Malware in Addons?

Add-ons Add-on Support
#1

I posted an issue on the Support forum regarding NetVideoHunter and another addon that are acting like they contain malware. They’ve asked me to post the details here.

I’ve recently installed Malwarebytes, and each time I click on the Addon NetVideoHunter in Firefox it blocks an outgoing connection. Here’s the report I get -

Blocked Website Details- Malicious Website: 1 Blocked,

-Website Data- Domain: www.adnetworkperformance. com IP Address: 130.211.186.109 Port: [50051] Type: Outbound File: C:\Program Files (x86)\Mozilla Firefox\firefox.exe

UnHackNe identifies NetVideoHunter as Malicious, so I’ve uninstalled it, performed a reset of FireFox and installed Flash Video Downloader. Unfortunately, that also seems to want to connect to a site whenever I click on it! Here’s the report for that -

-Blocked Website Details- Malicious Website: 1 Blocked,

-Website Data- Domain: speednetwork6.adk2x. com IP Address: 130.211.54.133 Port: [51719] Type: Outbound File: C:\Program Files (x86)\Mozilla Firefox\firefox.exe

UnHackMe also reports that Flash Video Downloader is a malicious app, so I’ve uninstalled that as well.

I’m now using Flash and Video Download. That doesn’t seem to want to connect to another website each time I use it, although UnHackMe seems to think that might be dodgy as well!

I’m fairly certain that the report for Flash and Video Download is a false positive. However, as NetVideoHunter and Flash Video Downloader are trying to connect to another site each time they are used, that suggests that all is not well.

I only ever install Addons from the Mozzilla repository, so I’m a bit surprised that I’m getting these reports of malware. If an addon is trying to connect to adnetworkperformance. com, then it doesn’t look like a false positive to me.

I’ve scanned my machine with the following programs -

Malwarebytes’ Anti-Malware Free
SuperAntispyware
Microsoft Safety Scanner
Anti-Rootkit Utility - TDSSKiller
AdwCleaner
HitmanPro
CCleaner
Zemana Antimalware
UnHackMe
Windows Defender

They all report that my machine is clean when the downloader addons are not installed.

The attempts to connect to websites that Malwarbytes blocks only happen when NetVideoHunter and Flash Video Downloader are installed. Even then, it only happens when the addon is clicked to download a video

UnHackMe identify both addons as malicious when they are installed, so it looks like the issue is contained within the addons.

To confirm that there is an issue with these addons, I used another machine, with a fresh install of Windows 10, Firefox, and Malwarebytes.

As soon as I added NetVideoHunter and clicked on it, it attempted to connect in the background to adnetworkperformance. com

#2

I installed NetVideoHunter and I can see why it’s sending a request to adnetworkperformance. The main add-on UI has an ad under the explanation on how to download videos. It’s very clearly an advertisement, so you can remove the add-on if you don’t like that. In itself that’s not considered malicious, though it’s understandable it would be flagged as adware by scanning tools.

It’s really up to you if you want to keep using such add-ons or not. Our role on AMO is to ensure the add-ons are safe to use and transparent to the user in what they do.

#3

Ok, not malware, but does it not break review policies?

Features like advertising or certain forms of user activity tracking may be required to be opt-in, or at least opt-out…

#4

In that case I don’t think it is necessary to make it opt-in or opt-out, since it’s easy to determine the ad comes from the add-on and the user can choose whether to keep it or not.