It seems that Mozilla’s quest for protecting privacy in its products has intensified.
The company has recently banned 197 Firefox add-ons that its add-on review team caught gathering user data illegally, executing malicious code, or using obfuscation.
Mozilla has banned and removed the identified add-ons from Mozilla Add-on (AMO) portal in order to make sure any new installs are prevented. In addition, the company has also disabled these add-ons, if already installed, from the users’ browsers.
“We’ve learned that creating products with privacy by default is very powerful. It’s ‘unrealistic’ to expect consumers to read all the privacy policies and options in a product to protect themselves,” Alan Davidson, vice-president for global policy, trust and security at Mozilla, which makes the Firefox browser, said at the Ottawa hearing on big data firms in May, 2019. “To make privacy real the burden needs to shift from consumers to companies.”
The names of these add-ons have not been listed, but the company has revealed their IDs so add-on developers can appeal the ban and remove malicious behaviour.
One add-on that passed the appeal process was the Like4Like.org Addon, originally suspected of gathering and submitting tokens of social media websites of users or their credentials to another website, states an article by ZDNet.
Out of the 197 Firefox add-ons that have been banned, 129 were downloading and executing code from a remote server – all developed by a single B2B software provider company called 2Ring.
Among add-ons banned for intercepting and gathering user search terms were FlixTab, FlixTab Search, ConvertToPDF, EasySearch for Firefox, and EasyZipTab.
Six add-ons developed by Tamo Junto Caixa, and three add-ons that were found out to actually be fake premium products were banned for downloading and executing remote code in users’ Firefox browsers.
As per the rules laid down by Mozilla, it is mandatory for all add-ons to self-contain all their code, and not download code dynamically from remote locations. The company has recently started to grow a lot more strict around its add-on ecosystem.
The company’s security staff banned Pdfviewer – tools, WeatherPool and Your Social, Rolimons Plus, RoliTrade, and an unnamed add-on for illegally gathering user data.
Mozilla’s add-on review team also banned a batch of two, three and nine add-ons that were caught using obfuscated code to hide malicious behaviour. Obfuscation is a technique used by add-on developers to make their code illegible to hide their source code.
The FromDocToPDF add-on was also behaving maliciously by loading remote content into a new tab page of Firefox, as spotted by Mozilla engineers. In addition, Fake Youtube Downloader, a Firefox add-on, was banned for attempting to install other malware in users’ browsers.
The remaining 30 add-ons were banned for exhibiting malicious behaviours.
In June 2019, Mozilla Firefox browser had started to block hideous tracking cookies that scraped the surfing patterns of the users. Mozilla said it is hoping to turn cookie blocking to a standard and not just a feature, given the rising volume of data leaks across all digital sectors.
