459324 - Google scanner scans my computer

Status: RESOLVED INVALID

(Firefox :: Security, defect)

Description

[Tony Pickert]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.3) Gecko/2008092417 Firefox/3.0.3
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.3) Gecko/2008092417 Firefox/3.0.3

OPTIONS, Security page: if these two are checked
Tell me if the site I'm visiting is a suspected attack site
Tell me if the site I'm visiting is a suspected forgery
Google begins scanning my computer instead of the website visited.

Reproducible: Always

Steps to Reproduce:
1. Check Security option for forgery
2. Apply
3. Restart Browser. Wait one to three minutes. 
Actual Results:  
Google sites used in the past to scan my computer are
74.125.12.99
72.14.205.100
62.43.180.237
64.233.167.100-64.233.167.117

Expected Results:  
I stop the scanner by shutting down network activity.

Scan the visited website.

Comment 1

[Daniel Veditz [:dveditz]]

Google does not "scan" your computer through Firefox, it is responding to requests Firefox has made for information from Google servers. A network traffic tool should show these as responses, not requests.

For the anti-phishing ("Web Forgery detection") and anti-malware protection we regularly download updates for the list of known bad sites from Google. Google generates the list of sites based on what they find when scanning websites to update their search index. The sites we contact for that are http://safebrowsing.clients.google.com and https://sb-ssl.google.com (IP addresses will vary over time as requests are spread over Google's many servers)

Google is also contacted for search requests if you've chosen Google as your search provider. A "keyword" search is also performed if you type something into the address bar that does not look like a URL.

Feel free to change any of those default settings: it's your browser. Disabling or changing the keyword search is a little obscure, you can get help from http://support.mozilla.com

62.43.180.237 is registered to "ono.com", registered by Cableuropa SA. Dunno what that is, but it's not Mozilla nor Google. Do you have a "Live Bookmark" (rss feed) pointing at them? Are they your Internet provider (they're in Spain)? The rest do appear to be Google addresses.

Comment 2

[Tony Pickert]

Thank you, Daniel, for environmental Firefox suggestions.

Google is scanning, not downloading, from those Google servers....
I may be able to resolve certain Google components in ABOUT:CONFIG options.

I suspected, at first, that it has something to do with YouTube.... and
it's still an open possibility.