Be careful of rogue FireFox Extensions

Posted on

Today I was working on a website application and I saw a strange thing happen with a date checking related library called moment.js where it was calling a website to get some usage statistics. Well, that’s what I thought was the case initially…

I have a few ad blockers installed in my browser, and so that was a good indication something wasn’t right, especially that traffic was flowing to icelandsue.com when it was a locally hosted website.

This got me looking and digging through my own code a lot, until I loaded the same page in Chrome.

Strangely enough, it wasn’t there…

This was a good thing.

Eventually I was able to load the JS in a debug in Firefox and discover it was actually a FF Addon called “YouTube Downloader” version 4.5 to be exact.

Oddly enough there was no homepage associated with it as well.

I tried disabling it and re-enabling it and the problem went and returned. Bingo.

I haven’t been able to find it again since, and in my attempt to disable it, I actually ended up removing it.

moz-extension://72315215-4bb7-44c7-8a6d-7bd1dcbfea50/

This rogue Add-on posts content like the following:

http://abp.smartadcheck.de/js/abpc.js?#ads/banner/ad/

    ao_gc

moz-extension://72315215-4bb7-44c7-8a6d-7bd1dcbfea50/data/moment.js:1992:38
<anonymous>moz-extension://72315215-4bb7-44c7-8a6d-7bd1dcbfea50/data/moment.js:1998:1
<anonymous>moz-extension://72315215-4bb7-44c7-8a6d-7bd1dcbfea50/data/moment.js:6:19
<anonymous>moz-extension://72315215-4bb7-44c7-8a6d-7bd1dcbfea50/data/moment.js:7:2
inject
resource://gre/modules/ExtensionContent.jsm:568:25

And also other stuff like this too

b/<
https://icelandsue.com/22e6c5fc171a88ebee.js:1:436
b
https://icelandsue.com/22e6c5fc171a88ebee.js:1:592
<anonymous>https://icelandsue.com/22e6c5fc171a88ebee.js:2:23075
<anonymous>https://icelandsue.com/22e6c5fc171a88ebee.js:2:24246

Anyway, I just thought I’d post it as a warning and in case someone else has this problem.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s