How does built-in Phishing and Malware Protection work?
- Revision id: 93509
- Creator: Francois Marier
- Comment: Update spec URL
- Reviewed: No
- Ready for localization: No
Firefox contains built-in Phishing and Malware Protection to help keep you safe online. These features will warn you when a page you visit has been reported as a Web Forgery of a legitimate site (sometimes called “phishing” pages) or as an Attack Site designed to harm your computer (otherwise known as malware). This feature also warns you if you download files that are detected as malware.
Table of Contents
- 1 What are Web Forgery/Phishing, Attack Sites and Malware?
- 2 How does Phishing and Malware Protection work in Firefox?
- 3 I’ve confirmed that my site is safe, how do I get it removed from the lists?
What are Web Forgery/Phishing, Attack Sites and Malware?
Web Forgery (also known as “Phishing”)
This is a form of identity theft that occurs when a malicious website impersonates a legitimate one in order to trick you into giving up sensitive information such as passwords, account details, or credit card numbers. Phishing attacks usually come from email messages that attempt to lure the recipient into updating their personal information on fake but very real-looking websites. More information on phishing can be found at the Anti-Phishing Working Group, and there are a number of examples and resources available at the Wikipedia Phishing page.
Attack Sites are websites that try to infect your computer with malware when you visit. These attacks can be very difficult to detect; even a site that looks safe may be secretly trying to attack you. Sometimes even the website’s owner doesn’t realize that the site has become an Attack Site.
Malware is software designed to infect your computer without your knowledge. Malware is most often used to steal personal information, send junk email (spam), or spread more malware.
You can learn more about malware and Attack Sites from StopBadware, a non-profit organization that works with partners like Mozilla to protect users from malware and other dangerous software.
How does Phishing and Malware Protection work in Firefox?
Phishing and Malware Protection works by checking the sites that you visit against lists of reported phishing and malware sites. These lists are automatically downloaded and updated every 30 minutes or so when the Phishing and Malware Protection features are enabled. The technical details of the safe-browsing protocol are also publicly available.
When you download an application file, Firefox will verify the signature. If it is signed, Firefox then compares the signature with a list of known safe publishers. For files that are not identified by the lists as “safe” (allowed) or as “malware” (blocked), Firefox asks Google’s Safe Browsing service if the software is safe by sending it some of the download’s metadata.*
How do I use the Phishing and Malware Protection features?
These features are turned on by default so, unless your security settings have been changed, you are likely already using them. Phishing and Malware Protection optionspreferences can be found on the Security panel:
- Click the menu button and choose . .
- Click on the panel.
- Put a check mark next to the following settings to activate them:
- Block reported attack sites - this setting protects you from malware sites and files.
- Block reported web forgeries - this setting warns you against fraudulent websites that trick you into giving them your personal and financial information.
- Click to save your settings.Close the window to implement your changes.
To turn these features off, follow the preceding steps to return to thepanel and remove the check marks next to Block reported attack sites and Block reported web forgeries. Then click the button to save the settings.
What happens when a page or file is blocked?
Firefox will block the page from loading and display a Reported Web Forgery warning for phishing sites and Reported Attack Page for malware sites.
If you download malware or spyware, Firefox displays a message on the Downloads panel.
What information is sent to Mozilla or its partners when Phishing and Malware Protection are enabled?
There are two times when Firefox will communicate with Mozilla’s partners while using Phishing and Malware Protection. The first is during the regular updates to the lists of reporting phishing and malware sites. No information about you or the sites you visit is communicated during list updates. The second is in the event that you encounter a reported phishing or malware site. Before blocking the site, Firefox will request a double-check to ensure that the reported site has not been removed from the list since your last update. In both cases, existing cookies you have from google.com, our list provider, may also be sent.
I’ve confirmed that my site is safe, how do I get it removed from the lists?
If you own a site that was attacked and you have since repaired it, or if you feel that your site was reported in error, you can request that it be removed from the lists. We encourage site owners to investigate any such report thoroughly, though; a site can often be turned into an attack site without any visible change.