1737292 - Firefox is detecting my download links

Status: RESOLVED INCOMPLETE

(Core :: DOM: Security, defect)

Description

[marika]

Attachment: 2021-10-20_1305281.jpg

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36

Steps to reproduce:

1. Go to https://wiki-tech.net//en/errors/0x/0x
2. Click on Download now button
3. Try to download the app

Alternative steps:

1. Try to initiate download from any of these links
   https://dynamicdownloads.outbyte.com/en/pc-repair/stub/pc-repair-setup.exe
   https://dynamicdownloads.outbyte.com/en/pc-repair/st/stub/pc-repair-setup.exe
   https://outbyte.com/software/pc-repair/download
   https://dynamicdownloads.outbyte.com/en/pc-repair/stub/outbyte-pc-repair

Actual results:

We sometimes receive an error message:
File not downloaded. Potential security risk.
The file uses an insecure connection. It may be corrupted or tampered with during the download process.
You can search for an alternate download source or try again later.

See attachment for the error message.
*The links definitely use https (we checked) but get the same error message. We also checked the analytics and our links conversions from Firefox dropped over 70% for the last few months.

Not sure what insecure means, both the files and links are clean.

Expected results:

The download of the .exe file should have started

Comment 1

[BugBot [:suhaib / :marco]]

The Bugbug bot thinks this bug should belong to the 'Core::Networking' component, and is moving the bug to that component. Please revert this change in case you think the bot is wrong.

Comment 2

[Daniel Veditz [:dveditz]]

(In reply to marika from comment #0)

1. Go to https://wiki-tech.net//en/errors/0x/0x
2. Click on Download now button

I did not see a "Download now" button. In a sidebar on the right there was a green "Download" button, and in the article a text link "Download PC Repair application". I tried both of them on Firefox 93 and did not see any problems. I tried with standard and strict tracking protection settings, I tried messing with the "HTTP-only" settings. No combination gave me the results of your screenshot.

If you can still reproduce this it would be interesting to see what network requests happen after you click the link. You can check this using the "Network" tab of our "Web Developer Tools" that you can reach from our menus. It's possible the links or requests are being interfered with in only some cases, such as by malicious advertising code loaded on the page, an add-on, or a rogue proxy. A network record would let us know what's going on.

Alternative steps:

1. Try to initiate download from any of these links
   https://dynamicdownloads.outbyte.com/en/pc-repair/stub/pc-repair-setup.exe
   https://dynamicdownloads.outbyte.com/en/pc-repair/st/stub/pc-repair-setup.exe
   https://outbyte.com/software/pc-repair/download
   https://dynamicdownloads.outbyte.com/en/pc-repair/stub/outbyte-pc-repair

Same -- I have no problem using those links directly from this bug. If you do that would rule out malicious ads (our bug tracker doesn't have any ads) but still leave open the possibility of add-on or proxies injecting tracking redirects.

*The links definitely use https (we checked) but get the same error message.

On the website there were several "click" event handlers on the link, some of which appear to modify the URL to add parameters (but don't cause this problem as far as I can see). A malicious version of this could change the URL entirely between when you click on a link and when it gets loaded.

Comment 3

[Valentin Gosu [:valentin]]

Attachment: suspicious_url_google.png

The previous mail was marked as suspicious by gmail just for containing the links.
So I assume the problem here is that the safe-seach list contains these URLs which is what's triggering the download error.

Comment 4

[Daniel Veditz [:dveditz]]

Interesting... but that would give a different blocked download wouldn't it? Should look more like https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware-protection-work#w_what-happens-when-a-page-or-file-is-blocked

I tried all those URLs in about:url-classifier and didn't get any detections. It's likely GMail has a broader context than the lists shipped to browsers.

The message in the screenshot is unique to insecure (http:) downloads and happens when the status Ci.nsITransfer.DOWNLOAD_POTENTIALLY_UNSAFE is set.

Comment 5

[Daniel Veditz [:dveditz]]

Can't proceed without more information about systems where these symptoms are happening.