Re: Wow! Mozilla distributing infected code! in Security http://www.dslreports.com/forum/r20450118 en Tue, 02 Dec 2008 01:33:19 EDT Tue, 02 Dec 2008 01:33:19 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20469662 astirusty :
said by Steve See Profile :

Been out there for 2.5 months! Wow!
I know the infection via Vietnamese language pack add-on doesn't effect the vast majority of us, but it is still good you brought it. In that it is a wake-up call (or reminder) of the various methods of injecting malware into application that in itself was being protected by scanning/monitoring.
--
Do yourself a favor, just say no to anything Windows.]]> http://www.dslreports.com/forum/remark,20469662 Mon, 12 May 2008 12:35:13 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20469637 astirusty :
said by Blackbird See Profile :

the following comments also appear in the »https://bugzilla.mozilla.org/show_bug.cgi?id=432406 dialogue...
Thanks for posting the dialogue, it appears there was a slip-up with FF add-ons and there are plans to reduce the chances of it happening again.
--
Do yourself a favor, just say no to anything Windows.]]> http://www.dslreports.com/forum/remark,20469637 Mon, 12 May 2008 12:27:44 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20469567 Davebo_ :
said by matunga See Profile :

yet another demonstration that open source code is NOT safer than closed source code :)

Well, only you were making this assumption. I think your post tells us more about you and your skillset, such as it is. Only you make that claim (or counter-claim). You're a one man war...

Having fun down there under the bridge?]]> http://www.dslreports.com/forum/remark,20469567 Mon, 12 May 2008 12:09:48 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20469194 quatrix :
said by matunga See Profile :

yet another demonstration that open source code is NOT safer than closed source code
Your logic needs some work. It's only a demonstration that open-source code isn't 100% safe, which was obvious.]]> http://www.dslreports.com/forum/remark,20469194 Mon, 12 May 2008 10:55:18 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20455102 moby866 : Dude, what about WindowsME?]]> http://www.dslreports.com/forum/remark,20455102 Fri, 09 May 2008 02:57:33 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20455048 Blackbird :
said by Steve See Profile :

Yes, I know all that - this was lucky that the infected code couldn't propogate because XPI allows executable code. And they had no kind of re-scanning every time they get A/V updates to have caught this some time ago - they are now doing so, but I don't know how this fails to undermine trust in the distribution mechanism.
What you state is true, but to keep this in context and to better understand why things may have unfolded as they did, the following comments also appear in the »https://bugzilla.mozilla.org/show_bug.cgi?id=432406 dialogue...
Dave Miller (MoCo) 2008-05-06 10:49:42 PDT
(In reply to comment #12)
> I thought we were scanning all the uploads -- did it slip by before the virus
> definitions were updated to include HTML.Xorer?

Yes, that was explained in comment 5.

> Maybe we need to rescan after every definition update?

Ideally, yes, except that we get new definitions on average every 6 hours or so
and it takes over a week to virus scan the entire ftp server. Getting monthly
scans is in the plan for the new stage server once we get it working. (bb: my emphasis added)


This is later followed by the following exchange:
Mike Shaver 2008-05-06 11:13:52 PDT
Can we just rescan using the newly added definitions (if that makes things
faster), or just scan add-ons to make it go faster? I think the risk level is
a fair bit higher for uploaded add-ons and the contrib directories than for the
builds pushed out by our tinderboxes, so it'd be good to improve the frequency
on the softer targets if we can.
Comment #22
Dave Miller (MoCo) 2008-05-06 12:20:59 PDT
I rescanned the addons tree last night, it took a few hours to run. Don't know
how many, it had been going for an hour or two when I went to sleep and it was
done when I woke up. Getting a full scan of addons daily would probably be
doable.

--
If God wanted us to work with electrons, He'd make them big enough to see...]]> http://www.dslreports.com/forum/remark,20455048 Fri, 09 May 2008 02:25:39 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20454839 mikenolan7 : Coming down hard on Mozilla, and stating this shows some inherent weakness in open source software is not fair. They made a mistake, they are taking steps to fix it. Open source software is the most amazing gift in this world. To the detractors please point to anywhere else where you can get something of such value for free. Where would the internet be without Firefox, Opera, all the Linux distros, FreeBSD and OpenBSD? People interested in security should be especially grateful. As a home user what else can we ask for, with Wireshark, Snort, Nmap and the others to secure our networks with and learn from, entirely free of charge? It's the most generous thing I see in a world full of greed.

Edit: Steve, this was not directed at you, but to some of the more negative posts.]]> http://www.dslreports.com/forum/remark,20454839 Fri, 09 May 2008 00:51:27 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20454759 SUMware :
said by jdong See Profile :

It is a disappointment to see the distribution infrastructure for any software project, open or closed source, to be compromised in this manner , but I don't think this is a problem isolated to Mozilla -- I'd like to know how many other vendors have active countermeasures and preventative measures for this kind of compromise.

On the bright side, I am glad to see Mozilla is instituting policy/procedure changes in reaction to this breach.
Agreed. Mozilla resolved the issue quickly upon discovery, without denial, and publicly for everyone to view.

Mozilla needs to take more responsibility and ownership for extension quality/security. Their current extension 'disclaimer' states:
»https://addons.mozilla.org/en-US/firefox/
Mozilla is providing links to these applications as a courtesy, and makes no representations regarding the applications or any information related there to. Any questions, complaints or claims regarding the applications must be directed to the appropriate software vendor.

That isn't quite going to cut it anymore.
Mozilla now better understands that they must provide a higher level of end user assurance. Well, let's hope so anyway.

said by KrK See Profile :

Chances are they don't know Vietnamese, so they farmed out the translation to some third party who caused the problem.
That is not what occurred.]]> http://www.dslreports.com/forum/remark,20454759 Fri, 09 May 2008 00:25:18 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20454714 jdong : It is a disappointment to see the distribution infrastructure for any software project, open or closed source, to be compromised in this manner , but I don't think this is a problem isolated to Mozilla -- I'd like to know how many other vendors have active countermeasures and preventative measures for this kind of compromise.

On the bright side, I am glad to see Mozilla is instituting policy/procedure changes in reaction to this breach.
--
Ubuntu MOTU Developer and Forums Council]]> http://www.dslreports.com/forum/remark,20454714 Fri, 09 May 2008 00:10:41 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20454710 KrK : No, but Microsoft has served up Malware....

Microsoft Apologizes for Serving up Malware.

»apcmag.com/microsoft_apologises_···ware.htm]]> http://www.dslreports.com/forum/remark,20454710 Fri, 09 May 2008 00:09:24 EDT Re: Only Vietnamese language pack addon is affected http://www.dslreports.com/forum/remark,20454690 KrK : Chances are they don't know Vietnamese, so they farmed out the translation to some third party who caused the problem.]]> http://www.dslreports.com/forum/remark,20454690 Fri, 09 May 2008 00:03:44 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20454674 SUMware :
said by Mele20 See Profile :

BTW, who blew out the margins? It is really hard to read this thread in Fx which doesn't have fit to page feature.
said by AB See Profile :

It was the link within this post: »Re: Wow! Mozilla distributing infected code!
Fixed. Sorry about that, folks.]]> http://www.dslreports.com/forum/remark,20454674 Fri, 09 May 2008 00:00:20 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20454621 Lanik :
said by Mele20 See Profile :

My screen is at 1280x1024 and this thread is one of the worst I have seen for blown margins.
So is mine, perhaps its your big fonts that are blowing the margins. ;)
--
"If it ain't broke don't fix it."]]> http://www.dslreports.com/forum/remark,20454621 Thu, 08 May 2008 23:45:31 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20454552 Mele20 :
said by IWillLoginSoon :

Thank you.

It seems AB found the culprit quickly. The link does not cause margin problems at 1280x1024 (for me).
My screen is at 1280x1024 and this thread is one of the worst I have seen for blown margins. I should have started Opera or Safari as they can handle it but neither Fx 1.5 or 2 can.

I just checked IE6 and it is not blown on that browser.
--
"The same ferocity that our founders devoted to protect the freedom and independence of the press is now appropriate for our defense of the freedom of the internet. The stakes are the same: the survival of our Republic". Al Gore, The Assault on Reason]]> http://www.dslreports.com/forum/remark,20454552 Thu, 08 May 2008 23:26:15 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20454435 Grail Knight : You are welcome. :)]]> http://www.dslreports.com/forum/remark,20454435 Thu, 08 May 2008 22:57:31 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20454428 anon : Thank you.

It seems AB found the culprit quickly. The link does not cause margin problems at 1280x1024 (for me).]]> http://www.dslreports.com/forum/remark,20454428 Thu, 08 May 2008 22:55:03 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20454400 Grail Knight : My notebook is 1280x800

Tried to get Mele20 rendering issue using Fx v2.0.0.15 and Fx v3pre, IE7, and Opera 9. All are fine.
--
"When the questions get tough the tough pull a MuMu". - unknown]]> http://www.dslreports.com/forum/remark,20454400 Thu, 08 May 2008 22:48:18 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20454360 anon : I have the same problem on "page 1" while viewing the site anonymously (default thread settings). Resolution on this laptop is 1024x768.

Can the two unaffected members post some useful information - their screen resolutions?]]> http://www.dslreports.com/forum/remark,20454360 Thu, 08 May 2008 22:39:56 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20454351 AB :
said by Steve See Profile :

said by Mele20 See Profile :

BTW, who blew out the margins? It is really hard to read this thread in Fx which doesn't have fit to page feature.
Hmmm, looks fine to me - any chance you have the Vietnamese language pack installed?

*snicker* :-)
Phân thần thánh! :o :D

Eh, I'll back her up on this one.
It was the link within this post: »Re: Wow! Mozilla distributing infected code!

The margins are blown on page one of this thread for me, too-- page two is fine.]]> http://www.dslreports.com/forum/remark,20454351 Thu, 08 May 2008 22:38:07 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20454339 mrchris : Good thing I never downloaded that language pack.]]> http://www.dslreports.com/forum/remark,20454339 Thu, 08 May 2008 22:36:05 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20454318 Steve :
said by Mele20 See Profile :

BTW, who blew out the margins? It is really hard to read this thread in Fx which doesn't have fit to page feature.
Hmmm, looks fine to me - any chance you have the Vietnamese language pack installed?

*snicker* :-)]]> http://www.dslreports.com/forum/remark,20454318 Thu, 08 May 2008 22:32:00 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20454310 Grail Knight : The thread looks fine in Fx Mele20.

Check your browser part 1,524-6 again.

Edit* Line out.
--
"When the questions get tough the tough pull a MuMu". - unknown]]> http://www.dslreports.com/forum/remark,20454310 Thu, 08 May 2008 22:29:36 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20454295 Mele20 : And this has what to do with this thread topic?

BTW, who blew out the margins? It is really hard to read this thread in Fx which doesn't have fit to page feature.]]> http://www.dslreports.com/forum/remark,20454295 Thu, 08 May 2008 22:26:59 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20454265 cork1958 :
said by slajoh01 See Profile :

I agree, Firefox and Mozilla WILL become unsafe also just like IE.

Firefox is gaining momentum and its market share is picking up. And that will result in more exploitations.
They already have passed Microsoft at exploitations!
--
The Firefox alternative.
»www.mozilla.org/projects/seamonkey/]]> http://www.dslreports.com/forum/remark,20454265 Thu, 08 May 2008 22:20:37 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20453562 Steve :
said by jig See Profile :

and as far as this being proof that open source is not safer than closed (another poster), don't be silly.
This incident demonstrates nothing more than one particular vendor had one particular quality control problem, and applying it to open source generally does indeed seem silly.

Steve — longtime open source contributor]]> http://www.dslreports.com/forum/remark,20453562 Thu, 08 May 2008 19:42:03 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20453323 Lowtarget :
said by Davebo_ See Profile
SP 3 for XP was just recently released.... ;) Folks running OEM AMD machines would call SP3 malware.
What would you call? A Intel system running OEM windowsXP SP3. ;)]]> http://www.dslreports.com/forum/remark,20453323 Thu, 08 May 2008 18:40:51 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20452751 jabarnut :
said by dave See Profile :

You're missing the point; this news isn't about a browser bug, it's about a software distributor's quality control.

Essentially, most people trust 'big name' software providers to provide sterile code.
Exactly.
Although, some of the defensive responses don't surprise me at all.

As usual, as soon as I saw the topic heading, I knew that the "Mozilla crowd" would get all bent out of shape.

I suppose I should mention that in addition to IE, I'm also a Firefox user....so no need to get too excited (At least as far as my comments).

It is what it is.
--
I had a life once.....now I have a Computer and a Modem.]]> http://www.dslreports.com/forum/remark,20452751 Thu, 08 May 2008 16:52:52 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20452722 AB :
said by dave See Profile :

said by MysticGogeta See Profile :

Wow! I like when people are shocked that a browser isn't perfect so they jump on every opportunity to flame/troll.
You're missing the point; this news isn't about a browser bug, it's about a software distributor's quality control.
Agree 100%.
This has sometimes been an issue in the past (and currently, no doubt) with extensions for Firefox. Mozilla doesn't police them very well.
Sure, they could pass it off as 'we're not responsible, that's third-party code', but they don't-- at least not wholly. They've realized people often mentally connect 'extensions' to 'Mozilla.org' or 'Mozillazine', and therefore crap extensions reflect badly upon them.
So while they hardly run the tightest ship imaginable, they do in fact try to limit damage or leaks, and avoid enemy torpedoes as much as possible.

Essentially, most people trust 'big name' software providers to provide sterile code.
Most people then make a mistake by doing that.
Trust no one, as far as the computer is concerned. NO ONE.
That's not 'tin-foil hat' stuff, that's merely being practical and cautious, imo.

But your point is well taken. There is most certainly a level of trust that must be extended between vendor and user.
Otherwise, nothing is ever vended, nothing ever installed or used.

I trust-- yet I don't.

said by jig See Profile :

. . as far as this being proof that open source is not safer than closed (another poster), don't be silly.
Being 'silly' about open-source code is on his good days.]]> http://www.dslreports.com/forum/remark,20452722 Thu, 08 May 2008 16:49:58 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20452507 dave :
said by MysticGogeta See Profile :

Wow! I like when people are shocked that a browser isn't perfect so they jump on every opportunity to flame/troll.
You're missing the point; this news isn't about a browser bug, it's about a software distributor's quality control.

Essentially, most people trust 'big name' software providers to provide sterile code.]]> http://www.dslreports.com/forum/remark,20452507 Thu, 08 May 2008 16:15:29 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20452490 dave :
said by Steve See Profile :

Blaming ActiveX is like holding an operating system liable because they provide a way to delete a file.
I thought with IE and Temporary Internet Files, everyone blamed the operating system for not providing a way to delete a file?]]> http://www.dslreports.com/forum/remark,20452490 Thu, 08 May 2008 16:12:01 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20452464 alamarco : Thank-you! I appreciate that information.]]> http://www.dslreports.com/forum/remark,20452464 Thu, 08 May 2008 16:06:10 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20452382 SUMware : From »www.pandasecurity.com/homeusers/···iculares

Brief Description

Xorer.O is a worm that only affects computers that belong to the same local network.

Its main aim is to capture and modify the HTTP-type network packets that are sent from the computers.

As a consequence, the websites requested by the user will be displayed with alterations. However, this anomaly will not be displayed in the infected computer.

Xorer.O spreads through the local, removable and mapped drives, making copies of itself in them.

Visible Symptoms

Xorer.O is difficult to recognize, as it does not display any messages or warnings that indicate it has reached the computer.

However, as Xorer.O only affects computers that belong to a local network, there will be symptoms in other computers.

In the computers that are part of the same network as the affected computer, the visited websites will have anomalies, a pop-up window will appear at the bottom right of the website, as in the image below:



Common name: Xorer.O
Technical name: W32/Xorer.O.worm
Threat level: Medium
Type: Worm
Effects: It only affects computers that belong to the same local network. It captures and modifies the HTTP-type network packets that are sent from these computers, in such a way that the websites visited by the user will be displayed with alterations. It spreads through the local, removable and mapped drives.
Affected platforms: Windows 2003/XP/2000/NT/ME/98/95/3.X
First detected on: Feb. 28, 2008
Detection updated on: March 1, 2008]]> http://www.dslreports.com/forum/remark,20452382 Thu, 08 May 2008 15:50:25 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20451498 alamarco : Thanks for that quote from Bugzilla SUMware See Profile. However I still don't really know what type of virus this was. Was it a trojan? Spyware/data mining? For those infected, what would be the harm?

Most articles just mention "virus" and nothing about the nature of it.]]> http://www.dslreports.com/forum/remark,20451498 Thu, 08 May 2008 12:51:20 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20451326 fatness :
said by Steve See Profile :

And they had no kind of re-scanning every time they get A/V updates to have caught this some time ago - they are now doing so,
That, to me, was the problem. And in perfect hindsight now, what a stupid idea it was.
--
Female monkeys often utter loud, distinctive calls before, during or after sex..]]> http://www.dslreports.com/forum/remark,20451326 Thu, 08 May 2008 12:21:54 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20451061 mikenolan7 : The simple inescapable fact is, the more code you use, the greater the risk that some of it might do things you don't want it to do. Firefox without the extra language pack was safer than with it.]]> http://www.dslreports.com/forum/remark,20451061 Thu, 08 May 2008 11:35:14 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20451014 jig :
said by Steve See Profile :

said by goalieskates See Profile :

Oh grow up. I pick up more bad stuff using IE than I ever do using FF.
I think you're missing the point: here, the malware came from the vendor - Microsoft hasn't ever shipped malware, as far as I know, but Mozilla has.
it's hard for me believe that you haven't read the same articles i have over the past 4-6 years that included MS update being hacked through DNS poisoning as well as shipping some virus on cd-updates. anyway, here's the "i got lucky" link when searching for "microsoft ships infected":

»www.theregister.co.uk/2001/04/25···nfected/

here's another one:

»www.infoworld.com/articles/hn/xm···rea.html

and i know there are more.

and as far as this being proof that open source is not safer than closed (another poster), don't be silly.]]> http://www.dslreports.com/forum/remark,20451014 Thu, 08 May 2008 11:24:49 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20450849 La Luna : The problem is that they possibly have poor quality control over "add ons" (or whatever this language pack is officially called). I've often wondered just how well add ons are tested before being put out to the public.

Who here doesn't believe that the majority of people who download add ons, including language packs, from the Mozilla site itself automatically assume that they are throughly tested and are clean?

On the flip side, in Mozilla's defense, this particular faux pas seemed to be rather hard to detect as the virus signature was unknown at the time....it just goes to show that nothing is 100% safe and even Mozilla can have an *oops* occasionally.
--
11,044 DEADLY TERROR ATTACKS SINCE 9/11~~TEAM DISCOVERY
Can't feel you anymore, don't need you anymore, don't believe you anymore, I don't need you anymore
]]> http://www.dslreports.com/forum/remark,20450849 Thu, 08 May 2008 10:54:28 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20450825 SUMware :
said by Steve See Profile :

And they had no kind of re-scanning every time they get A/V updates to have caught this some time ago - they are now doing so
As you say here, scanning could have been performed with greater diligence. They learned, and now it will be.
said by Steve See Profile :

but I don't know how this fails to undermine trust in the distribution mechanism.
Didn't expect to see FUD from you.]]> http://www.dslreports.com/forum/remark,20450825 Thu, 08 May 2008 10:48:21 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20450808 Steve : Yes, I know all that - this was lucky that the infected code couldn't propogate because XPI allows executable code. And they had no kind of re-scanning every time they get A/V updates to have caught this some time ago - they are now doing so, but I don't know how this fails to undermine trust in the distribution mechanism.
--
Stephen J. Friedl | Unix Wizard | Microsoft Security MVP | Tustin, California USA | my web site]]> http://www.dslreports.com/forum/remark,20450808 Thu, 08 May 2008 10:42:48 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20450784 SUMware :
said by Steve See Profile :

The distribution mechanism was attacked, and that's news.
"With info from Panda security, I think it just because the author's local network was infected with the virus, so it modified html files. The main virus is a Win32 program. The infected code just display annoying banner but it can't propagate."

"The virus's signature was unknown at the time, and thus passed Mozilla's testing of add-ons."]]> http://www.dslreports.com/forum/remark,20450784 Thu, 08 May 2008 10:38:27 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20450752 Steve :
said by MysticGogeta See Profile :

Wow! I like when people are shocked that a browser isn't perfect so they jump on every opportunity to flame/troll.
It's not the browser that's imperfect, it's the quality control of distribution. That's news.
said by SUMware See Profile :

The Firefox browser itself was/is not infected.
The distribution mechanism was attacked, and that's news. It's just a happy accident that it was a little-used add-on: remember that XPI can execute code.
said by Cabal See Profile :

Next? (re: my claim that Microsoft had not distributed malware)
Yep, you're right - they did it too.

Corrupting the distribution system is a tremendous violation of trust.

Steve — longtime enthusiastic Firefox user
--
Stephen J. Friedl | Unix Wizard | Microsoft Security MVP | Tustin, California USA | my web site]]> http://www.dslreports.com/forum/remark,20450752 Thu, 08 May 2008 10:32:59 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20450746 BeesTea :
said by SUMware See Profile :

As has been stated, the infection occured in one language extension addon. The Firefox browser itself was/is not infected.
An important thing to note. The extent of involvement for the Mozilla project directly was marginal. I don't know if the addons are even directly hosted with Mozilla. This is essentially 3rd party.
--
Overpower, overcome.]]> http://www.dslreports.com/forum/remark,20450746 Thu, 08 May 2008 10:32:09 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20450738 Cabal :
said by matunga See Profile :

yet another demonstration that open source code is NOT safer than closed source code :)

Mozilla spreads malware rather than security:
»blogs.zdnet.com/hardware/?p=1813
said by Steve See Profile :

said by goalieskates See Profile :

Oh grow up. I pick up more bad stuff using IE than I ever do using FF.
I think you're missing the point: here, the malware came from the vendor - Microsoft hasn't ever shipped malware, as far as I know, but Mozilla has.
Try again. Next?
--
Interested in open source engine management for your Subaru?]]> http://www.dslreports.com/forum/remark,20450738 Thu, 08 May 2008 10:30:36 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20450717 SUMware : As has been stated, the infection occured in one language extension addon. The Firefox browser itself was/is not infected.
said by fatness See Profile :

Wired News article

quote:
Trojan Horse code seemingly accidentally embedded in a language pack available on its Add-ons site. The virus's signature was unknown at the time, and thus passed Mozilla's testing of add-ons.

»https://bugzilla.mozilla.org/show_bug.cgi?id=432406
quote:
Dave Miller (MoCo) 2008-05-06 01:47:24 PDT
clamscan says:
vietnamese_language_pack-2.0-fx-win.xpi: HTML.Xorer FOUND
The file is dated February 18, the virus signature is date April 14, so we
apparently had this in the wild for about 2 months before the scanners were
detecting it.

Axel Hecht [:Pike] 2008-05-06 01:50:23 PDT
FWIW, I think we're talking about
http://www.pandasecurity.com/homeusers/security-info/about-malware/encyclopedia/overview.
aspx?idvirus=189095&sitepanda=particulares,
right?

Dave Miller (MoCo) 2008-05-06 01:53:02 PDT
The signature I found that said April 14 on it was HTML.Xorer.A. The one you
just found is much more likely to be a match, and the window looks much smaller
there.

Hai-Nam Nguyen (jcisio) 2008-05-06 02:01:26 PDT
With info from Panda security, I think it just because the author's local
network was infected with the virus, so it modified html files. The main virus
is a Win32 program. The infected code just display annoying banner but it can't
propagate.
I think we might just remove the script and everything backs ok.

Justin Scott [:fligtar] 2008-05-06 10:20:09 PDT
Since we seem to have determined it wasn't malicious on the part of the author,
I've changed the add-on status to be in the sandbox and deleted both files.
Jasper, please upload a new version without the virus and let us know and we'll
check it out before pushing it public again.

Dan Guido 2008-05-07 21:07:14 PDT
Was the source of this malicious code found?

Jasper Thái 2008-05-08 05:04:42 PDT
Sorry for the inconvenient!
I've found that translated help files was modified by a virus, come from China.
I'm so busy these days, but I've cleaned up malicious code. The new fresh pack
coming soon.
Thanks!
]]> http://www.dslreports.com/forum/remark,20450717 Thu, 08 May 2008 10:27:33 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20450647 MysticGogeta : Wow! I like when people are shocked that a browser isn't perfect so they jump on every opportunity to flame/troll.
--
Team Discovery-Join the fight]]> http://www.dslreports.com/forum/remark,20450647 Thu, 08 May 2008 10:11:11 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20450471 fatness : Wired News article

quote:
Mozilla, the maker of the open source Firefox browser, is redoubling its efforts to check user created add-ons for viruses and Trojans after it discovered that a language pack on its official add-on page had been infected for months with rogue code, the organization reported Wednesday.

Starting in mid-Feburary, Vietnamese users of Mozilla's open source Firefox browser were at risk of infection from malicious Trojan Horse code seemingly accidentally embedded in a language pack available on its Add-ons site. The virus's signature was unknown at the time, and thus passed Mozilla's testing of add-ons.

The glitch isn't the first time that seemingly trusted software included rogue code, but such occurences are surprisingly rare given the amount of open-source and shareware programs that net users install based on blind trust. That's not even mentioning the huge selection of pirated software available on file sharing networks that could easily be infected with malware.

In response to the later discovery of the latent Trojan code by anti-virus software, Mozilla pulled the language pack and announced it would begin scanning all add-ons whenever they update their virus signatures, not just when add-ons are originally posted, according to a entry on the Mozilla security blog.


quote:
16,667 people had downloaded the add-on since November 2007.

--
Female monkeys often utter loud, distinctive calls before, during or after sex..]]> http://www.dslreports.com/forum/remark,20450471 Thu, 08 May 2008 09:26:44 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20450469 Steve :
said by Lanik See Profile :

I guess nobody reads links these days. Vietnamese language pack is an addon and doesn't ship with the browser. :uhh:
That it doesn't ship with the product doesn't mean that the vendor doesn't provide it
Micro$oft ships far worse, hActiveX comes to mind.
ActiveX isn't a thing that ships, it's an interface that everybody uses to create browser extensions. Blaming ActiveX is like holding an operating system liable because they provide a way to delete a file.
--
Stephen J. Friedl | Unix Wizard | Microsoft Security MVP | Tustin, California USA | my web site]]> http://www.dslreports.com/forum/remark,20450469 Thu, 08 May 2008 09:26:21 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20450393 Lanik : I guess nobody reads links these days. Vietnamese language pack is an addon and doesn't ship with the browser. :uhh:

Micro$oft ships far worse, hActiveX comes to mind.
--
"If it ain't broke don't fix it."]]> http://www.dslreports.com/forum/remark,20450393 Thu, 08 May 2008 09:09:45 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20450367 Davebo_ :
said by Steve See Profile :

said by goalieskates See Profile :

Oh grow up. I pick up more bad stuff using IE than I ever do using FF.
I think you're missing the point: here, the malware came from the vendor - Microsoft hasn't ever shipped malware, as far as I know, but Mozilla has.
Whatchu talking 'bout Willis!

SP 3 for XP was just recently released.... ;) Folks running OEM AMD machines would call SP3 malware.]]> http://www.dslreports.com/forum/remark,20450367 Thu, 08 May 2008 09:02:39 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20450161 slajoh01 : I agree, Firefox and Mozilla WILL become unsafe also just like IE.

Firefox is gaining momentum and its market share is picking up. And that will result in more exploitations.]]> http://www.dslreports.com/forum/remark,20450161 Thu, 08 May 2008 07:52:32 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20450123 donoreo :
said by Steve See Profile :

Microsoft hasn't ever shipped malware,
Depends on your definition of malware, doesn't it? :) ]]> http://www.dslreports.com/forum/remark,20450123 Thu, 08 May 2008 07:28:04 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20450118 Steve :
said by goalieskates See Profile :

Oh grow up. I pick up more bad stuff using IE than I ever do using FF.
I think you're missing the point: here, the malware came from the vendor - Microsoft hasn't ever shipped malware, as far as I know, but Mozilla has.]]> http://www.dslreports.com/forum/remark,20450118 Thu, 08 May 2008 07:26:00 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20450107 goalieskates :
said by matunga See Profile :

yet another demonstration that open source code is NOT safer than closed source code :)

Mozilla spreads malware rather than security:
»blogs.zdnet.com/hardware/?p=1813
Oh grow up. I pick up more bad stuff using IE than I ever do using FF. ]]> http://www.dslreports.com/forum/remark,20450107 Thu, 08 May 2008 07:21:33 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20450013 matunga : yet another demonstration that open source code is NOT safer than closed source code :)

Mozilla spreads malware rather than security:
»blogs.zdnet.com/hardware/?p=1813]]> http://www.dslreports.com/forum/remark,20450013 Thu, 08 May 2008 05:45:21 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20449527 mikenolan7 : It also highlights one of my concerns with a lot of software available by download - checksums not being provided. Perhaps checksums might have caught this before 16,000 people downloaded it. Of course there is no certainty in that, but I think it should be a part of quality control.]]> http://www.dslreports.com/forum/remark,20449527 Thu, 08 May 2008 00:42:04 EDT Re: Only Vietnamese language pack addon is affected http://www.dslreports.com/forum/remark,20449438 Steve :
said by SUMware See Profile :

Only Vietnamese language pack addon is affected
The point is not to get everybody to check their installations - I didn't download this pack and don't know anybody who did. Most people weren't affected.

This reveals a shocking lack of quality control. We're lucky it was "only" a Vietnamese language pack.
--
Stephen J. Friedl | Unix Wizard | Microsoft Security MVP | Tustin, California USA | my web site]]> http://www.dslreports.com/forum/remark,20449438 Thu, 08 May 2008 00:17:17 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20449251 AB :
said by Steve See Profile :

said by »blog.mozilla.com/security/2008/0···refox-2/ :

The Vietnamese language pack for Firefox 2 contains inserted code to load remote content. This code is the result of a virus infection ...
Been out there for 2.5 months! Wow!
Phân thần thánh! :o]]> http://www.dslreports.com/forum/remark,20449251 Wed, 07 May 2008 23:38:04 EDT Re: Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20449222 Cabal : I've seen worse add-ons. :D]]> http://www.dslreports.com/forum/remark,20449222 Wed, 07 May 2008 23:31:36 EDT Only Vietnamese language pack addon is affected http://www.dslreports.com/forum/remark,20449025 SUMware : Here's the rest:

"Everyone who downloaded the most recent Vietnamese language pack since February 18, 2008 got an infected copy. While we cannot determine the exact number of compromised downloads, there have been 16,667 total downloads of the Vietnamese language pack since November 2007, so we anticipate the impact on users to be limited.

Mozilla does virus scans at upload time but the virus scanner did not catch this issue until several months after the upload. We are also adding after-the-fact scans of everything to address this sort of case in the future.

A new language pack will be available shortly. Until then, Vietnamese language pack users should disable this package using the add-ons dialog on the Tools menu.

More information is available in bugzilla: https://bugzilla.mozilla.org/show_bug.cgi?id=432406"

According to Bugzilla the affected file was removed from public staging prior to 2008-05-06 11:06:44 PDT.]]> http://www.dslreports.com/forum/remark,20449025 Wed, 07 May 2008 22:59:26 EDT Wow! Mozilla distributing infected code! http://www.dslreports.com/forum/remark,20448839 Steve :
said by »blog.mozilla.com/security/2008/0···refox-2/ :

The Vietnamese language pack for Firefox 2 contains inserted code to load remote content. This code is the result of a virus infection, but does not contain the virus itself. This usually results in the user seeing unwanted ads, but may be used for more malicious actions.

...
Been out there for 2.5 months! Wow!]]> http://www.dslreports.com/forum/remark,20448839 Wed, 07 May 2008 22:31:55 EDT