979856 - Bypassing addon installation [Trusted Shopper Adware]

Status: RESOLVED FIXED

(Toolkit :: Blocklist Policy Requests, defect)

Description

[Toady]

Attachment: [Warning]-trusted shopper.zip

User Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:27.0) Gecko/39237369 Firefox/27.0 (Nightly/Aurora)
Build ID: 20140217134052

Steps to reproduce:

Program installer origin unknown it was packaged in a shark007 codec pack for windows 7.

The item TrustedShopper firefox addon by TrustedWeb produced by squeakychocolate (Malicious Adware)






Actual results:

This addon is part of trusted shopper adware that targets ie, firefox, chrome, safari & opera, It overlays ad's across the entire content area of the browser and for each tab open.

The firefox addon component bypasses standard addon installation alerts (No messages, Prompts or Notifications of its installation into firefox) only visible sign is every browser tab hijacked with ad's


I recommend add to block list hard and soft, It also utilizes the update mechanisms through there own hosting with a constant changing GUID.

Attached you will find 80% of the programs registry entries, Screen shot of its installed .dll files and the trusted shopper xpi 

Unfortunately i can not recovery of any further information from the affected PC as its been wiped clean.


Expected results:

A form of notification should have alerted the user of an addon installation.
Should have been blocked by a security measure.

Comment 1

[Benjamin Smedberg]

    <em:id>jid1-bKSXgRwy1UQeRA@jetpack</em:id>
    <em:version>2.0.1</em:version>
    <em:name>TrustedShopper</em:name>
    <em:description>Coupons and deals to help you get the best deals!</em:description>
    <em:creator>TrustedWeb</em:creator>
    <em:optionsType>2</em:optionsType>
	<em:updateURL>http://cdn.trustedshopper.net/trustedshopper/ff/update.rdf</em:updateURL>
    <em:updateKey>MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDLyedVuUuVZTMaJtAk4yFUdBPCpkWCo9BQ34YITDpuJSZi3I6vhR9oRCv9URMAJk4kkfWrYZMut2IPRhtIqlT17+QuHHh1rTPFkV/HTz1lxT4V0gw5+1zzAvVGEWMiQTPQFLizC6nFOa2xDzeFzsYqPxz2Y5X+/AbNKDY+aMmSwwIDAQAB"</em:updateKey>

Comment 2

[Wiliam Tweedy]

[Tracking Requested - why for this release]:

Comment 3

[Jorge Villalobos [:jorgev] (he/him)]

Kris, please confirm this report and let us know what its usage stats are looking like.

Comment 4

[Kris Maglione [:kmag]]

I happened to test the installer in question yesterday for unrelated reasons. It currently installs a search hijacker called Astromenda, and another shopping add-on called Deal Keeper, but not TrustedShopper.

In any case, metrics strongly suggest that TrustedShopper is a third-party silent install, so it should be blocked.

Comment 5

[Jorge Villalobos [:jorgev] (he/him)]

Blocked: https://addons.mozilla.org/en-US/firefox/blocked/i680