This is a long time coming – Firefox extensions that have malicious intent. Because Firefox extensions are executable code, the coder can do anything he wants, as long as he can code it.
A person posted an advisory in Bugtraqdetailing a Firefox extension he created which is capable of sniffing passwords in HTML forms. The Firefox extension, which he dubbed has the name FFsniFF (FireFox sniFFer).
It should be noted that this is neither a bug nor a vulnerability in Firefox. Firefox extensions are executable code; the creator can do anything he/she desires.
If a user is indeed infected by a malicious Firefox extension, the infection is only limited to that user; it is not system-wide. For Windows XP/2000 users, each user’s set Firefox extensions is independent from one another. The extensions are stored in each respective user’s profile. The same goes for Linux users. Users using the same system does not share the same set of extensions.
However, this could become problematic for users in Internet cafes, where it is customary that only one user account is used throughout.
Malicious Firefox extension can be avoided, easily – do not install extensions from untrusted sources. Only install extensions coming from the official Firefox extension repository.
Firefox itself warns users before installing any extensions.
Malicious software can damage your computer or violate your privacy.
You should only install software from sources that you trust.
It’s time to consider those warnings, seriously.
