781088 - Malicious "Youtube" addon

Status: VERIFIED FIXED

(Toolkit :: Blocklist Policy Requests, defect)

Description

[MarkH]

Attachment: 20120807_video4552_m.zip (password malwares4mple)

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_4) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.57 Safari/537.1

Steps to reproduce:

Installed the attached add-on


Actual results:

Analysis of plugin.xpi:

Injects youtube.js from within the addon

youtube.js:
Injects http://feedbuzz.info/js.php

js.php:
Uses one of these two for its spam link
blogs[0] = 'http://youtube-snakes.tumblr.com/?';
blogs[1] = 'https://dl.dropbox.com/u/76699623/Youtube/Youtube%20theme.html/?';

Posts spam to Facebook via the following endpoints on FB:
http://www.facebook.com/ajax/connect/external_edge_comment.php
http://www.facebook.com/ajax/connect/external_node_connect.php



Expected results:

It should not steal information from your Facebook session and then spam your friends, without your consent.

Comment 1

[Jorge Villalobos [:jorgev] (he/him)]

Blocked: https://addons.mozilla.org/en-US/firefox/blocked/i374

Comment 2

[Iulian Timis]

Verified as fixed in https://addons.mozilla.org/ on FF21 (Win 7).
The add-on has been blocked.
Closing bug.