The way this information is spread by United Internet is misleading (I am trying hard to avoid saying "libel"). The allegation as it stands is clearly wrong by all objective means, and the presentation is defamatory.
Of course, in principle, one has to admit that Adblock (Plus) is of course a potential security risk. Whether this risk warrants a reasonable concern is another thing.
Adblock (Plus) might be a security risk for three reasons:
- It is software that runs on your computer, which could, like all software, in principle do almost anything. Including showing false information or stealing your data.
- It does modify web page contents, that is what blocking ads is about. Certainly, a software which is well-known to modify the contents of web pages could modify the contents in a malicious way and go unnoticed much easier than another software.
- It performs this task by matching a downloadable list of regular expressions from a range of (uncontrolled/unknown) third parties, such as EasyList
So, if you are in ultra-paranoia mode, you might fear that either someone at EasyList (or another filter list provider) modifies the filter list so they do something malicious, or a hacker hijacks the site. Your Adblock Plus addon would presumably download the malicious list during its daily/weekly update without knowing and without a means of verification (there is a checksum that can be embedded, but this only protects from accidential corruption, not malicious modification).
As a result, such a malicious block list could in theory cause the addon to do "evil things".
Luckily, apart from JS exploits, there is not too much harm that could realistically be done via this attack vector due to the way Adblock works (it will match an arbitrary regex, but it won't do arbitrary susbstitutions, so hiding some elements it shouldn't hide or letting some ads through is pretty much the worst possible case).
On the other hand, a JS exploit could be used against you without Adblock Plus running in the first place.
Also, obviously, like any third party software (including Firefox or Chrome itself!) the Adblock Plus addon itself could steal your data. All you can say at the present time is that so far this has not happened.
Then again, almost all of the big commercial players in the business are doing untrustworthy things on a daily base, which nobody objects against.
Now you have to ask yourself how likely it is that Adblock Plus will indeed steal user data, and how likely it is that such a thing would go undetected for longer than a day or two on a widely-deployed open-source project.
Frankly, if you believe that this is a serious and realistic threat which is likely to affect you, then you must also believe that the Microsoft in collaboration with the NSA already builds identity theft functionality right into Windows and that every computer has a secret "kill switch" which the US DoD can activate at will (that too, is in principle possible, and it's actually more likely to be true than the author of Adblock stealing your savings).
You should not trust GMX either in this case, since they will (note the wording, will, not may) share all your personal data and traffic information in a malicious and unethical way with other parties (at least with US agencies, due to Schröder's 2001 treaty, but you have no way of telling with whom else).
You also shouldn't trust 1&1 (another member of United Internet) because they will share your personal data with who-knows-whom (being an US based company). Nor Google, nor the other half of the internet for that matter.
On the other hand, Adblock Plus has demonstrably prevented malware from being installed on users' computers in the past.
