Security/Download Protection: Difference between revisions

Revision as of 22:09, 7 April 2017

This feature protects users against malware downloads. It is based on Safe Browsing.

browser.safebrowsing.downloads.enabled: enables application reputation checks for downloaded files
browser.safebrowsing.downloads.remote.enabled: enables remote lookups (requires the previous pref)
browser.safebrowsing.downloads.remote.timeout_ms: timeout for the remote lookups
browser.safebrowsing.downloads.remote.url: server endpoint for remote lookups
browser.safebrowsing.malware.enabled: enables malware checks (required by application reputation)
browser.safebrowsing.provider.google.lists: list of tables coming from the Google Safe Browsing service
urlclassifier.downloadAllowTable: list of trusted certificates which suppress remote lookups (Windows-only)
urlclassifier.downloadBlockTable: list of URLs serving malware binaries

Product/Component: Toolkit/Safe Browsing

Most of the code lives in toolkit/components/downloads/ApplicationReputation.cpp.

Upstream list of file extensions:

Shipped to Chrome via a "File Type Policies" Chrome extension (see chrome://components)
Binary protobuf extractor
Source protobuf

To turn on debugging output, export the following environment variable:

MOZ_LOG_FILE=/tmp/apprep.log
MOZ_LOG="ApplicationReputation:5"

APPLICATION_REPUTATION_COUNT: number of download lookups through the application reputation code
APPLICATION_REPUTATION_LOCAL: results of the local checks (whitelist and blacklist)
APPLICATION_REPUTATION_SERVER: whether the response from the remote server was valid, invalid (failed to parse as a protobuf) or failed in some other way
APPLICATION_REPUTATION_SERVER_VERDICT: results (verdict) we got back from the remote server lookup
APPLICATION_REPUTATION_SHOULD_BLOCK: whether or not a download has been blocked due to an application reputation lookup (local or remote)
APPLICATION_REPUTATION_REMOTE_LOOKUP_TIMEOUT: whether or not a client timed out while contacting the remote lookup server

@@ Line 10: / Line 10: @@
 * <tt>browser.safebrowsing.downloads.remote.enabled</tt>: enables remote lookups (requires the previous pref)
 * <tt>browser.safebrowsing.downloads.remote.timeout_ms</tt>: timeout for the remote lookups
+* <tt>browser.safebrowsing.downloads.remote.url</tt>: server endpoint for remote lookups
 * <tt>browser.safebrowsing.malware.enabled</tt>: enables malware checks (required by application reputation)
 * <tt>browser.safebrowsing.provider.google.lists</tt>: list of tables coming from the Google Safe Browsing service
 * <tt>urlclassifier.downloadAllowTable</tt>: list of trusted certificates which suppress remote lookups (Windows-only)
 * <tt>urlclassifier.downloadBlockTable</tt>: list of URLs serving malware binaries
-Firefox 45 and earlier:
-* <tt>browser.safebrowsing.appRepURL</tt>: server endpoint for remote lookups
-Firefox 46 and later:
-* <tt>browser.safebrowsing.downloads.remote.url</tt>: server endpoint for remote lookups
 == Engineering ==