935779 - Blocklist add-ons site-installed by rogue Firefox installer.

Status: VERIFIED FIXED

(Toolkit :: Blocklist Policy Requests, defect)

Description

[Kris Maglione [:kmag]]

A Firefox installer distributed from http://firefox.begin.pro/en/?p=US-SOFT bundles a large number of malware extensions. One of them even hides the presence of any add-ons from the extension manager.

IDs:

[e-mail]
[e-mail]
[e-mail]
[e-mail]
{81b13b5d-fba1-49fd-9a6b-189483ac548a}
{906000a4-88d9-4d52-b209-7a772970d91f}
{B21F5E31-B8E8-41CD-B74C-168A71A10E49}

Comment 1

[Kris Maglione [:kmag]]

It also looks like {81b13b5d-fba1-49fd-9a6b-189483ac548a}, which is for the PassWidget add-on, may be randomly generated.

Comment 2

[Jorge Villalobos [:jorgev] (he/him)]

Blocked:
https://addons.mozilla.org/firefox/blocked/i469
https://addons.mozilla.org/firefox/blocked/i470
https://addons.mozilla.org/firefox/blocked/i471
https://addons.mozilla.org/firefox/blocked/i472
https://addons.mozilla.org/firefox/blocked/i473
https://addons.mozilla.org/firefox/blocked/i474
https://addons.mozilla.org/firefox/blocked/i475

Comment 3

[Mike Kaply [:mkaply]]

Should this site be reported to legal?

Comment 4

[Jorge Villalobos [:jorgev] (he/him)]

That's what bug 936260 is about.

Comment 5

[Iulian Timis]

Verified as fixed in 
https://addons.mozilla.org/firefox/blocked/i469
https://addons.mozilla.org/firefox/blocked/i470
https://addons.mozilla.org/firefox/blocked/i471
https://addons.mozilla.org/firefox/blocked/i472
https://addons.mozilla.org/firefox/blocked/i473
https://addons.mozilla.org/firefox/blocked/i474
https://addons.mozilla.org/firefox/blocked/i475
on FF25 (Win 7).
Closing bug.

Comment 6

[Jorge Villalobos [:jorgev] (he/him)]

Block 475 (ID {B21F5E31-B8E8-41CD-B74C-168A71A10E49}) has been reverted as we have been contacted by the owners of the extension (CBS Interactive) and they had already terminated their relationship with the distributor of the dubious installer.