Mozilla pulls password-sniffing Firefox add-on

Filed Under: Data loss, Firefox, Malware

Clothes peg on nose
Mozilla has issued a warning that a Firefox add-on available from the official Mozilla Add-Ons website was secretly sending users' stolen passwords to a remote location.

"Mozilla Sniffer" was uploaded to the Firefox add-on site on June 6th, but was only determined at the start of this week to contain code that sent the contents of website login forms to a remote location.

In other words, if you installed this add-on (and according to Mozilla about 1800 people did) then everytime you entered your password on a website you were potentially handing over your confidential login details to an unknown party.

And this isn't the first time that Firefox add-ons have made the security headlines. For instance, earlier this year Mozilla revealed that the Master Filer add-on was infected by the LdPinch password-stealing Trojan.

Back then Mozilla said it would strengthen its vetting procedures, scanning all add-ons with additional anti-virus tools. Clearly that wasn't enough in this latest breach, and there is a proposal to introduce a requirement that all add-ons be code-reviewed before they are published on the site. More details on this proposal are available in a document about the new review model.

Mozilla has now black-listed the "Mozilla Sniffer" add-on, meaning that users who are already running the code will be prompted to remove it.

If you're one of the potential victims, however, I would go further than just removing the add-on. Make sure you change your passwords too.

In a separate security incident, Mozilla has warned that a security vulnerability exists in a version of the popular CoolPreviews add-on (which displays thumbnails of websites when you hover your mouse over web links). Version 3.0.1 and earlier versions of CoolPreviews are said to be affected.

CoolPreviews add-on

Proof-of-concept code demonstrating how hackers could exploit the flaw to run malicious code on the users' computer has been published on a Japanese blog.

Mozilla says that currently 177,000 users have a vulnerable version of CoolPreviews installed - and has encouraged all users to update to the latest version as soon as possible in order to avoid exposure to attacks.

, , , ,

You might like

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

About the author

Graham Cluley runs his own award-winning computer security blog, and is a veteran of the anti-virus industry having worked for a number of security companies since the early 1990s. Now an independent security analyst, he regularly makes media appearances and gives computer security presentations. Send Graham an email, subscribe to his updates on Facebook, follow him on Twitter and, and circle him on Google Plus for regular updates.