Compromised file found in language pack for Firefox

Share this article:
An add-on for the popular Firefox browser hid potentially malicious code, possibly contaminating the machines of anyone who downloaded it. The add-on was a Vietnamese language pack, and though it has been removed from the official Mozilla add-on website, it was undetected until this week.

Window Snyder, Mozilla's security chief, told SCMagazineUS.com Thursday that “about 1,200 people downloaded the pack every week since Feb. 18. Compared to 170 million users, that's a small number.”

The language pack was a single file that had a remnant of a script tag that could direct a user to a site that would play unsolicited ads.

“It was not an infection, per se, and the site it directed users to is down. The most likely scenario was that users would be seeing unwanted ads,” Snyder said.

How did it get into the pack? Said Snyder, “We did not do forensics on the developer's machine, but the most likely scenario was that the machine was infected and when the developer uploaded the pack to our add-on site, our antivirus software did not detect it.”

The virus signature was not identified until April.

A new language pack will be available shortly. Until then, Vietnamese language pack users should disable this package, she said.
Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

TOP COMMENTS

More in News

Email promises free pizza, ensnares victims in Asprox botnet instead

Email promises free pizza, ensnares victims in Asprox ...

Cloudmark came upon an email that offers free pizza, but clicking on the link to get the coupon ends with victims being ensnared in a botnet.

Report: most orgs lacking in response team, policies to address cyber incidents

In its Q3 threat intelligence report, Solutionary learned that 75 percent of organizations it assisted had no response team or policies and procedures to address cyber incidents.

Flash redirect campaign impacts Carnegie Mellon page, leads to Angler EK

Flash redirect campaign impacts Carnegie Mellon page, leads ...

Malwarebytes found that, since early July, thousands of sites had been targeted in the campaign.