943194 - MaganiPieC extensions adds "remove" metho to Array type

Status: RESOLVED INVALID

(Toolkit :: Blocklist Policy Requests, defect)

Description

[Pierre Renaux]

Attachment: MaganiPieC-adds-remove-to-Array-type.jpg

User Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1621.0 Safari/537.36

Steps to reproduce:

MaganiPieC extension got installed on my computer silently, really not sure how.


Actual results:

A method "remove" gets added to the Array type:
for(var e in ["alpha","beta"]) { console.log("E:" + e); }
Prints:
"E:0"
"E:1"
"E:remove"


Expected results:

MaganiPieC should be blacklisted it looks like a Trojan, it also does a lot of request on ads site before the actual page loads.

Comment 1

[Jorge Villalobos [:jorgev] (he/him)]

Can you give us the add-on ID? It can be found in about:support.

Comment 2

[Pierre Renaux]

Attachment: MaganiPieC.dat

Comment 3

[Pierre Renaux]

I'm sorry I already removed it from my installation. It was an extension, not a plug-in.

Not sure if it will help but I've uploaded the only file remnant that was still on my HDD.

Its related to this I think: https://forums.malwarebytes.org/index.php?showtopic=123963. I used "Privitize VPN" while in China, I suppose that's how it got installed.

Comment 4

[Jorge Villalobos [:jorgev] (he/him)]

Found a couple of references to it:
https://support.mozilla.org/en-US/questions/951822
https://support.mozilla.org/en-US/questions/968380

And 3 different IDs :(

[e-mail]
[e-mail]
[e-mail]

However, they seem to follow a simple pattern. Kris, can you check this out and see install numbers and whether it's worth blocking by regexp?

Comment 5

[Kris Maglione [:kmag]]

We've tried to block IDs with these patterns before and wound up reverting them. It also seems that this add-on is going by IDs with multiple other ID patterns and names, e.g.,

[e-mail]	MaganiiPic
[e-mail]	MaganiiPic
[e-mail]	MaganiPic
[e-mail]	MaganiPic
[e-mail]	MaganiPiec
[e-mail]	MaganiPiec

Comment 6

[Jorge Villalobos [:jorgev] (he/him)]

Alright, let's keep this bug open until we can block this based on name patterns.

Comment 7

[Jorge Villalobos [:jorgev] (he/him)]

Closing old blocklist requests that shouldn't be valid after the move to WebExtensions-only in Firefox 57. Please comment if you think this bug is still valid and should be reopened.