{"id":1285,"date":"2010-02-04T20:49:26","date_gmt":"2010-02-05T04:49:26","guid":{"rendered":"http:\/\/blog.mozilla.org\/addons\/?p=1285"},"modified":"2011-03-28T01:30:44","modified_gmt":"2011-03-28T08:30:44","slug":"please-read-security-issue-on-amo","status":"publish","type":"post","link":"https:\/\/blog.mozilla.org\/addons\/2010\/02\/04\/please-read-security-issue-on-amo\/","title":{"rendered":"Please read: Security Issue on AMO"},"content":{"rendered":"

NOTE: Further investigation has revealed that all versions of Sothink Web Video Downloader are malware free.\u00a0 For more, read our update<\/a>.<\/strong><\/p>\n

Issue<\/strong><\/p>\n

Two experimental add-ons, Version 4.0 of Sothink Web Video Downloader and all versions of Master Filer were found to contain Trojan code aimed at Windows users. Version 4.0 of Sothink Web Video Downloader contained Win32.LdPinch.gen, and Master Filer contained Win32.Bifrose.32.Bifrose Trojan. Both add-ons have been disabled on AMO.<\/p>\n

Impact to users <\/strong><\/p>\n

If a user installs one of these infected add-ons, the trojan would be executed when Firefox starts and the host computer would be infected by the trojan. Uninstalling these add-ons does not remove the trojan from a user’s system. Users with either of these add-ons should uninstall them immediately. Since uninstalling these extensions does not remove the trojan from a user’s system, an antivirus program should be used to scan and remove any infections.<\/p>\n

Status<\/strong><\/p>\n

This vulnerability is known to affect Firefox on Windows only, if either Master Filer or Version 4.0 of Sothink Web Video Downloader are installed. Versions of Sothink Web Video Downloader greater than 4.0 are not infected. Master Filer was downloaded approximately 600 times between September 2009 and January 2010. Version 4.0 of Sothink Web Video Downloader was downloaded approximately 4,000 times between February 2008 and May 2008. Master Filer was removed from AMO on January 25, 2010 and Version 4.0 of Sothink Web Video Downloader was removed from AMO on February 2, 2010. AMO performs a malware check on all add-ons uploaded to the site, and blocks add-ons that are detected as such. This scanning tool failed to detect the Trojan in Master Filer. Two additional malware detection tools have been added to the validation chain and all add-ons were rescanned, which revealed the additional Trojan in Version 4.0 of Sothink Web Video Downloader. No other instances of malware have been discovered.<\/p>\n

Credit<\/strong><\/p>\n

This issue was originally reported by CatThief.<\/p>\n

Antivirus Software<\/strong><\/p>\n

Here is a list of antivirus programs known to detect the trojans found in the affected add-ons.<\/p>\n

Antiy-AVL<\/a>
\nAvast<\/a>
\nAVG<\/a>
\nGData<\/a>
\nIkarus<\/a>
\nK7AntiVirus<\/a>
\nMcAfee<\/a>
\n Norman<\/a>
\nVBA32<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

NOTE: Further investigation has revealed that all versions of Sothink Web Video Downloader are malware free.\u00a0 For more, read our update. Issue Two experimental add-ons, Version 4.0 of Sothink Web … Read more<\/a><\/p>\n","protected":false},"author":132,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[121],"tags":[7105],"yoast_head":"\nPlease read: Security Issue on AMO - Mozilla Add-ons Community Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.mozilla.org\/addons\/2010\/02\/04\/please-read-security-issue-on-amo\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Nick Nguyen\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blog.mozilla.org\/addons\/2010\/02\/04\/please-read-security-issue-on-amo\/\",\"url\":\"https:\/\/blog.mozilla.org\/addons\/2010\/02\/04\/please-read-security-issue-on-amo\/\",\"name\":\"Please read: Security Issue on AMO - Mozilla Add-ons Community Blog\",\"isPartOf\":{\"@id\":\"https:\/\/blog.mozilla.org\/addons\/#website\"},\"datePublished\":\"2010-02-05T04:49:26+00:00\",\"dateModified\":\"2011-03-28T08:30:44+00:00\",\"author\":{\"@id\":\"https:\/\/blog.mozilla.org\/addons\/#\/schema\/person\/8648e838daf14e36b6d5474243134522\"},\"breadcrumb\":{\"@id\":\"https:\/\/blog.mozilla.org\/addons\/2010\/02\/04\/please-read-security-issue-on-amo\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blog.mozilla.org\/addons\/2010\/02\/04\/please-read-security-issue-on-amo\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blog.mozilla.org\/addons\/2010\/02\/04\/please-read-security-issue-on-amo\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/blog.mozilla.org\/addons\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Please read: Security Issue on AMO\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blog.mozilla.org\/addons\/#website\",\"url\":\"https:\/\/blog.mozilla.org\/addons\/\",\"name\":\"Mozilla Add-ons Community Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blog.mozilla.org\/addons\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/blog.mozilla.org\/addons\/#\/schema\/person\/8648e838daf14e36b6d5474243134522\",\"name\":\"Nick Nguyen\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.mozilla.org\/addons\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/3157aa227723e202837c0f17257b2361?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/3157aa227723e202837c0f17257b2361?s=96&d=mm&r=g\",\"caption\":\"Nick Nguyen\"},\"description\":\"Vice President of Firefox Product\",\"url\":\"https:\/\/blog.mozilla.org\/addons\/author\/nnguyenmozillacom\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Please read: Security Issue on AMO - Mozilla Add-ons Community Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.mozilla.org\/addons\/2010\/02\/04\/please-read-security-issue-on-amo\/","twitter_misc":{"Written by":"Nick Nguyen","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/blog.mozilla.org\/addons\/2010\/02\/04\/please-read-security-issue-on-amo\/","url":"https:\/\/blog.mozilla.org\/addons\/2010\/02\/04\/please-read-security-issue-on-amo\/","name":"Please read: Security Issue on AMO - Mozilla Add-ons Community Blog","isPartOf":{"@id":"https:\/\/blog.mozilla.org\/addons\/#website"},"datePublished":"2010-02-05T04:49:26+00:00","dateModified":"2011-03-28T08:30:44+00:00","author":{"@id":"https:\/\/blog.mozilla.org\/addons\/#\/schema\/person\/8648e838daf14e36b6d5474243134522"},"breadcrumb":{"@id":"https:\/\/blog.mozilla.org\/addons\/2010\/02\/04\/please-read-security-issue-on-amo\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.mozilla.org\/addons\/2010\/02\/04\/please-read-security-issue-on-amo\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/blog.mozilla.org\/addons\/2010\/02\/04\/please-read-security-issue-on-amo\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blog.mozilla.org\/addons\/"},{"@type":"ListItem","position":2,"name":"Please read: Security Issue on AMO"}]},{"@type":"WebSite","@id":"https:\/\/blog.mozilla.org\/addons\/#website","url":"https:\/\/blog.mozilla.org\/addons\/","name":"Mozilla Add-ons Community Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.mozilla.org\/addons\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/blog.mozilla.org\/addons\/#\/schema\/person\/8648e838daf14e36b6d5474243134522","name":"Nick Nguyen","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.mozilla.org\/addons\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/3157aa227723e202837c0f17257b2361?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/3157aa227723e202837c0f17257b2361?s=96&d=mm&r=g","caption":"Nick Nguyen"},"description":"Vice President of Firefox Product","url":"https:\/\/blog.mozilla.org\/addons\/author\/nnguyenmozillacom\/"}]}},"_links":{"self":[{"href":"https:\/\/blog.mozilla.org\/addons\/wp-json\/wp\/v2\/posts\/1285"}],"collection":[{"href":"https:\/\/blog.mozilla.org\/addons\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.mozilla.org\/addons\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/addons\/wp-json\/wp\/v2\/users\/132"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/addons\/wp-json\/wp\/v2\/comments?post=1285"}],"version-history":[{"count":0,"href":"https:\/\/blog.mozilla.org\/addons\/wp-json\/wp\/v2\/posts\/1285\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.mozilla.org\/addons\/wp-json\/wp\/v2\/media?parent=1285"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.mozilla.org\/addons\/wp-json\/wp\/v2\/categories?post=1285"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.mozilla.org\/addons\/wp-json\/wp\/v2\/tags?post=1285"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}