Mozilla developers have taken steps to ban the popular YouTube Unblocker add-on after it was caught changing the browser's security settings by installing a second add-on without the user's consent.
YouTube Unblocker is a Firefox add-on that allows users to watch YouTube videos that are blocked in their country. It does this by using a collection of proxy servers that reroute YouTube content through countries where the videos are allowed.
Last weekend, a user complained that the add-on was exhibiting sneaky behavior, saying that his Avast antivirus blocked a download coming from a third-party website immediately after he installed the YouTube Unblocker add-on.
The user analyzed the add-on's source code and found that this extension changed the browser's default settings by installing a new user.js configuration file
This file contained options that disabled the Firefox built-in add-on signing feature. This feature prevents the browser from installing unsigned add-ons that have not been tested (and signed/certified) by Mozilla. Code signing is a recent security feature added to Firefoxthat Mozilla deemed necessary to prevent situations like these.
With this feature disabled, YouTube Unblocker was downloading another add-on called Adblock Converter, which Avast flagged as malware.
Things became mysterious because this add-on did not appear on the standard Firefox Add-ons page (about:addons) and was re-enabled on its own once the user managed to disable it when starting Firefox in Safe Mode.
After Mozilla investigated the user's complaint, YouTube Unblocker was removed from Mozilla's official Add-ons website. In justifying their decision, Mozilla staff also referred to another similar report from June 2015, where the add-on contained code to update itself and allowed its operator to update the add-on without going through Mozilla's review process.
The add-on remains available via its homepage. Before it was taken down, the add-on had been installed on over 250,000 Firefox browsers. Users who want to get rid of the add-on entirely can follow the steps provided by Ghacks.
