842402 - Block more malicious Codec add-ons

Status: RESOLVED WONTFIX

(Toolkit :: Blocklist Policy Requests, defect)

Description

[Jorge Villalobos [:jorgev] (he/him)]

We need to follow up bug 806451 because there is a whole category of malicious ids that wasn't covered there. These come in the form [0-9a-f]{13}@[0-9a-f]{13}\.com, which we can now verify is pretty safe to block without collateral damage.

Since this is a major block, we will go through staging and some testing before pushing it live.

Comment 1

[Jorge Villalobos [:jorgev] (he/him)]

The block is staged now: https://addons-dev.allizom.org/en-US/firefox/blocked/i279

Kris, can you give this a look and make sure it works as expected?

Comment 2

[Kris Maglione [:kmag]]

The regexp should probably have a $ at the end. Other than that, I tested with one of the known IDs and it worked as expected.

Comment 3

[Jorge Villalobos [:jorgev] (he/him)]

Blocked: https://addons.mozilla.org/en-US/firefox/blocked/i288

Comment 4

[Jorge Villalobos [:jorgev] (he/him)]

Apparently these IDs are being generated by a platform called justplug.it, whose creators just contacted me. I'm backing out this block while we investigate.

Comment 5

[Jorge Villalobos [:jorgev] (he/him)]

It looks like most of these IDs correspond to their add-ons, since they are generating a new ID for every XPI :(. I met with them and we're following up with policy compliance issues via email. If that doesn't lead anywhere I'll file a new block bug.