873384 - Mcafee SiteAdvisor hides itself from plugin page with css to stop user disabling it

Status: RESOLVED WONTFIX

(Toolkit :: Blocklist Policy Requests, defect)

Description

[girish.gopi]

Attachment: Screenshot of add-on manager with style editor open; showing the plugin hiding css file

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:22.0) Gecko/20100101 Firefox/22.0 (Beta/Release)
Build ID: 20130514181517

Steps to reproduce:

This is a corporate PC and has Mcafee Siteadvisor installed. Until today, the only browser plugin as was internet explorer that I used just for the internal sharepoint sites. When firefox beta updated itself to v22, I noticed that there was a ugly Mcafee button in the titlebar.

I attempted to disable Mcafee Siteadvisor in Firefox's Add-ons page


Actual results:

McAfee Siteadvisor is not in the list of plugins in the add-on's manager making it hard for me to disable it. about:plugins clearly showed that it was loaded and running.


Expected results:

Siteadvisor should've been visible in the list of plugins to allow a user to disable a currently loaded plugin.

Opening the style inspector on the add-on's page shows a css file loaded that hides the SiteAdvisor plugin from view (see attached screenshot).

Also, the plugin seems to be present in the Mozilla Firefox\distribution\bundles\ directory and I did not get any notification that the plugin was installed. It was obvious that firefox was running a third-party plugin because of the obnoxious button on the titlebar. But this seems to be a security risk (only for users running as admin, I guess) if it's possible to install a plugin with no notification, which is invisible in the add-on manager

Comment 1

[girish.gopi]

Additional info:
Deleting the display: none; 's from the style editor made the add-on's visible and allowed me to disable the plugin. But this is not something a normal user would do (especially if a malicious add-on did not indicate it was currently running)

Comment 2

[Georg Fritzsche [:gfritzsche]]

Hm, that's not nice.
Benjamin or Jorge, is an addon unannouncedly hiding its "private" plugins acceptable under the addon policy?

Comment 3

[Georg Fritzsche [:gfritzsche]]

Girish, could you copy the data from the plugins entry on about:plugins in case it is needed for further actions?

Comment 4

[girish.gopi]

Attachment: current about:plugins from my install

about:plugins output attached as per request

Comment 5

[Benjamin Smedberg]

There are some things I'd like to understand here. I suspect that the McAfee SiteAdvisor plugin is basically just an implementation detail of the SiteAdvisor extension/toolbar. It probably is never meant to be used by web pages directly.

If the plugin is contained within the extension package, disabling the SiteAdvisor extension will also disable SiteAdvisor NPAPI plugin. In this case I think that their current behavior is kinda reasonable. Disabling the NPAPI plugin will probably leave the extension in a broken state.

Can you state whether you have a SiteAdvisor extension present in the addons manager? And if so, can we determine whether it's install location is C:\Program Files (x86)\McAfee\SiteAdvisor Enterprise or some other location?

Does anyone know what this plugin is actually used for?

Comment 6

[girish.gopi]

Attachment: Internet Explorer with Siteadvisor plugin

That's what initially threw me. There is no SiteAdvisor "extension" listed in the addon manager's "extension" list. All the publicly available info points to just removing the extension to uninstall the plugin; but there doesn't seem to be an "extension"(at least on my install here) -- just the plugin.

>>Can you state whether you have a SiteAdvisor extension present in the addons manager
No. I do not.

>>can we determine whether it's install location is C:\Program Files (x86)\McAfee\SiteAdvisor Enterprise
Well, that directory exists and it's how I originally thought to look for the css file (I stumbled upon SAEPPluginAddOn.css in C:\Program Files (x86)\McAfee\SiteAdvisor Enterprise\scripts which seemed to do the display hiding -- which then prompted me to pull up Style Editor in Firefox's AddOn page)

>>Does anyone know what this plugin is actually used for?
As far as I can tell, it logs all pages visited and gives them a rating for malicious content. Presumably it blocks certain pages too (but as it's a work PC, I don't want to push it too hard) -- I'm unsure if it's comparing with a local blacklist or reporting page visits to Mcafee (as it automatically gives me a green/amber/red on all pages, I assume it can't have a massive local blacklist)
When performing google searches, it also seems to embed "ticks" next to the links.
Screenshot of the plugin in action on Internet Explorer attached. Behavious seemed broadly the same on Firefox

Comment 7

[girish.gopi]

Additional note:
>>I suspect that the McAfee SiteAdvisor plugin is basically just an implementation detail of the SiteAdvisor extension/toolbar.
>>In this case I think that their current behavior is kinda reasonable

Even if your assumption was correct (about the plugin being an implementation detail of their extension -- and I stress, in this case there does not seem to be an extension); I still think this is not Ideal behaviour. 

Say, an ISP's setup package that the user runs on their computer surreptitiously adds a monitoring plugin. Do we not think it should somehow be harder for the software to cover it's tracks, allowing the user to know that firefox is running a plugin? If not from a security point of view, then atleast from the fact that there may be fewer bug reports due to misbehaving plugins if the user can easily check the list of running ones (I realise about:plugins shows this list, but it is more of a "hidden" page)

OK, better question: Why did firefox not prompt me on startup that it was loading a plugin that had been installed since the last time (which had not explicitly been authorised by the user) I'm sure a change to notify about new extensions on startup was rolled out sometime back; I guess not for plugins?

Comment 8

[Benjamin Smedberg]

Well hrm. The fact that we're loading a stylesheet from chrome://saff means that siteadvisor is loading some "extension-like" content into Firefox and not just this plugin.

I wonder if they also hid their extension in the addon manager using the same CSS trick? If so that would be a significant violation of trust. Can you check about:support for any siteadvisor-related entries in the extensions list?

Comment 9

[girish.gopi]

Attachment: My about:support page

Nothing with Mcafee or siteadvisor or anything else there (attached if you want to re-confirm)

The css file does have two entries. The first one hides the plugin from the list. I'm not sure what the second one does (it suggests it's hiding the actual extension, but I can't see it anyway?)

--------
Content of SAEPPluginAddOn.css
--------


/* Hide SAE Plugin */
/* It should match the name displayed on about:plugins */
richlistitem[name="SiteAdvisor Enterprise"]
{
  display: none;
}

/* Hide the add-on itself */
/* This ensures someone disable the add-on and then disable the plugin */
richlistitem[addonID="{B7082FAA-CB62-4872-9106-E42DD88EDE45}"],
richlistitem[value="SiteAdvisor Enterprise"] {
  display: none;
}

Comment 10

[girish.gopi]

Attachment: about:support after enabling siteadvisor

Just to ensure that the extension had not gone due to me disabling the plugin, I re-enabled the plugin, restarted firefox and re-checked (new about:support attached) -- this time the plugin says it's enabled, but the page otherwise seem to be the same?

Comment 11

[Blair McBride [:Unfocused] (UNAVAILABLE)]

(In reply to girish.gopi from comment #0)
> Also, the plugin seems to be present in the Mozilla
> Firefox\distribution\bundles\ directory and I did not get any notification
> that the plugin was installed. It was obvious that firefox was running a
> third-party plugin because of the obnoxious button on the titlebar. But this
> seems to be a security risk (only for users running as admin, I guess) if
> it's possible to install a plugin with no notification, which is invisible
> in the add-on manager

If the extension was put in /bundles/, then it won't show up in the Add-ons Manager - anything there is loaded automatically, and not managed by the Add-ons Manager. It's intended for custom deployments, not for 3rd party vendors to dump their add-on (I've been wondering about removing support for /bundles/ for this type of reason).

We should reach out to McAfee to ask them about this. Jorge?

Comment 12

[Jorge Villalobos [:jorgev] (he/him)]

(In reply to Blair McBride [:Unfocused] (Limited availability.) from comment #11)
> 
> We should reach out to McAfee to ask them about this. Jorge?

Yeah, anything they're doing that hides the add-on in the Add-on Manager window violates our Add-on Guidelines, so they should fix it ASAP. I'll try to get in touch with them.

Comment 13

[Georg Fritzsche [:gfritzsche]]

(In reply to Jorge Villalobos [:jorgev] from comment #12)
> Yeah, anything they're doing that hides the add-on in the Add-on Manager
> window violates our Add-on Guidelines, so they should fix it ASAP. I'll try
> to get in touch with them.

Sounds like this is a better fit for TechEvangelism::Addons then? Not sure about this.

Comment 14

[girish.gopi]

>>violates our Add-on Guidelines, so they should fix it ASAP
>>Sounds like this is a better fit for TechEvangelism::Addons then?
I realise this'll just make Mozilla play whack-a-mole with third party add-on developers constantly finding workarounds; but shouldn't there be a change to Firefox to not load additional css files when displaying the add-on's page? (in addition to talking to McAfee about not violating user-trust in this case)

>>I've been wondering about removing support for /bundles/ for this type of reason
Sounds like a good idea. Does this need a new bug report? Anything else I can do to help?

Comment 15

[Jorge Villalobos [:jorgev] (he/him)]

Can someone please verify if this is still the case with the latest version of the add-on?

Comment 16

[girish.gopi]

Hi,

The add-on still uses a css file to hide it's existence from the list of plugins in firefox.
Current plugin version: 3.5.0.724
Current firefox version: 24.0

Comment 17

[Jorge Villalobos [:jorgev] (he/him)]

Sorry for the delays, I'm following up with them again.

Comment 18

[Jorge Villalobos [:jorgev] (he/him)]

I missed the fact that this is a corporate deployment we're talking about. Our usual rules don't apply in these cases since corporate networks are controlled by network admins and they define the policies for things like this.

I heard back from McAfee and they pointed out that this is done in the Enterprise version of their add-on. I'm waiting to hear back from them about their other product lines to confirm that this only happens in enterprise settings.

Girish, can you confirm that you're using the Enterprise version of McAfee?

Comment 19

[girish.gopi]

Hi Jorge,

Yes, it's the Enterprise version of Mcafee.
While I understand your rationale of Mozilla's usual rules not applying to corporate installs, the original bug was that this demonstrates a way for plugins to install themselves without firefox notifying the user that a plugin has been installed?

In reply to Blair McBride [:Unfocused] from comment #11)
> [...] It's intended for custom deployments, not for 3rd party
> vendors to dump their add-on (I've been wondering about removing support for
> /bundles/ for this type of reason).
> 

My real beef if not that my internal IT policy pushes the McAfee plugin or with McAfee themselves; just that the plugin was so well hidden and Firefox appeared to provide a sanctioned way for plugins to install themselves without user visibility.

Comment 20

[Jorge Villalobos [:jorgev] (he/him)]

(In reply to girish.gopi from comment #19)
> Hi Jorge,
> 
> Yes, it's the Enterprise version of Mcafee.
> While I understand your rationale of Mozilla's usual rules not applying to
> corporate installs, the original bug was that this demonstrates a way for
> plugins to install themselves without firefox notifying the user that a
> plugin has been installed?

We know that's possible, and there are way worse things add-ons can do. At the moment we don't have any way to prevent add-ons from messing with the Add-ons Manager and hide themselves. In this case it is somewhat justified.

> In reply to Blair McBride [:Unfocused] from comment #11)
> > [...] It's intended for custom deployments, not for 3rd party
> > vendors to dump their add-on (I've been wondering about removing support for
> > /bundles/ for this type of reason).
> > 
> 
> My real beef if not that my internal IT policy pushes the McAfee plugin or
> with McAfee themselves; just that the plugin was so well hidden and Firefox
> appeared to provide a sanctioned way for plugins to install themselves
> without user visibility.

Firefox doesn't provide a sanctioned mechanism for add-ons to hide themselves, but it's possible and not very hard to do. In general, an add-on that does this qualifies for blocklisting, but corporate add-ons are an exception to this rule.

I don't see any further action to take here.