1148010 - Firefox malware blocking has too few information, it's an enigma to people wanting to know why

Status: NEW

(Firefox :: Downloads Panel, defect)

Description

[Jonas Thiem]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:39.0) Gecko/20100101 Firefox/39.0
Build ID: 20150315030236

Steps to reproduce:

Firefox malware blocking has waaaay too few information, it's an enigma to people wanting to know why:

"Blocked: may contain virus or spyware"

1. Who says that (signature/list source)
2. What is it based on? (known URL of spyware download, signature in file, ...)
3. What to do in case of false positives?

3. is notably important. Since apparently you do some advanced AV scanning or lookup now, please note that *all* reputable AV companies have some easy way of sending them samples, most notably also for false positives via a simple e-mail.

Since your message doesn't even say *which* AV company (see point 1) is responsible for this, it's impossible to do something about it which just plain sucks.

Therefore, please add "Details..." and provide the full information for all of these 3 bullet points, to make it less like some black box enigma that sometimes work and sometimes doesn't and I have no idea of checking why it failed, what I can do about it etc etc as an end user.

Comment 1

[wiki]

Further to the above ,

On point 1.  Attribution of the data provider would also be a courtesy to those data providers (It's also free advertising for them ;) )

ON point 3.  As well as being able to do it for an obvious false positive, I would also suggest an extension to the download manager, which would (with caveats) allow a download to be submitted for analysis, even when it wasn't flagged directly. (I've sometimes had download files that seemed innocuous on download, and then the AV found something AFTER download.)

Releated to this is the issue of handling signing, some Linux packages are PGP/GPG signed if I recall, which is something that could be borne in mind for Add-ons/Extensions, as an additional check. 

An additional point is 

4. Allow a client-side exceptions/whitelist (with appropriate caveats) for advanced users  (who should know the risks) that are needing to bypass the malware checking, for the purposes of debugging, deliberate security testing and so on.

Comment 2

[alex_mayorga]

Attachment: Screen capture of a blocked download

The UI should have a "Learn more..." or "?" button or link that points to https://support.mozilla.org/en-US/kb/security-and-passwords-settings#w_security-settings or https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware-protection-work#w_what-happens-when-a-page-or-file-is-blocked or even somewhere more suiting.

https://support.mozilla.org/en-US/questions/1053014 is a recent sample from SUMO on this.

Comment 3

[Jonas Thiem]

Those links only speak about false positives sites, not files. There should be something that more obviously refers to downloaded files being false positives. If the retrieval procedure for malware sites and files is the same, then it should say that more explicitly at https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware-protection-work#w_what-happens-when-a-page-or-file-is-blocked

Also, the FAQ on reporting seems to require the user to know if it's a known phishing OR malware URL. Will known fishing files be blocked as well, and how can a user tell the difference?

TL;DR: there should really be a new section in the FAQ speaking explicitly and purely on FILE false positives, not website false positives. And that one should be linked, not the one about websites

Comment 4

[Jonas Thiem]

This site *still* does not have any information on whom to send information on a *FILE* false positive.

It mentions how to request getting entire websites unlisted, but not on how to inform the provider of the data that a specific file detected as a virus is NOT a virus.

Again, all reputable AV providers offer this information in an easy-to-find place, can you please do it too??

Comment 5

[Jonas Thiem]

Also the FAQ solution is only intended for website providers/webmasters, if the *user* wants to download a file and it is detected as a false positive, it appears they are supposed to be unable to do ANYTHING about it. Why?? Any sort of acceptable anti virus solution would allow me to e-mail their provider "well I'm just a regular user who tried to download this file and it was blocked, but I'm pretty sure it's not a virus" to have them investigate it. You should offer that possibility as well.

Comment 6

[Jonas Thiem]

Please note that sending me to the Google Webmaster Tools for *someone else's site* is not a solution either. Also, people should NOT be required to have a google account just for reporting a false positive!

Comment 7

[Gian-Carlo Pascutto [:gcp]]

The information we have comes from Google's SafeBrowsing system, which returns a simple verdict:
https://dxr.mozilla.org/mozilla-central/source/toolkit/components/downloads/csd.proto#277
so most of the information requested in this bug is simply not available to Firefox.

If there's information available from Google that answers or resolves some of the things listed in the comments here, we can look into making it more discoverable in Firefox or SUMO. Otherwise there's not much we can do.

Comment 8

[Jonas Thiem]

I beg to differ, you could do e.g. one or more of the following:

1. Communicate clearly to Google that you need such information

2. Make it more obvious in firefox it retrieved it from SafeBrowsing, and make an obvious button for ignoring it

3. Replace your data source with a proper AntiVirus vendor that provides non-**** information on what they are actually doing instead of acting like a silly questionable black box.

Comment 9

[Gian-Carlo Pascutto [:gcp]]

(In reply to Jonas Thiem from comment #8)
> 1. Communicate clearly to Google that you need such information

Feel free to shoot them a mail if this is important to you.

> 2. Make it more obvious in firefox it retrieved it from SafeBrowsing, and
> make an obvious button for ignoring it

You can right-click to unblock files, and there is a checkbox in preferences that disables the protection. That's all explained in SUMO, which also explains the data sources.

> 3. Replace your data source with a proper AntiVirus vendor that provides
> non-**** information on what they are actually doing instead of acting like
> a silly questionable black box.

I'm very willing to add additional data feeds like that. Can you suggest any free ones that support a few hundred million clients and have acceptable privacy impact?

Comment 10

[Jonas Thiem]

> Feel free to shoot them a mail if this is important to you.

Well if Mozilla asks, they are probably more inclined to think about than if I do.

> You can right-click to unblock files, and there is a checkbox in preferences that disables the protection. That's all explained in SUMO, which also explains the data sources.

It has been a while since I got a malware block in firefox, but back then I saw no obvious way to override it. The best would probably a button on the toolbar similar to the popup blocker if there's nothing like that present yet.

> I'm very willing to add additional data feeds like that. Can you suggest any free ones that support a few hundred million clients and have acceptable privacy impact?

Yes this is a long shot and I understand you would rather use SafeBrowsing than nothing, but maybe it would be at least worth trying asking some of the regular AV vendors whether they have such a db and would make a deal with Mozilla e.g. for prominent mentioning in the error message to allow them to use it?

Most AV vendors have very nice information about each detected virus about what it is (like trojan, ...) and most also have proper forms to report false positives, unlike Google - which I consider one of the biggest problems with SafeBrowsing really, more so than the lack of information what the supposed problem of the site is.

I know this isn't an easily solvable problem, but that doesn't mean it's not worth investigating whether there might be a better solution.

Comment 11

[Jonas Thiem]

Also to bring this up again, https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware-protection-work#w_what-happens-when-a-page-or-file-is-blocked still seems to have no info on downloaded files.

Maybe it's just as trivial as entering the download link as a "page" that is incorrectly listed, but it doesn't really say.

It would be really helpful if the site had a specific section talking about when a download is a false positive, not just a site, just to provide clear and complete instructions.

The reason I opened this bug report because is I downloaded a file which seemed to be a false positive, and I couldn't find out up to now how I am supposed to report that sort of thing.

(also again there was no obvious button on the UI to override that decision)

Comment 12

[Gian-Carlo Pascutto [:gcp]]

(In reply to Jonas Thiem from comment #10)
> It has been a while since I got a malware block in firefox, but back then I
> saw no obvious way to override it. 

It was added as part of the work for bug 1062966. I understand that the UX needs further work and because of this we actually don't warn for some files that are more likely to be false positives.

See e.g.
https://bugzilla.mozilla.org/show_bug.cgi?id=1198181
https://bugzilla.mozilla.org/show_bug.cgi?id=1019933

> I know this isn't an easily solvable problem, but that doesn't mean it's not
> worth investigating whether there might be a better solution.

FWIW we are talking to other vendors about getting similar feeds (and welcome any new ones that might be interested), but as you can observe Google's stuff still seems to be the best compromise so far.

Comment 13

[Jonas Thiem]

Alright. Thanks for doing those improvements! I'm hoping there might be a more informative data source in the future.

The main thing which still remains in my eyes which can be easily fixed/improved right now is to add a specific section talking about downloaded files which are false positives to https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware-protection-work#w_what-happens-when-a-page-or-file-is-blocked

Suggestion for the section name: "I’ve confirmed the downloaded file isn't actually unsafe, how do I get the false positive investigated?" or similar, below the existing "I’ve confirmed that my site is safe, how do I get it removed from the lists?"

Suggestion for section contents: "Use the process described above for websites and simply enter the download URL to the affected false positive file." (if that is accurate, otherwise the respective instructions)

Comment 14

[Gian-Carlo Pascutto [:gcp]]

(In reply to Jonas Thiem from comment #11)
> The reason I opened this bug report because is I downloaded a file which
> seemed to be a false positive, and I couldn't find out up to now how I am
> supposed to report that sort of thing.

Maybe this?
https://support.google.com/webmasters/answer/168328?hl=en&ref_topic=4598410

Feel free to update the SUMO article, it's a collaborative effort similar to a wiki.

Comment 15

[Jonas Thiem]

That's definitely not helpful, since it can't be used if the downloaded file wasn't on YOUR site as far as I am aware - also it seems to require a google webmaster account thing, which a regular user wouldn't have.

As you can see, the situation regarding reporting false positive files is definitely a bit unclear. It would be good if someone could find out the definite answer of how this is supposed to be done.

Comment 16

[Jonas Thiem]

https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware-protection-work#w_what-happens-when-a-page-or-file-is-blocked still only mentions the phishing sites in the false positives section, and when you click the button to actually attempt to report something, the form is also clearly speaking about phishing sites only and it doesn't mention malware reported through safebrowsing/Google at all.

Can this finally be cleared up? I assume someone spoke with Google to set up safebrowsing initially, how about someone calls them and asks how users should report false positives with files and not just phishing sites and fixes it in the knowledge base article?

It has been 1.5 years, one would think it's possible to find out about this in that time and add a simple sentence + link on how to report a simple false positive... (for a file, not a phishing attempt)

At least the report form appears to have been changed to allow false positive reporting without a Google Webmaster account or owning the affected site, but there is still no file upload and absolutely no indication on whether it is the right place to report file malware false positives at all.

Comment 17

[Jonas Thiem]

(Also I understand Google probably doesn't care too much, but in that case maybe at least add something to https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware-protection-work#w_what-happens-when-a-page-or-file-is-blocked that explains the current situation and that the reporting of file false positives appears to be currently not possible?)

Comment 18

[Gian-Carlo Pascutto [:gcp]]

As already stated in comment 14, SUMO is a community wiki and you can edit it yourself (or at least, IIRC, make proposed edits).

>still only mentions the phishing sites in the false positives section

I'm not sure what you mean, but there is a link saying "To request removal from the list of reported malware sites"?

Francois, do you know if there's any false positive reporting system for the new download protection, and whether there's generally a way for users (not site owners) to report false positives?

Comment 19

[François Marier [:francois]]

(In reply to Gian-Carlo Pascutto [:gcp] from comment #18)
> Francois, do you know if there's any false positive reporting system for the
> new download protection, and whether there's generally a way for users (not
> site owners) to report false positives?

The only URLs I know about are these:

  https://developers.google.com/webmasters/hacked/
  https://support.google.com/webmasters/answer/6350487
  https://support.google.com/webmasters/answer/3258249

I checked with Google and they don't currently have a way for users to report false positives for misclassified downloads, nor does Chrome have that functionality.

Comment 20

[Jonas Thiem]

(In reply to Gian-Carlo Pascutto [:gcp] from comment #18)
> I'm not sure what you mean, but there is a link saying "To request removal
> from the list of reported malware sites"?
The malware false positive reporting link provided in the mozilla support article is not for google / safebrowsing malware false positives, but just those caused by stopbadware.org. However, safebrowsing reports malware as well: https://www.google.com/transparencyreport/safebrowsing/

If malware false positives caused by safebrowsing are supposed to go through the same form as the phishing sites (although for malware you would usually have an upload form to provide a sample, right? And there's nothing like that to be found), then the article should be changed/expanded to state so more clearly.

(In reply to François Marier [:francois] from comment #19)
> I checked with Google and they don't currently have a way for users to
> report false positives for misclassified downloads, nor does Chrome have
> that functionality.
If that is the case, that would be rather unfortunate...

Comment 21

[François Marier [:francois]]

Do you have concrete examples of downloads that are incorrectly marked as malware by Safe Browsing?

Comment 22

[Gian-Carlo Pascutto [:gcp]]

>The malware false positive reporting link provided in the mozilla support article is not for google / safebrowsing malware false positives, but just those caused by stopbadware.org

I'm not sure where you get that idea from. If you actually follow the link and read what the stopbadware.org site says, it specifically addresses being blacklisted by Google, how to deal with it etc, together with a report if you're blacklisted by more than Google. I'm not exactly sure what the relations are here, but both Google and Mozilla are also listed as the main sponsors of stopbadware.org. From what I can see, the link in SUMO is correct and what you want.

Comment 23

[Jonas Thiem]

I did back when I opened the ticket, but this has been a long time ago, so I don't recall what it was exactly.

It appears indeed the SUMO article is complete and exactly what I searched. (I did indeed incorrectly assume stopbadware.org is unrelated to Google, so there's nothing missing)

If it hasn't been added yet, I suggest there's a direct button added to the popup which leads to the SUMO article. Otherwise I suppose this ticket can be closed, and sorry for my confusion related to stopbadware.org!