Mozilla blocks rogue Firefox add-on

Stephen Withers
Friday, 16 July 2010 10:39

Business IT - Open Source

Mozilla has added a malicious add-on to the Firefox blocklist. A second add-on with a serious security vulnerability is also heading for the blocklist.

A Firefox add-on called Mozilla Sniffer has been found to intercept login details from any site visited. It then forwards the details to a remote server.

Mozilla Sniffer has now been added to the blocklist, which means existing users will be prompted to uninstall it.

Despite the name, the add-on was not developed by Mozilla. Its stated function was to allow the display and modification of HTTP and HTTPS headers. In the Trojan Horse tradition, it also forwarded the form data from any page containing a password field to another site.

According to Mozilla, Mozilla Sniffer has been downloaded approximately 1800 times and has less than 350 active daily users.

Mozilla Sniffer had not been code-reviewed by Mozilla. The malicious nature of the add-on was a chance discovery by Johann-Peter Hartmann of Germany-based security company SektionEins.

Another add-on is being placed on the blocklist due to a security vulnerability - see page 2.