Firefox Plugin Shipped with Malicious Code

Because of a virus infection, the Vietnamese language pack for Firefox 2 was polluted with adware.


Mozilla: Firefox Plugin Shipped With Malicious Code

Mozilla warned Wednesday that a malicious program inserted adware code into a Firefox plugin that has been downloaded thousands of times over the past three months.

Because of a virus infection, the Vietnamese language pack for Firefox 2 was polluted with adware, Mozilla security chief Window Snyder said in a blog posting. "Everyone who downloaded the most recent Vietnamese language pack since February 18, 2008 got an infected copy," she wrote. "Mozilla does virus scans at upload time but the virus scanner did not catch this issue until several months after the upload."

Mozilla is now going to add additional scans of its software to prevent this kind of thing from happening in the future, she said.

The malware in the language pack is from the Xorer Trojan, according to discussion on Mozilla's Bugzilla developer Web site, which indicates that Mozilla developers first discovered the issue on Tuesday.

"I think it (happened) just because the author's local network was infected with the virus, so it modified HTML files," wrote developer Hai-Nam Nguyen. "The infected code just display(s) annoying banner but it can't propagate."

The open-source browser maker does not know how many people were infected with the adware, but the plugin was downloaded more than 1,200 times in the past week and has been downloaded 16,667 times since November.

On Wednesday afternoon, the Web page for the plugin was off-line as Mozilla scrambled to come up with a new, adware-free version of the language pack. In the meantime, users of the software should disable the plugin, Snyder said.

iPhone's First Trojan

The Trojan specifically targets users that have modded their iPhone so they can install third-party applications.

First Trojan Reported for the iPhone

While not a huge risk, the first Trojan for the iPhone has been discovered. The first reports came from iPhone enthusiast site Modmyifone.com and were later confirmed by security research company F-Secure.

The Trojan specifically targets users that have modded their iPhone so they can install third-party applications. The application masks itself as an update to Erica's Utilities and is labeled as "113 prep."According to Modmyifone.com all the app does is say "shoes."

However, when uninstalled, the application removes files from the /bin directory on the iPhone, breaking valid apps like Sendfile and Erica's Utilities.The Web site hosting the application was taken offline soon after it was discovered, reports F-Secure.

"Hopefully this serves as a warning for those who have opened their iPhones using a security hole in the system and then installing unverified software without a second thought to what they are doing," said F-Secure on its Web site.F-Secure reported that it was an 11-year-old kid playing with XML files who created the Trojan. "Next time it might be someone else with more skills and with specific target," they said.