About 4,600 Windows users appear to have downloaded the infected software.

Thomas Claburn, Editor at Large, Enterprise Mobility

February 5, 2010

2 Min Read

Mozilla on Friday said that it had removed two Firefox add-ons from its Web site because they installed malware.

"Two add-ons in the experimental section of addons.mozilla.org were found to be containing malware," Mozilla said on its security blog. "These were not originally detected with the anti-malware scanning tools that we have been using. We have since increased the number of scanning tools, and will be taking additional steps to minimize the risk of further incidents."

AMO, Mozilla's add-on management group, posted a notice about the malicious add-ons on Thursday.

The malicious add-ons have been identified as version 4.0 of Sothink Web Video Downloader and all versions of Master Filer. According to AMO's blog post, Sothink Web Video Downloader 4.0 included malware known as Win32.LdPinch.gen, while Master Filer included malware known as Win32.Bifrose.32.Bifrose Trojan.

Launching Firefox with either of these add-ons installed on a Windows computer is likely to lead to an infection. Removing the add-on does not remove the trojan software, however. Antivirus software that recognizes the malware is necessary for removal. According to Mozilla, the following antivirus apps will work: Antiy-AVL, Avast, AVG, GData, Ikarus, K7AntiVirus, McAfee, Norman, and VBA32.

Last May, security researcher Duarte Silva created a proof-of-concept malicious add-on, or "maladon," to highlight problems in Firefox's add-on security model.

Mozilla has made some security improvements since then, such as locking down Firefox's components directory. But the discovery of infected add-ons on Mozillla's AMO site suggests that additional action is necessary.

A Mozilla spokesperson wasn't immediately available for comment.

Master Filer was downloaded approximately 600 times between September 2009 and January 2010. Version 4.0 of Sothink Web Video Downloader was downloaded approximately 4,000 times between February 2008 and May 2008. AMO's blog post says that versions of Sothink greater than 4.0 are not infected. The latest version, 5.7, is not available through AMO's site, but can be found at Sothink's Web site.

In July, Mozilla launched a program to help add-on developers solicit contributions for the add-ons they post on the AMO site.

Read more about:

2010

About the Author(s)

Thomas Claburn

Editor at Large, Enterprise Mobility

Thomas Claburn has been writing about business and technology since 1996, for publications such as New Architect, PC Computing, InformationWeek, Salon, Wired, and Ziff Davis Smart Business. Before that, he worked in film and television, having earned a not particularly useful master's degree in film production. He wrote the original treatment for 3DO's Killing Time, a short story that appeared in On Spec, and the screenplay for an independent film called The Hanged Man, which he would later direct. He's the author of a science fiction novel, Reflecting Fires, and a sadly neglected blog, Lot 49. His iPhone game, Blocfall, is available through the iTunes App Store. His wife is a talented jazz singer; he does not sing, which is for the best.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights