Mozilla has announced the removal of two add-ons, Bypass and Bypass XM, from the addons.mozilla.org (AMO) directory, which had 455,000 active installations and were marketed as add-ons for providing access to paid subscription materials (paywall bypass). These add-ons used the API Proxy to modify traffic, allowing control over the web requests executed by the browser. In addition to the stated functionalities, the add-ons utilized the API Proxy to block requests to Mozilla servers, preventing updates to Firefox and leading to an accumulation of unpatched vulnerabilities that could be exploited by attackers to compromise user systems.
Notably, in addition to preventing updates to Firefox versions as a result of the activities of the reviewed add-ons, the updating of remotely configurable components of the browser was also disrupted, and access to block lists that allowed the disabling of already installed malicious add-ons was blocked. Users are advised to check their current browser version — if automatic updates are not specifically disabled in the settings and the version differs from Firefox 93 or 91.2, a manual update should be performed. In new releases of Firefox, the Bypass and Bypass XM add-ons are already included on the blacklist, so they will be automatically disabled after the browser is updated.
To prevent the future placement of malicious add-ons that block updates and blacklists, changes have been made in the code starting with Firefox 91.1, implementing direct requests to update and download servers if a request through the proxy fails. To extend this protection to users of any version of Firefox, a forcibly installed system add-on called 'Proxy Failover' has been prepared, which prevents the improper use of the API Proxy to block Mozilla services. Until this proposed protection method is widely deployed, the acceptance of new add-ons that use the API Proxy into the addons.mozilla.org directory has been suspended.
Source: opennet.ru
