847018 - Blocklist a fake Flash extension that is in fact a malware

Status: RESOLVED FIXED

(Toolkit :: Blocklist Policy Requests, defect)

Description

[Underpass]

User Agent: Mozilla/5.0 (X11; Linux i686; rv:20.0) Gecko/20100101 Firefox/20.0
Build ID: 20130227063501

Steps to reproduce:

One of my Facebook contacts tagged me in a post leading to this website

http://www.xn--47aaeabb.net/

redirecting to

http://www.sosyalaghileleri.com/firefox.php

It used have a fake Flash video and a notation saying that the Flashplayer installed on the system is obsolete and should be updated. It also provides the link to a fake extension. If you install it, your Facebook account becomes compromised and starts to spread the same link tagging other contacts, harvesting them from the list of your Facebook friends and thus propagating the "infection".
I also have a copy of the fake extension (downloaded but not installed) and I can upload it if necessary.

The website should be marked as dangerous. The extension should be blocklisted as soon as possible. This malware is increasingly spreading on Facebook in the last few days.

Thanks

Comment 1

[Kris Maglione [:kmag]]

The first link redirects me to chrome.php, and nothing on chrome.php or firefox.php seems to work. Can you upload the extension that you mentioned?

Comment 2

[Underpass]

Hello, sorry for my late answer. Probably the DNS you are using somehow block the page since I'm perfectly seeing the fake extension download link.
Anyway, I'm uploading it. Thanks.

Comment 3

[Underpass]

Attachment: Rename .ZIP to .XPI to install

Comment 4

[Kris Maglione [:kmag]]

Well, the add-on linked definitely appears to be malicious. It's name and description are "Adobe Flash Player", and all it does is inject a remote script into every page. The URL for the script doesn't actually work, though.

ID: jid0-Y6TVIzs0r7r4xkOogmJPNAGFGBw@jetpack

Comment 5

[Kris Maglione [:kmag]]

This is also on AMO (not masquerading as Flash): https://addons.mozilla.org/addon/sosyal-medya/

Comment 6

[Underpass]

Probably they plan to redirect somewhere else

Comment 7

[Jorge Villalobos [:jorgev] (he/him)]

Blocked: https://addons.mozilla.org/en-US/firefox/blocked/i322

Comment 8

[Scoobidiver (away)]

(In reply to Jorge Villalobos [:jorgev] from comment #7)
> Blocked: https://addons.mozilla.org/en-US/firefox/blocked/i322
Typo in "pretending to the the Flash Player plugin."

Comment 9

[Jorge Villalobos [:jorgev] (he/him)]

(In reply to Scoobidiver from comment #8)
> (In reply to Jorge Villalobos [:jorgev] from comment #7)
> > Blocked: https://addons.mozilla.org/en-US/firefox/blocked/i322
> Typo in "pretending to the the Flash Player plugin."

Fixed, thanks.