MozillaWiki

Security/Download Protection: Difference between revisions

Page Discussion

Security/Download Protection (view source)

Revision as of 20:19, 15 June 2020

5,747 bytes added ,  15 June 2020
→‎Documentation: Fix broken Chromium link.
(Mostly stealing content from https://wiki.mozilla.org/Security/Features/Application_Reputation)
 
(→‎Documentation: Fix broken Chromium link.)
 
(33 intermediate revisions by 2 users not shown)
Line 1: Line 1:
== Description ==
== Description ==


We warn on every application download, which causes warning fatigue and doesn't help users make good decisions. We should track the reputation of download URLs and hashes.
This feature protects users against malware downloads. It is based on [[Security/Safe Browsing|Safe Browsing]].


See [[Security/Features/Application_Reputation_Design_Doc]] for implementation details.
See [[Security/Features/Application_Reputation_Design_Doc]] for implementation details.
== Prefs ==
* <tt>browser.safebrowsing.downloads.enabled</tt>: enables application reputation checks for downloaded files
* <tt>browser.safebrowsing.downloads.remote.enabled</tt>: enables remote lookups (requires the previous pref)
* <tt>browser.safebrowsing.downloads.remote.timeout_ms</tt>: timeout for the remote lookups
* <tt>browser.safebrowsing.downloads.remote.url</tt>: server endpoint for remote lookups
* <tt>browser.safebrowsing.malware.enabled</tt>: enables malware checks (required by application reputation)
* <tt>browser.safebrowsing.provider.google.lists</tt>: list of tables coming from the Google Safe Browsing service
* <tt>urlclassifier.downloadAllowTable</tt>: list of trusted certificates which suppress remote lookups (Windows-only)
* <tt>urlclassifier.downloadBlockTable</tt>: list of URLs serving malware binaries


== Engineering ==
== Engineering ==
Product/Component: '''Toolkit/Safe Browsing'''


* [https://bugzilla.mozilla.org/show_bug.cgi?id=662819 Tracking bug]
* [https://bugzilla.mozilla.org/show_bug.cgi?id=662819 Tracking bug]
Most of the code lives in <tt>toolkit/components/downloads/ApplicationReputation.cpp</tt>. The lookup is requested from within [https://searchfox.org/mozilla-central/rev/d67ef71097da4d1aa344c9d9c672e49a7228e765/toolkit/components/jsdownloads/src/DownloadIntegration.jsm#468-482 toolkit/components/jsdownloads/src/DownloadIntegration.jsm].
Upstream list of file extensions:
* Shipped to Chrome via a "File Type Policies" Chrome extension (see <tt>chrome://components</tt>)
* [https://github.com/fmarier/safebrowsing-tools/blob/master/parse-filetypes.py Binary protobuf extractor]
* [https://cs.chromium.org/chromium/src/chrome/browser/resources/safe_browsing/download_file_types.asciipb Source protobuf]
=== Tests ===
Here are the download protection specific tests:
./mach test toolkit/components/reputationservice/test/
Also relevant are the [[Security/Safe_Browsing#Tests|Safe Browsing tests]].


== QA ==
== QA ==
* [http://testsafebrowsing.appspot.com Test page]
* [https://bugzilla.mozilla.org/show_bug.cgi?id=1250329 Meta QA bug for Safe Browsing]
* [https://urlhaus.abuse.ch/ URLhaus] (real malicious downloads)


To turn on debugging output, export the following environment variable:
To turn on debugging output, export the following environment variable:


  NSPR_LOG_MODULES="ApplicationReputation:5"
  MOZ_LOG_FILE=/tmp/apprep.log
MOZ_LOG="ApplicationReputation:5"


* [http://testsafebrowsing.appspot.com Test page]
== Telemetry ==
 
'''Alerts are sent to [https://mail.mozilla.org/listinfo/safebrowsing-telemetry safebrowsing-telemetry@mozilla.org].'''
* [https://telemetry.mozilla.org/new-pipeline/dist.html#!cumulative=0&end_date=2018-09-04&keys=__none__!__none__!__none__&max_channel_version=nightly%252F63&measure=APPLICATION_REPUTATION_BINARY&min_channel_version=null&processType=*&product=Firefox&sanitize=1&sort_keys=submissions&start_date=2018-08-09&table=1&trim=1&use_submission_date=0 APPLICATION_REPUTATION_BINARY]: whether the file examined by download protection is a binary type
* [https://telemetry.mozilla.org/new-pipeline/dist.html#!cumulative=0&end_date=2018-09-04&keys=__none__!__none__!__none__&max_channel_version=nightly%252F63&measure=APPLICATION_REPUTATION_BINARY_ARCHIVE&min_channel_version=null&processType=*&product=Firefox&sanitize=1&sort_keys=submissions&start_date=2018-08-09&table=1&trim=1&use_submission_date=0 APPLICATION_REPUTATION_BINARY_ARCHIVE]: whether the binary file examined by download protection is dmg, rar or zip
* [https://telemetry.mozilla.org/new-pipeline/dist.html#!cumulative=0&end_date=2016-06-06&keys=__none__!__none__!__none__&max_channel_version=nightly%252F49&measure=APPLICATION_REPUTATION_LOCAL&min_channel_version=null&product=Firefox&sanitize=1&sort_keys=submissions&start_date=2016-04-25&table=1&trim=1&use_submission_date=0 APPLICATION_REPUTATION_LOCAL]: results of the local checks (whitelist and blacklist)
* [https://telemetry.mozilla.org/new-pipeline/dist.html#!cumulative=0&end_date=2016-08-20&keys=__none__!__none__!__none__&max_channel_version=nightly%252F51&measure=APPLICATION_REPUTATION_REMOTE_LOOKUP_TIMEOUT&min_channel_version=nightly%252F51&product=Firefox&sanitize=1&sort_keys=submissions&start_date=2016-08-20&table=0&trim=1&use_submission_date=0 APPLICATION_REPUTATION_REMOTE_LOOKUP_TIMEOUT]: whether or not a client timed out while contacting the remote lookup server
* [https://telemetry.mozilla.org/new-pipeline/dist.html#!cumulative=0&end_date=2018-09-04&keys=__none__!__none__!__none__&max_channel_version=nightly%252F63&measure=APPLICATION_REPUTATION_SERVER_2&min_channel_version=null&processType=*&product=Firefox&sanitize=1&sort_keys=submissions&start_date=2018-08-09&table=1&trim=1&use_submission_date=0 APPLICATION_REPUTATION_SERVER_2]: whether the response from the remote server was valid, invalid (failed to parse as a protobuf) or failed in some other way (e.g. network error)
* [https://telemetry.mozilla.org/new-pipeline/dist.html#!cumulative=0&end_date=2016-06-06&keys=__none__!__none__!__none__&max_channel_version=nightly%252F49&measure=APPLICATION_REPUTATION_SERVER_VERDICT&min_channel_version=null&product=Firefox&sanitize=1&sort_keys=submissions&start_date=2016-04-25&table=1&trim=1&use_submission_date=0 APPLICATION_REPUTATION_SERVER_VERDICT]: results (verdict) we got back from the remote server lookup
* [https://telemetry.mozilla.org/new-pipeline/dist.html#!cumulative=0&end_date=2016-06-06&keys=__none__!__none__!__none__&max_channel_version=nightly%252F49&measure=APPLICATION_REPUTATION_SHOULD_BLOCK&min_channel_version=null&product=Firefox&sanitize=1&sort_keys=submissions&start_date=2016-04-25&table=1&trim=1&use_submission_date=0 APPLICATION_REPUTATION_SHOULD_BLOCK]: whether or not a download has been blocked due to an application reputation lookup (local or remote)


== Documentation ==
== Documentation ==


* API Documentation available internally under NDA
* [[Security/Features/Application_Reputation_Design_Doc]]
* [https://mana.mozilla.org/wiki/display/FIREFOX/Application+Reputation Google API documentation] (internal access only)
* [http://www.internetsociety.org/doc/camp-content-agnostic-malware-protection Content-Agnostic Malware Protection] (paper describing how the whole system is implemented)
* [https://source.chromium.org/chromium/chromium/src/+/master:components/safe_browsing/core/proto/csd.proto;l=465;drc=f0881a1b6bb18aade55c4d60769f53d1a850453e Chromium source code]
* [http://monica-at-mozilla.blogspot.co.nz/2014/07/download-files-more-safely-with-firefox.html Announcement blog post]
* [http://monica-at-mozilla.blogspot.co.nz/2014/07/download-files-more-safely-with-firefox.html Announcement blog post]
Fmarier
Confirmed users
908

edits

Retrieved from "https://wiki.allizom.org/Special:MobileDiff/1067758...1228145"