Be careful of rogue FireFox Extensions
Today I was working on a website application and I saw a strange thing happen with a date checking related library called moment.js where it was calling a website to get some usage statistics. Well, that’s what I thought was the case initially…
I have a few ad blockers installed in my browser, and so that was a good indication something wasn’t right, especially that traffic was flowing to icelandsue.com when it was a locally hosted website.
This got me looking and digging through my own code a lot, until I loaded the same page in Chrome.
Strangely enough, it wasn’t there…
This was a good thing.
Eventually I was able to load the JS in a debug in Firefox and discover it was actually a FF Addon called “YouTube Downloader” version 4.5 to be exact.
Oddly enough there was no homepage associated with it as well.
I tried disabling it and re-enabling it and the problem went and returned. Bingo.
I haven’t been able to find it again since, and in my attempt to disable it, I actually ended up removing it.
moz-extension://72315215-4bb7-44c7-8a6d-7bd1dcbfea50/
This rogue Add-on posts content like the following:
http://abp.smartadcheck.de/js/abpc.js?#ads/banner/ad/
ao_gc
moz-extension://72315215-4bb7-44c7-8a6d-7bd1dcbfea50/data/moment.js:1992:38
<anonymous>moz-extension://72315215-4bb7-44c7-8a6d-7bd1dcbfea50/data/moment.js:1998:1
<anonymous>moz-extension://72315215-4bb7-44c7-8a6d-7bd1dcbfea50/data/moment.js:6:19
<anonymous>moz-extension://72315215-4bb7-44c7-8a6d-7bd1dcbfea50/data/moment.js:7:2
inject
resource://gre/modules/ExtensionContent.jsm:568:25
And also other stuff like this too
b/< https://icelandsue.com/22e6c5fc171a88ebee.js:1:436 b https://icelandsue.com/22e6c5fc171a88ebee.js:1:592 <anonymous>https://icelandsue.com/22e6c5fc171a88ebee.js:2:23075 <anonymous>https://icelandsue.com/22e6c5fc171a88ebee.js:2:24246
Anyway, I just thought I’d post it as a warning and in case someone else has this problem.
