One usually doesn’t question the trustworthiness of a Firefox extension from Mozilla’s official add-on site, but in the case of the recently removed “YouTube Unblocker”, that faith would have been misplaced. The add-on is no longer available, after being removed by Mozilla for violating the organisation’s extension guidelines.
This post was originally published on Lifehacker Australia.
Late last month, a bug report was filed with Mozilla for YouTube Unblocker when it was discovered the extension performed some suspicious background actions without informing the user, including downloading and installing another add-on:
I installed the add-on “YouTube Unblocker” version 0.6.20 from AMO. Immediately after installing my antivirus software (Avast) warned me of a blocked download from a third-party website associated with neither Mozilla nor the add-on. The download was another add-on which Avast categorized as malware.
After poking around a bit, the bug reporter uncovered exactly how the add-on did its less than wholesome work:
This addon had no name and was modified in a way that it did not show up under about:addons, so it stayed invisible to the user. The addon file was called watcher.xpi (attached), was saved in the Firefox profile folder and got enabled without user feedback. As far as I could tell the addon did nothing useful, except repeatedly transmitting information to another anonymously registered domain watcher.aws.sparpilot.com … There was no option to disable this behaviour and the privacy statement of Youtube Unblocker made no mention of this second addon. Even after uninstalling Youtube Unblocker, watcher.xpi stayed installed and active.
Once the report was filed, it didn’t take long for Mozilla to yank the extension. If you visit its page, you’ll see it has disappeared, however, the original still exists in Google’s web cache (for now at least).
Its unfortunate that the extension slipped through the cracks, but at least Mozilla was quick to do something about it once the behaviour was discovered.