Main Area and Open Discussion > General Software Discussion

How to prove which Firefox add-on is trying to access 128.127.110.10 ?

(1/4) > >>

IainB:
For some time now, my Malwarebytes has kept announcing that it has blocked an attempt to access 128.127.110.10 - which is in MWB's blacklist. I checked, and it seems to be an IP address in Denmark. The certainty of this location may be in some doubt, as, when I googled it, various diverse and misleading results popped up in the search.

The MWB announcement occurred every time I started up Firefox. I therefore concluded that a FF Add-on was probably making the outgoing call - i.e., rather than FF itself.
I was going to post a query in DCF today to ask for help but have luckily discovered, by a process of elimination, that it is the FF add-on Google Reverse Image Search that is apparently making the calls.

The call to that IP address occurs every time FF is started up, without fail.
Disabling/removing the add-on causes the calls to not occur when FF is started up (all other features of FF remaining the same).

I had previously searched for that IP address string inside the files in the directory for FF and for its add-ons, but did not come up with any hits.

I would be interested if anyone has any ideas as to how you could identify/prove the source of such an outgoing call from an add-on, other than the hit-or-miss process of elimination that I employed.

Curt:
The various security related programs that I have, can merely tell it came from Firefox, not which add-on.

Carol Haynes:
Simple - disable 50% of your addons and see if it goes away - and continue by salami tactics until you find the offending addon!

Should be able to get it in a few tries.

Don't know any other way to do it.

4wd:
Probably the most efficient way to narrow it down is just using a good old fashioned binary chop search on your add-ons.  eg. For my 25 add-ons it would have taken a maximum of 5 Firefox restarts to find the offensive add-on.

Worst cases:
Disable 13
Disable 6
Disable 3
Disable 1 - at this point you've found it, or
Disable 1 - it's this one or the one still enabled.

Disable 13
Enable 7 + Disable other 12
Disable 3
Disable 2
Disable 1 - this one or the one still enabled.

EDIT: Carol beat me :)

IainB:
Simple - disable 50% of your addons and see if it goes away
-Carol Haynes (July 06, 2012, 07:48 AM)
--- End quote ---
Yes, that's exactly what I did - that's what I mean by "a process of elimination".
I felt sure there could be a more techie approach though!

Navigation

[0] Message Index

[#] Next page