A trojan attacks Firefox masquerading as Adobe Flash Player update

By franzon
in Back Page News

 Share

Recommended Posts

Mentor

franzon

Posted
Posted

Trend Micro threat analysts were alerted to the discovery of a spyware (detected as TSPY_EBOD.A) purporting to be an Adobe Flash Player update. Upon execution, the spyware creates a Firefox add-on called ?Adobe Flash Player 0.2,? the installer of which uses JavaScript (detected as JS_EBOD.A) and appears to spread via forum posts.

TSPY_EBOD_A.jpg

The said add-on injects ads into the user?s Google search results pages. More disturbing, however, is its capability to monitor the user?s browsing activities, particularly his/her Google search queries using the Firefox browser. It then sends the information it gathers to http://{BLOCKED}jupdate.com.

We have seen a lot of malware target Internet Explorer in the past. This is probably one of the reasons why a huge number of users are opting to use alternative browsers such as Firefox, Chrome, Safari, and Opera instead. Though this used to be considered a safe computing practice it seems it no longer is with the proliferation of malware targetting the most popular alternative Internet browser?Firefoxor:rolleyes::rolleyes:

http://blog.trendmicro.com/firefox-addo-sp...search-results/

Grand Master

Miuku.

Posted
Posted
probably going to get blocked with an update

Seeing as you have to accept it, wait for 5 seconds and then accept to install it AGAIN..

I'll be right back. I'll create a trojan that erases your entire hard drive after you you press "Yes I'm an idiot, I actually pressed run twice on this application, first to download it and then to execute it and now I'm screwed."

Grand Master

supernova_00

Posted
Posted
Seeing as you have to accept it, wait for 5 seconds and then accept to install it AGAIN..

I'll be right back. I'll create a trojan that erases your entire hard drive after you you press "Yes I'm an idiot, I actually pressed run twice on this application, first to download it and then to execute it and now I'm screwed."

Extensions can be easily installed without prompt. Not through Firefox but through Windows.

Grand Master

supernova_00

Posted
Posted
Yeah, amazing how secure is FireFox..... :unsure:

I edited my comment as it wasn't completely accurate. You can download the .xpi file and unzip it to your profile without the prompt but you will always be notified that a new extension was installed. Just like when MS installed the .net framework extension or whatever the heck it was without the user consenting.

Grand Master

ToneKnee

Posted
Posted
I edited my comment as it wasn't completely accurate. You can download the .xpi file and unzip it to your profile without the prompt but you will always be notified that a new extension was installed. Just like when MS installed the .net framework extension or whatever the heck it was without the user consenting.

But that required a user to install something to do that in the first place.

Grand Master

dead.cell

Posted
Posted
Though this used to be considered a safe computing practice before, it seems it no longer is with the proliferation of malware targetting the most popular alternative Internet browser?Firefoxb>:rolleyes:s:

Right. Like we're all going to stop using Firefox because of this:rolleyes:s:

Community Regular

Tech Geek Alex

Posted
Posted
Seeing as you have to accept it, wait for 5 seconds and then accept to install it AGAIN..

I'll be right back. I'll create a trojan that erases your entire hard drive after you you press "Yes I'm an idiot, I actually pressed run twice on this application, first to download it and then to execute it and now I'm screwed."

That is because you read - As the very old saying goes "There is one born every minute". And I make my living cleaning up after they click 2x's without reading what they are clicking on.

Veteran

toadeater

Posted
Posted
I edited my comment as it wasn't completely accurate. You can download the .xpi file and unzip it to your profile without the prompt but you will always be notified that a new extension was installed. Just like when MS installed the .net framework extension or whatever the heck it was without the user consenting.

I'm surprised Mozilla didn't complain to MS about this incident. Not only was it installed without permission, not only did it introduce a vulnerability into Firefox, but MS didn't provide an uninstaller! Doesn't that classify as malware?

Adobe and Apple too pulled something similar by silently installing the Bonjour service onto PCs via Photoshop. No one should be allowed to do this kind of thing. If companies like MS, Adobe, and Apple want to put themselves on the level of the tech industry's criminals then they have to face the consequences.

Hey, Obama, how about passing a bill to outlaw corporate spyware, instead of more bills for spying on computer users!

Grand Master

Eric Veteran

Posted
  • Veteran
Posted
I'm surprised Mozilla didn't complain to MS about this incident. Not only was it installed without permission, not only did it introduce a vulnerability into Firefox, but MS didn't provide an uninstaller! Doesn't that classify as malware?

Adobe and Apple too pulled something similar by silently installing the Bonjour service onto PCs via Photoshop. No one should be allowed to do this kind of thing. If companies like MS, Adobe, and Apple want to put themselves on the level of the tech industry's criminals then they have to face the consequences.

Hey, Obama, how about passing a bill to outlaw corporate spyware, instead of more bills for spying on computer users!

The .NET plugin is a plugin, not an addon. It's installed as part of the Framework and Mozilla simply picks it up. Same as installing the Flash player plugin without Firefox. FF will add it automatically upon installation. Firefox is responsible for the security of its own script addons, not Microsoft.

Community Regular

Eice

Posted
Posted
Seeing as you have to accept it, wait for 5 seconds and then accept to install it AGAIN..

I'll be right back. I'll create a trojan that erases your entire hard drive after you you press "Yes I'm an idiot, I actually pressed run twice on this application, first to download it and then to execute it and now I'm screwed."

When you get off your high horse and stop assuming that a program is secure just because it prompts you on everything, you'll realize that social engineering is exactly how malware spreads these days.

Not only was it installed without permission, not only did it introduce a vulnerability into Firefox, but MS didn't provide an uninstaller! Doesn't that classify as malware?

Yes, a program exhibiting those characteristics would. Unfortunately, due to your ignorance, you are led by rabidly paranoid hype into believing that the .NET plugin exhibits those characteristics.

Contributor

toki

Posted
Posted
I'm surprised Mozilla didn't complain to MS about this incident. Not only was it installed without permission, not only did it introduce a vulnerability into Firefox, but MS didn't provide an uninstaller! Doesn't that classify as malware?

I think you have a wrong computer software knowledge mate.

The FireFox ADDON/Extension, have NOTHING to do with Microsoft. The problem is in FireFox square.

Grand Master

ichi

Posted
Posted
The .NET plugin is a plugin, not an addon. It's installed as part of the Framework and Mozilla simply picks it up. Same as installing the Flash player plugin without Firefox. FF will add it automatically upon installation.

The .NET plugin provided an uninstallable extension.

Yes, a program exhibiting those characteristics would. Unfortunately, due to your ignorance, you are led by rabidly paranoid hype into believing that the .NET plugin exhibits those characteristics.

Did it install an extension without permission? Check.

Did it introduce a vulnerability? Check.

Did it not provide an uninstaller? Check.

I wouldn't qualify it as malware as that would imply an intention to do harm that I'd hope this didn't, but it still shares those three qualities though.

This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.

  • Posts

    • Amazon Greenlights A New "Stargate" Series

      By Som · Posted

      https://www.change.org/p/save-the-new-stargate-series-let-martin-gero-build-the-future-of-the-franchise?utm_source=share_petition&utm_medium=mobileNativeShare&utm_campaign=share_petition&recruited_by_id=376d0b10-cf3c-11e7-a513-03b837c94000&recruiter=836653795&share_id=jVyr5PGfkN Petition for anyone who's interested 
    • Here's how to watch Summer Game Fest 2026 and what to expect from the 2-hour showcase

      By LoneWolfSL · Posted

      Here's how to watch Summer Game Fest 2026 and what to expect from the 2-hour showcase by Pulasthi Ariyasinghe The June game showcase schedule is packed, and with the Sony event already behind us, it's time for the next major presentation to come in swinging. Later today, Geoff Keighley will be bringing the 2026 edition of Summer Game Fest live from the Dolby Theatre in Los Angeles, California. For anyone wanting to tune in online, the Summer Game Fest showcase livestream will be kicking off at 2 PM PT | 5 PM ET | 10 PM BST later today, June 5. The jam-packed show is slated to run for about two hours, with platforms like YouTube (4K at 60FPS), Twitch, Facebook, or X being available for catching it. Like in previous years, separate streams featuring American Sign Language and Descriptive Audio are available on YouTube as well. Keighley has only dropped a few teasers about what gaming fans can expect to see at the show. This includes a new look at Star Wars Zero Company from EA, a major announcement from Guild Wars developer ArenaNet, more Clutch gameplay, and some sort of Sega presence. As for fan expectations, there is hype building about a Final Fantasy 7 Remake Part 3 reveal here, and we might see new details about announced games like Alien Isolation 2 as well. If you want even more games, keep in mind that right after the main kickoff event, the Day of the Devs showcase will begin its own festivities at 4 pm PT | 7 pm ET. This is focused entirely on upcoming indie games. Following this, the next major games showcase is slated to happen on June 7. Here, Microsoft is bringing the big guns with its Xbox Games Showcase and Gears of War E-Day Direct. Check out the full calendar for all of the June events over here.
    • Ladybird Browser is no longer accepting outside contributions thanks to AI

      By Reancarnation_X · Posted

      AI is destroying jobs like nothing before
    • Microsoft is making Windows 11's context menus faster, simpler, and configurable

      By +samw61 · Posted

      I think the car analogy is more this: Left hand drive, basic commands on the left side of the infotainment screen. Right hand drive, basic commands on the right side of the infotainment screen. Granted, you're not swapping between the two often so it's doesn't really work. But it's to do with the proximity of you (your mouse, or the driver) to the controls.
    • Microsoft is making Windows 11's context menus faster, simpler, and configurable

      By +samw61 · Posted

      I mean, the old one was broken and so stupidly complex for many users, so I don't see that as a feasible option. A context menu needs to be simple to use, and for me the Windows 11 style actually worked really well for me, and many others. I used to have to scroll the damn context menu just to get to "file properties" in Windows 10. That was not a good experience, and I'm sure you'd agree. What they're trying to do is make it the best of both worlds, as clearly you'd prefer the Win10 style. I'm curious how they're going to do this.

  • Recent Achievements

    • Conversation Starter
      FBSPL earned a badge
      Conversation Starter
    • Week One Done
      I2D earned a badge
      Week One Done
    • Week One Done
      Dr Jared Dental Studio earned a badge
      Week One Done
    • Week One Done
      RG INVESTMENT GROUP earned a badge
      Week One Done
    • Very Popular
      The Norwegian Drone Pilot earned a badge
      Very Popular

  • Popular Contributors

    1. 1
      +primortal
      486
    2. 2
      PsYcHoKiLLa
      263
    3. 3
      Skyfrog
      86
    4. 4
      FloatingFatMan
      64
    5. 5
      Michael Scrip
      63
    Show More

  • Tell a friend

    Love Neowin? Tell a friend!