Mozilla add-ons - 2 infected at AMO...

FYI…

- http://blog.mozilla.com/addons/2010/02/09/…security-issue/
February 9, 2010 - "… the suspected trojan in Version 4.0 of Sothink Video Downloader was a false positive and the extension does not include malware. The same investigation also confirmed that the Master Filer extension included a valid instance of a trojan. Our estimate of 6,000 affected downloads has been revised to under 700. The Sothink Video Downloader has been re-enabled on AMO. We apologize to our users and the developers of Sothink for any inconvenience this has caused…"

Mozilla add-ons - 2 infected…
- http://blog.mozilla.com/addons/2010/02/04/…y-issue-on-amo/
February 4, 2010 - "Two experimental add-ons, Version 4.0 of Sothink Web Video Downloader and all versions of Master Filer were found to contain Trojan code aimed at Windows users. Version 4.0 of Sothink Web Video Downloader contained Win32.LdPinch.gen, and Master Filer contained Win32.Bifrose.32.Bifrose Trojan. Both add-ons have been disabled on AMO.
Impact to users:
If a user installs one of these infected add-ons, the trojan would be executed when Firefox starts and the host computer would be infected by the trojan. Uninstalling these add-ons does -not- remove the trojan from a user’s system. Users with either of these add-ons should uninstall them immediately. Since uninstalling these extensions does not remove the trojan from a user’s system, an antivirus program should be used to scan and remove any infections…
Versions of Sothink Web Video Downloader greater than 4.0 are not infected. Master Filer was downloaded approximately 600 times between September 2009 and January 2010. Version 4.0 of Sothink Web Video Downloader was downloaded approximately 4,000 times between February 2008 and May 2008. Master Filer was removed from AMO on January 25, 2010 and Version 4.0 of Sothink Web Video Downloader was removed from AMO on February 2, 2010. AMO performs a malware check on all add-ons uploaded to the site, and blocks add-ons that are detected as such. This scanning tool failed to detect the Trojan in Master Filer. Two additional malware detection tools have been added to the validation chain and all add-ons were rescanned, which revealed the additional Trojan in Version 4.0 of Sothink Web Video Downloader. No other instances of malware have been discovered…"

<_<

This is a little scary, and confusing for many I suspect. Especially when FF users see "new" reports (from today) like this from PCMech, Malicious Firefox Extensions Exist. Note where it says,

Anti-virus scanners may not catch malicious Firefox add-ons because they are a different kind of beast, so your best protection is exercising caution.

And yet if you follow his links, you find where Mozilla listed 2 weeks ago AVs that would do the job, I am sure by now the others have caught up.

Also a problem is that report warns,

The important thing to remember is to only install add-ons from sites you trust (i.e. Mozilla’s Official Add-On Site).

Normally, that would be good advice, but the problem is, and a critical omission, IMO, if you follow the PCMech links again, you come the A+'s 2nd link where I note it says,

Both add-ons have been disabled on AMO.

Which, of course, indicates they were available on the Official Add-On Site.

.., they were available on the Official Add-On Site.

Things change quickly on the Web. Please note the last edit/date-of-entry there - February 9, 2010.

Nothing to get freaky about - that's the way it is.

.

Things change quickly on the Web

And that was my point about the PCMech article.