Mozilla, the company behind the popular open source browser Firefox, has just reported another malicious add-on which has been downloaded approximately 1,800 times from the AMO – the official add-on gallery. This add-on, Mozilla Sniffer, sends all submitted password field form data to a remote location. Hence, it tries to steal passwords of users who have installed this malicious add-on.
Mozilla explains this as:
It was discovered that this add-on contains code that intercepts login data submitted to any website, and sends this data to a remote location.
Unfortunately, more than 300 active users have still this add-on installed. According to the Mozilla, all current users will receive an uninstall warning soon. Thankfully, the Mozilla Sniffer was not reviewed and approved by the Mozilla editors. The add-on was marked as experimental, and has been removed from the AMO now. Also, a security vulnerability has been discovered in another add-on: CoolPreviews.
This is not the first case when an add-on is reported to be malicious. In past, two experimental Firefox add-ons were discovered to be containing Trojans. Though, later Mozilla found these reports false.
How To Be Safe?
Mozilla already ensures safety of users, and manually reviews every new add-on and updated versions of older add-ons. Before review, the add-ons are marked as experimental to avoid such troubles. Moreover, users should not install Firefox add-ons from un-trusted sources.
[ via ]
