Mozilla Removes 23 Firefox Add-Ons for Logging Browser History and Sending to Unsecure Servers

Mozilla has deleted as many as 23 Firefox add-ons after being caught for covertly logging browser history of users. At first, an add-on called Web Security was deleted for tracking web history and sending data to servers in Germany. However, upon further inspection, multiple add-ons with different features were found to run the same code, and action against these has also been taken. Mozilla engineer Jorge Villalobos explained in a Bugzilla update that action against these add-ons was taken not because they checked visited webpages, but that it sent more data than what seemed necessary to operate, and that some data was sent unsafely.

The 23 add-ons were wiped out from the Firefox list, along with Web Security, which was included in a list of recommended add-ons posted on the official Firefox blog just last week, ZDNet reported. This add-on clocked as many as 220,000 downloads, and was found to be quite popular. German security researcher Mike Kuketz first found out that We Security clocks users browser history and sends it over an unencrypted HTTP channel. This exposes the users' data to hackers and other attacks.

The removed add-ons include Quick AMZ, SmartTube, Popup Blocker, DirtyLittleHelpers, YTTools, Browser Security, and more. You can check the full list here. In the Mozilla Bugzilla update, Villalobos mentioned that these add-ons were removed because they sent some data unsafely, without alerting the user, and that these add-ons had different features, and different authors, but all had the same code. Villalobos notes that further inspection revealed that these add-ons could all be of the same person/group, and may pose threat.

Check the list to see if you have any of these add-ons installed, and disable them if they still exist. Firefox does note that these extensions cannot be downloaded any more, and that they have been disabled remotely for users who have them installed.

Editor's Note: Popup Blocker Ultimate was incorrectly included in the list of pulled add-ons, when Popup Blocker was the one pulled. The error is regretted.