1014773 - Auto download leads to malware download

Status: RESOLVED WORKSFORME

(Firefox for Android Graveyard :: General, defect)

Description

[Rubén Martín [:Nukeador] ❌ [away till Aug 31st]]

The auto-download feature is being used by malicious sites to make you auto-download malware apk as soon as you get into a website.

Steps to reproduce:

* You go to a site using Firefox for Android.
* Once you load the site a file is automatically downloaded.

This is being used actively by malicious sites to make you download an apk with is infected with a backdoor or it uses SMS to change you.

Inexperienced users will click on the download to fin out what was downloaded and probably some of them will install ir.

Proposal: Turn auto download off and avoid .apk files to be opened from the download manager directly.

Comment 1

[Rubén Martín [:Nukeador] ❌ [away till Aug 31st]]

s/change/charge

Comment 2

[Mark Finkle (:mfinkle) (use needinfo?)]

Firefox for Android no longer auto-downloads APK files. It no longer runs any file that is downloaded.

For APK files, the user must  request to "Download" the APK after tapping it.
For any file, the user must tap on the file from the Download Manager to open it.

Comment 3

[Kevin Brosnan [Ex-Mozilla]]

This is wfm unless there are specific steps.

Comment 4

[Aaron Train [:aaronmt]]

Fixed on 30 via https://bugzilla.mozilla.org/show_bug.cgi?id=945429

Comment 5

[Rubén Martín [:Nukeador] ❌ [away till Aug 31st]]

OK, I just showed this behaviour using current beta.

Good to know that will no longer auto download files :)

Thanks.