761050 - IETab Plus addon is hijacking ads

Status: RESOLVED WONTFIX

(addons.mozilla.org :: Security, defect)

Description

[Mike Hoye]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:15.0) Gecko/15.0 Firefox/15.0a1
Build ID: 20120603030523

Steps to reproduce:

Helping a fellow FF user with this question on Ask Metafilter: http://ask.metafilter.com/216931/Someone-is-inserting-ads-into-my-Firefox-Google-SERPs

Led me to find this: https://addons.mozilla.org/en-US/firefox/addon/ie-tab-plus-ff-36/reviews/

set of reviews noting that IE Tab Plus is engaging in underhanded, behavior, putting ads from the not-google-owned Google-co.com domain on your search result pages.

The gTranslator addon - https://addons.mozilla.org/en-US/firefox/addon/gtranslator/reviews/ - apparently does the same thing.



Actual results:

Underhanded behavior.


Expected results:

These addons are misdirecting users to ads hosted by a very spammy-looking domain.

Comment 1

[David.P]

I neither have IE Tab Plus nor gTranslator, but I still get those annoying ads.

They only appear after like a second at the top of the Google search results page, so very often when you want to click on one of the first couple of search results, you end up clicking on one of those ads.

Comment 2

[VinceH]

I have IE Tab Plus (now removed) and can confirm this is true. 

I assumed it was a new Google 'feature' until I noticed it wasn't on anyone elses screen.  This needs to be stamped out immediately.

Comment 3

[tenorsax]

I have removed IE Tabs Plus add-on, but I still have these

"http://google-co.com/xml/click/" ads displayed as text links appearing after a second on random google searches.

Comment 4

[Ari]

I had the same problem of hijacked google searches, and this was solved by removing IE Tab Plus.

I am a bit horrified that my firefox has been hijacked for such a long time, and also disappointed with mozilla for allowing this to happen, after one year of the issue being reported.

I can't help but wonder if this extension did more damage than just hijacking google searches - thumbs down to Mozilla's security review of add-ons.

The offending extension is still in Mozilla's add-on site!

https://addons.mozilla.org/en-US/firefox/addon/ie-tab-plus/


Mozilla security team: can you please take down the add-on and alert existing users.

Comment 5

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

This is not what the sec-review flag is for and the security team does not do take downs, that is an issue for the add-ons team to handle.

Comment 6

[tenorsax]

By using the Firefox element inspector on these ads, you can see the <div> type is ###vdls-advs , ###vdls-adv .   I googled these strings and found very little information, but I did see that the Fanboy's Adblock List filter set for Adblock Plus does block these as well as ###bottomads .

So, although my browser remains 'infected' (even though I have removed IE Tabs Plus) I have been able to block the ads using the Fanboy filter set.

Comment 7

[Jorge Villalobos [:jorgev] (he/him)]

(In reply to Mike Hoye from comment #0)
> Helping a fellow FF user with this question on Ask Metafilter:
> http://ask.metafilter.com/216931/Someone-is-inserting-ads-into-my-Firefox-
> Google-SERPs
> 
> Led me to find this:
> https://addons.mozilla.org/en-US/firefox/addon/ie-tab-plus-ff-36/reviews/

The add-on has been disabled on AMO for a while, and we won't blocklist it for only this reason. The only thing left for users to do is switch to the many other IE Tab alternatives, some of which are still being maintained.