Spyware found in Firefox add-on IE Tab Plus 1.95 !

[hackerman1]

hi !

i actually found this story in a thread under "Browsers", but thought it also should be posted here under "Security".

Spyware found in Firefox add-on IE Tab Plus 1.95 !

"Just a heads up for those sys admins who might be using the IE Tab Plus (3.6+) in a corporate enviroment (lan/intranets/webguis etc)
or you just value your security and privacy,
the current update being pushed out for this Firefox Addon is also installing without notice
components that capture all URLs/refferers visited as well as numerous other user statistics and
transmit them back to superfish dot com via a hidden https XSS request (3600000ms)

if you have these files in your profiles extensions subdirectories located in
\yourFFprofiledirectory\extensions\[email protected]\com ponents

nsSuperfishComponent.js (5.4k)
nsSuperfishProgressListener.js (15.7k)
nsSuperfishStatistics.js (16.5K)
nsSuperfishUtils.js (60.8k)

then you have the spyware installed"

the full story: Spyware found in (Coral) IE Tab Plus (3.6) - 1.95 mozillaZine Forums​

 

[Phone Man]

The "feature" is called Windows Shopper and has been removed in newest release. It should not have been added in the first place and I have removed the add-on and will not reinstall it.

mozdev.org - coralietab: installation

Jim

 

[hackerman1]

The "feature" is called Windows Shopper and has been removed in newest release.

i know, i read the thread over at mozilla....

It should not have been added in the first place and I have removed the add-on and will not reinstall it.

yes, i was thinking the same, but the other IE Tabs doesn´t work on FF 4-beta6.
but when IE-Tab2 works on FF 4...
i have 1.94, but i have checked the folder anyway, just in case....