Is Firefox infected with malware?

There are stories flying all over the web today about Mozilla Firefox being infected with a worm thanks to a Vietnamese language pack. It turns out that while there’s a little truth in the stories the headlines blow things out of proportion. Luckily Mozilla’s Asa Dotzler has set the record straight.

It turns out that there was an infected computer, but it was the computer of an add-on developer that was working on the Vietnamese Language Pack, and as a result a remnant of the worm code made it into the language pack. While Mozilla scans every add-on that gets submitted to them, this worm was so new that it wasn’t included in the virus definitions yet. This same thing happened to a good friend of mine who had to completely reformat her hard drive and reinstall Windows when a new bugger got onto her hard drive before AVG got information about it into their daily virus definition updates. Even when you update your virus defs every day it can still happen.

The good news is that most Firefox users are safe and nobody needs to uninstall Firefox and reinstall it to protect themselves. As the Mozilla Security blog points out,

This code is the result of a virus infection, but does not contain the virus itself.  This usually results in the user seeing unwanted ads, but may be used for more malicious actions.

For more information read Asa’s post on Mozilla: For The Record as well as the post on the Mozilla Security blog. Asa also lays out what Mozilla is doing to help ensure this doesn’t happen again.

Remember, when you hear information about an open source program getting hacked or infected you should probably check out the developer’s web sites to see what the story really is rather than just reading what the tech publications and blogs are saying. The reputable open source devs are completely open when things like this happen and want to make sure their users are both informed and protected.

Thanks for posting so fast on this, Asa. I would have posted about it sooner myself, just to make sure the word gets out, but as a Linux user I tend to ignore some of the Windows-based vulnerability stories that I come across. Part of why I stopped using Windows is because I was so tired of having to be so bloody vigilant about my computer’s security.