Security/Download Protection

Description

This feature protects users against malware downloads. It is based on Safe Browsing.

See Security/Features/Application_Reputation_Design_Doc for implementation details.

Prefs

• browser.safebrowsing.downloads.enabled: enables application reputation checks for downloaded files
• browser.safebrowsing.downloads.remote.enabled: enables remote lookups (requires the previous pref)
• browser.safebrowsing.downloads.remote.timeout_ms: timeout for the remote lookups
• browser.safebrowsing.malware.enabled: enables malware checks (required by application reputation)
• urlclassifier.downloadAllowTable: list of trusted certificates which suppress remote lookups (Windows-only)
• urlclassifier.downloadBlockTable: list of URLs serving malware binaries

Firefox 43 and later:

• browser.safebrowsing.provider.google.lists: list of tables coming from the Google Safe Browsing service

Firefox 45 and earlier:

• browser.safebrowsing.appRepURL: server endpoint for remote lookups

Firefox 46 and later:

• browser.safebrowsing.downloads.remote.url: server endpoint for remote lookups

Engineering

Product/Component: Toolkit/Safe Browsing

• Tracking bug

Most of the code lives in toolkit/components/downloads/ApplicationReputation.cpp.

QA

• Test page
• Meta QA bug for Safe Browsing

To turn on debugging output, export the following environment variable:

MOZ_LOG="ApplicationReputation:5"

Documentation

• Security/Features/Application_Reputation_Design_Doc (API Documentation available internally under NDA)
• Content-Agnostic Malware Protection (paper describing how the whole system is implemented)
• Chromium source code
• Announcement blog post