"Two add-ons in the experimental section of addons.mozilla.org were
found to be containing malware," Mozilla said on its security blog.
"These were not originally detected with the anti-malware scanning
tools that we have been using. We have since increased the number of
scanning tools, and will be taking additional steps to minimize the
risk of further incidents."
AMO, Mozilla's add-on management group, posted a notice about the malicious add-ons on Thursday.
The malicious add-ons have been identified as version 4.0 of Sothink
Web Video Downloader and all versions of Master Filer. According to
AMO's blog post, Sothink Web Video Downloader 4.0 included malware
known as Win32.LdPinch.gen, while Master Filer included malware known
as Win32.Bifrose.32.Bifrose Trojan.
Launching Firefox with either of these add-ons installed on a
Windows computer is likely to lead to an infection. Removing the add-on
does not remove the trojan software, however. Antivirus software that
recognizes the malware is necessary for removal. According to Mozilla,
the following antivirus apps will work: Antiy-AVL, Avast, AVG, GData,
Ikarus, K7AntiVirus, McAfee, Norman, and VBA32.
Last May, security researcher Duarte Silva created a proof-of-concept malicious add-on, or "maladon," to highlight problems in Firefox's add-on security model.
Mozilla has made some security improvements since then, such as locking down Firefox's components directory. But the discovery of infected add-ons on Mozillla's AMO site suggests that additional action is necessary.
News 1 month ago
