Vulnerabilities / Threats
2/5/2010
06:08 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Mozilla Removes Two Malicious Firefox Add-Ons

About 4,600 Windows users appear to have downloaded the infected software.

Mozilla on Friday said that it had removed two Firefox add-ons from its Web site because they installed malware.

"Two add-ons in the experimental section of addons.mozilla.org were found to be containing malware," Mozilla said on its security blog. "These were not originally detected with the anti-malware scanning tools that we have been using. We have since increased the number of scanning tools, and will be taking additional steps to minimize the risk of further incidents."

AMO, Mozilla's add-on management group, posted a notice about the malicious add-ons on Thursday.

The malicious add-ons have been identified as version 4.0 of Sothink Web Video Downloader and all versions of Master Filer. According to AMO's blog post, Sothink Web Video Downloader 4.0 included malware known as Win32.LdPinch.gen, while Master Filer included malware known as Win32.Bifrose.32.Bifrose Trojan.

Launching Firefox with either of these add-ons installed on a Windows computer is likely to lead to an infection. Removing the add-on does not remove the trojan software, however. Antivirus software that recognizes the malware is necessary for removal. According to Mozilla, the following antivirus apps will work: Antiy-AVL, Avast, AVG, GData, Ikarus, K7AntiVirus, McAfee, Norman, and VBA32.

Last May, security researcher Duarte Silva created a proof-of-concept malicious add-on, or "maladon," to highlight problems in Firefox's add-on security model.

Mozilla has made some security improvements since then, such as locking down Firefox's components directory. But the discovery of infected add-ons on Mozillla's AMO site suggests that additional action is necessary.

A Mozilla spokesperson wasn't immediately available for comment.

Master Filer was downloaded approximately 600 times between September 2009 and January 2010. Version 4.0 of Sothink Web Video Downloader was downloaded approximately 4,000 times between February 2008 and May 2008. AMO's blog post says that versions of Sothink greater than 4.0 are not infected. The latest version, 5.7, is not available through AMO's site, but can be found at Sothink's Web site.

In July, Mozilla launched a program to help add-on developers solicit contributions for the add-ons they post on the AMO site.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-2184
Published: 2015-03-27
Movable Type before 5.2.6 does not properly use the Storable::thaw function, which allows remote attackers to execute arbitrary code via the comment_state parameter.

CVE-2014-3619
Published: 2015-03-27
The __socket_proto_state_machine function in GlusterFS 3.5 allows remote attackers to cause a denial of service (infinite loop) via a "00000000" fragment header.

CVE-2014-8121
Published: 2015-03-27
DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service (infinite loop) by performing a look-up while the database is iterated over...

CVE-2014-9712
Published: 2015-03-27
Websense TRITON V-Series appliances before 7.8.3 Hotfix 03 and 7.8.4 before Hotfix 01 allows remote administrators to read arbitrary files and obtain passwords via a crafted path.

CVE-2015-0658
Published: 2015-03-27
The DHCP implementation in the PowerOn Auto Provisioning (POAP) feature in Cisco NX-OS does not properly restrict the initialization process, which allows remote attackers to execute arbitrary commands as root by sending crafted response packets on the local network, aka Bug ID CSCur14589.

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.