Mozilla: Firefox plugin shipped with malicious code

Mozilla warned Wednesday that a malicious program inserted adware code into
a Firefox plugin that has been downloaded thousands of times over the past three
months.

Because of a virus infection, the Vietnamese language pack for Firefox 2 was
polluted with adware, Mozilla security chief Window Snyder said in a blog
posting. "Everyone who downloaded the most recent Vietnamese language
pack since February 18, 2008 got an infected copy," she wrote. "Mozilla
does virus scans at upload time but the virus scanner did not catch this issue
until several months after the upload."

Mozilla is now going to add additional scans of its software to prevent this
kind of thing from happening in the future, she said.

The malware in the language pack is from the Xorer
Trojan, according to discussion
on Mozilla's Bugzilla developer Web site, which indicates that Mozilla developers
first discovered the issue on Tuesday.

"I think it (happened) just because the author's local network was infected
with the virus, so it modified HTML files," wrote developer Hai-Nam Nguyen.
"The infected code just display(s) annoying banner but it can't propagate."

Mozilla missed the code during its initial scan because antivirus vendors had not yet added detection for Xorer into their products, Snyder said in an interview. Antivirus vendor Panda Security first detected Xorer on Feb. 28, 10 days after the infected plugin was published.

Firefox developers have now scanned all of their plugins. The Vietnamese language pack is the only one that had this kind of code, she said.

The open-source browser maker does not know how many people were infected with
the adware, but the plugin was downloaded more than 1,200 times in the past
week and has been downloaded 16,667 times since November.

On Wednesday afternoon, the Web
page for the plugin was off-line as Mozilla scrambled to come up with a
new, adware-free version of the language pack. In the meantime, users of the
software should disable the plugin, Snyder said.

Xorer added a script to the Vietnamese language pack's HTML files that would
have taken Firefox users to adware servers as they were surfing the Internet,
Snyder said.

Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine