Sunday, August 16, 2009

[qvrersni] Noscript adware backdoors

Noscript is subtly adware, and the developer has previously included backdoors (disabling AdBlock) to perpetuate its adware-ness, and at least one backdoor (default whitelisting noscript.net) is still in place. Here is how to avoid having your privacy violated.

  1. Print or locally save these directions, because for many of the steps you will not be connected to the internet.
  2. Get Noscript by searching google for noscript, and going to addons.mozilla.org site. DO NOT go directly to noscript.net. Or follow this link: https://addons.mozilla.org/addon/722
  3. Click on "Add to Firefox", and install the extension. Do not click on "Restart Firefox". Do NOT allow firefox to automatically restart itself. DO NOT ALLOW FIREFOX TO AUTOMATICALLY RESTART ITSELF!!!
  4. Instead, close the installation window.
  5. Go to the File menu, and choose "Work Offline". (Alternatively, pull your network cable).
  6. Quit firefox manually.
  7. If you are extremely diligent, you should review the source code of the noscript that just got installed.
  8. Start firefox. You will see that firefox will attempt to to open up the page "http://noscript.net", but because you are working offline, it will fail.
    Who knows what lurks on that page? Especially since noscript.net is by default WHITELISTED by noscript itself. These days, the page serves advertisements (the developer claims these advertisements help pay for development of noscript). These advertisements, as well as noscript.net are likely violating your privacy in many ways: logging your IP address, browser version, operating system, time and date of installing noscript, installing cookies, possibly exploiting browser and flash vulnerabilities. If your DNS gets hacked, "noscript.net" might not even be the developer's website.
  9. Click on the "S" in the lower right hand corner, and choose Options.
  10. Under the Whitelist tab, remove all of the websites. This can be done by selecting the first one, scrolling down, and shift clicking the last one, then clicking "Remove Selected Sites". The grayed out sites cannot be removed, but that's OK (I think).
  11. Under the Notifications tab, uncheck "Display release notes on updates". (This is the second insidious adware aspect of Noscript: every time there's an update, which is quite frequently, the extension will send you to noscript.net, triggering the advertising privacy violations as liste above.) I have not tested whether unchecking this works; there has not been an update yet since I created this document.
  12. (Optional) Under the Plugins tab, check "Apply these restrictions to trusted sites too". Because you deleted the default whitelist, you will need re-enable them manually (if you wish). It is better to enable javascript and plugins, especially flash, separately.
  13. Close the Options window, by clicking "OK"
  14. Go to the "about:config" webpage
  15. You will notice some additional noscript backdoors: noscript.clearClick.exceptions, noscript.clearClick.subexceptions, noscript.forbidJarDocumentsExceptions. Clear the values of these configuration variables. I haven't tested whether this breaks things.
  16. File menu, uncheck "Work Offline".
  17. Finally, reflect upon yourself whether you should actually trust a developer who includes such backdoors in his software. Noscript is GPL, so I would appreciate a fork with the adware and backdoors removed.

No comments :