SillyDog701

[J-M]

This is really interesting and dangerous threat. From the Heise Security article:

http://www.heise-security.co.uk/news/76019

The antivirus specialists at McAfee have warned of a Trojan that disguises itself as a Firefox extension.

And later:

Trojan then installs itself as a Firefox extension, presenting itself as a legitimate existing extension called numberedlinks. It then begins intercepting passwords and credit card numbers entered into the browser, which it then sends to an external server.

Information about numberedlinks project is available at http://numberedlinks.mozdev.org/

Technical description of this malware entitled as FormSpy is located here:
http://vil.nai.com/vil/content/v_140256.htm

I have written about this to my blog on Wednesday ( http://networksecurity.typepad.com/netw ... koile.html ), but information in English must be spreaded now.

UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.0; fi; rv:1.8.0.4) Gecko/20060508 Firefox/1.5.0.4

[Antony]

Thanks for the information J-M.

If the Trojan is able to fake its identity as (legitimate) numberedlinks, it's possible to pretend as any (other) Firefox extension.

Users should be careful where they install extensions from.

UserAgent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.0.5) Gecko/20060723 Firefox/1.5.0.5

[Fulvio]

This is not a legitimate attempt to install extentions which are listed. The article said that it is Spam Mail from an alleged Walmart site. Why would one want to open unrequested attaachment is beyond me. However, I felt that it was a matter of time for anyone to use such means. I would say, go easy on extentions, if any. Use K-Ninja or K-meleon which don't allow extention, AFAIK.

UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.13) Gecko/20060706 K-Ninja/1.1 (Samurai)

[Antony]

MozillaZine has an article on this now, Anti-Virus Firms Warn of Trojan Horse Mozilla Firefox Extension (MozillaZine, July 27th, 2006)

UserAgent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.0.5) Gecko/20060723 Firefox/1.5.0.5

[J-M]

Thanks for the article link. I have posted information to SD701 forum at first and then submitted a tip to MozillaZine.

UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.0; fi; rv:1.8.0.4) Gecko/20060508 Firefox/1.5.0.4