-03-26 15:31 PDT, MarkH
no flags Details

Description User image MarkH 2012-03-26 15:31:05 PDT
Created attachment 609513 [details] (password 'infected')

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_3) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.83 Safari/535.11

Steps to reproduce:

Downloaded plugin from

Actual results:

Uses as an update URL to download the
remote JS and configuration as a JSON blob and stores it in HTML5 local

This injects inline, base64 encoded JS, a hidden div tag, a hidden iframe,
and a hidden img tracker tag.  The JS and div tag interact to create a
hidden overlay in the top left-hand corner of the webpages viewed by the

The hidden layer is a series of nested tables, with embedded images and
links that are overlaid on the Facebook logo and user menu, clickjacking
the user's actions on Facebook.

Expected results:

It shouldn't inject a hidden layer on top of the web pages used by the viewer to hijack their actions.
Comment 1 User image Jorge Villalobos [:jorgev] 2012-03-26 16:44:57 PDT
Comment 2 User image Jorge Villalobos [:jorgev] 2012-03-26 16:47:19 PDT

Note You need to log in before you can comment on or make changes to this bug.