Firefox = Spyware ?

Discussion in 'other software & services' started by CloneRanger, Dec 31, 2016.

  1. CloneRanger

    CloneRanger Registered Member

    Joined:
    Jan 4, 2006
    Posts:
    4,978
    Well it sure seems like it !

    Recently when i ran Eassos Recovery it discovered, amongst other things, Lots of screenshots of web pages i had logged into. These were both HTTP & HTTPS ! Including Hotmail & Wilders. Fortunately no log in usernames or passwords were shown. I'm presuming it's because i have Zemana free Antilogger installed.

    Obviously i was very concerned, but wondered how it could be happening, as i am Very careful, & have very good security measures in place. I ran a number of tools, including Rootkit Detectors etc, but couldn't see anything out of place. Wanting to get to bottom of this, i contacted a well known Anti Malware vendor who most of you would recognise. As i havn't asked permission to release his name yet, i won't say for now. He kindly agreed to do a remote into my comp, which took place yesterday.

    It was fascinating to watch him do all he did. Eventually he suspected it might be FF related, & sure enough it was ! He discovered that FF stores thumbnails of visted pages, Without your knowledge or permission ! So thankfully i wasn't being screenshotted by regular type malware, but who would expect FF to be doing that ? Since then i found out i'm not the only one who's had this issue.

    Here's how to disable the stupid thing.

    Interestingly, my earlier version of FF doesn't do that, just later versions. What a Crazy thing to program in !
     
  2. The Red Moon

    The Red Moon Registered Member

    Joined:
    May 17, 2012
    Posts:
    4,101
    Thats perfectly normal behaviour.
    Firefox is cacheing images to reduce downloading them again if the websites are visited again.Chrome does it too but does it in a more sporadic fashion.
    Using a system cleaner resolves the problem or empty your firefox cache upon closure of the browser.
     
  3. Minimalist

    Minimalist Registered Member

    Joined:
    Jan 6, 2014
    Posts:
    14,883
    Location:
    Slovenia, EU
    Well important thing is that it doesn't take screenshot with your username inserted.
    As I understand those screenshots are part of browser cache and are deleted when history is cleared.
    Info about sites you're visiting is stored in your history which can also be accessed using undelete tools. So those screenshots are only "graphical representation" of data that is otherwise stored in browser's cache. If you checked your Eassos Recovery results you would find this data in other files also (html...).
    You could also probably prevent them by entering into incognito mode or use Sandboxie that would redirect cache on RamDisk and delete content when browser is closed. Not writing data on your HDD would be IMO best solution to prevent it.
     
  4. TonyW

    TonyW Registered Member

    Joined:
    Oct 12, 2005
    Posts:
    2,741
    Location:
    UK
    I agree with the previous two posters that those images are only graphical representations of browser cache data. Personally I use a blank screen when I open a new tab so don't see these. You can choose to show a blank page instead within the 'new tab controls' settings.

    For fun, I just switched to show top sites to see if there is anything there but several screenshots are missing possibly because I haven't been using the feature. With that in mind, it's probably not worth me disabling the pagethumbnails as described in the first post. Clearing the cache should remove the thumbnails too.
     
    Last edited: Dec 31, 2016
  5. summerheat

    summerheat Registered Member

    Joined:
    May 16, 2015
    Posts:
    2,199
    Agreed. And it's even possible to regularly clear the cache every x minutes during the browsing session with add-ons like uMatrix or Self-Destructing Cookies.
     
  6. boredog

    boredog Registered Member

    Joined:
    Feb 1, 2015
    Posts:
    2,499

    Attached Files:

  7. TheWindBringeth

    TheWindBringeth Registered Member

    Joined:
    Feb 29, 2012
    Posts:
    2,171
    Since Firefox 13 in 2012 methinks. The page thumbnail privacy issue was reported at a number of tech sites back then, and Mozilla subsequently made some related changes. It remained something that many chose to disable and found its way into user.js files such as:

    https://github.com/pyllyukko/user.js/
    https://www.ghacks.net/2016/07/03/comprehensive-firefox-user-js/

    If you are just discovering it you might want to have a look at those. In case they demonstrate other useful prefs you aren't aware of. If you are interested in preventing the capturing/storage of page thumbnails [at HTTPS sites] you might also be interested in browser.cache.disk_cache_ssl and other cache settings.
     
  8. Brummelchen

    Brummelchen Registered Member

    Joined:
    Jan 3, 2009
    Posts:
    5,919
    yep, is more and more to reduce loading. and this has nothing to do with telemetrie (opt out possible) to improve performance.

    new tab is also here referring to my most visited sites, pint them to avoid inserting "suggestions" from mozilla.

    cleaning up with ccleaner is absolut no-go, please dont do if you like your profile kept working. use firefox features instead!

    "user.js" in profile is useful if it is not created from malware - eg to prevent updates or inserting ad popups or ad redirecting (hijack). if "about:support" ist listing a user.js which is not from you you have adware in system.

    concerning zemana - zemana is inserting a fraud user agent and this option is not to change. one reason for me to kick this **** off my system years ago. the bad of it - your firefox become unique with that insertion.

    happy new year
     
  9. CloneRanger

    CloneRanger Registered Member

    Joined:
    Jan 4, 2006
    Posts:
    4,978
    Retention of Data !

    For those who mention that FF can be set not retain data etc after closing etc, i have news for you. My FF is set as shown, plus i've set not to use Any cache too. But even so, it still takes & saves thumbnails of visted pages !

    data.png cache.png

    Fortunately i use Shadow Defender, so when i reboot it's all gone. I reboot several times a day for various reasons. Anybody using a similar App would be in the same position, After rebooting, whenever that might be.

    @ TheWindBringeth

    Thanx, i'll have a look

    @ Brummelchen

    What EXACTLY is the fraud user agent you say Zemana free Antilogger is using ? I checked at ShieldsUp & it seemed ok !
     
  10. pandorax

    pandorax Registered Member

    Joined:
    Feb 14, 2011
    Posts:
    386
    Thumbnails are for regular visited websites to show them in the new homepage.
     
  11. Minimalist

    Minimalist Registered Member

    Joined:
    Jan 6, 2014
    Posts:
    14,883
    Location:
    Slovenia, EU
    @CloneRanger
    Clear all history option and Shadow Defender would delete that data after it's already written to your disk. That data is deleted but could be restored using undelete tools. If you don't want it to be accessible using those tools, you have to make sure that this data doesn't get written to disk or that you overwrite it (CCleaner can be set that way).
    IDK what effect has 0MB set cache to creation of those thumbnalis.
     
  12. Brummelchen

    Brummelchen Registered Member

    Joined:
    Jan 3, 2009
    Posts:
    5,919
    zemana changing user agent string like this
    not sure if your suite do, but antilogger do - so i assume that suite will change UA too.
     
  13. CloneRanger

    CloneRanger Registered Member

    Joined:
    Jan 4, 2006
    Posts:
    4,978
    @ Brummelchen

    Hi, this is what i see @ grc.com

    User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:27.0) Gecko/20100101 Firefox/27.0

    So it seems like i'm golden, as far as that goes ! Wonder why you see what you do ?
     
  14. Brummelchen

    Brummelchen Registered Member

    Joined:
    Jan 3, 2009
    Posts:
    5,919
    this is not my UA, i dont use such "software" :p
    but when used Antilogger years ago i noticed this change too
     
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.