Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've found out that if you download a file with Firefox, a similar window as this one pops up (in dutch in my case):

enter image description here

("Bestand opslaan" = "Save file")

However, the file is already being downloaded before I press the Ok button (i.e. I waited 1 minute before clicking on the Ok button and already 50Mb of 191Mb was downloaded).

Does this feature come with any security risks (a malicious file could be downloaded before I even had the chance to click Cancel) and should I find a way to disable it or is this perfectly safe?

share|improve this question
    
Could someone link to any official documentation on this feature? It'd be very useful to see how / why this is done. –  Polynomial Feb 5 '13 at 16:19
    
@Polynomial Based on the answers, I found this FAQ on the Mozilla website about this feature: developer.mozilla.org/en-US/docs/Link_prefetching_FAQ –  Aerus Feb 5 '13 at 17:05
2  
@Aerus: that is a different kind of link prefetching. –  Lie Ryan Feb 5 '13 at 18:53
    
@LieRyan Indeed, although I believe it can be immediately extended to files downloaded in this manner because disabling network.prefetch-next in the config (as mentioned in the FAQ), also disables this behaviour. –  Aerus Feb 5 '13 at 19:42
1  
Whats the problem. Your security software would begin to scan this file. I have many files blocked in Chrome because of prefetching. –  Ramhound Feb 6 '13 at 12:29

4 Answers 4

up vote 16 down vote accepted

Technically, the popup does not ask you whether you really want to download the file; that decision, you already took when you clicked on the link which triggered the download. The popup asks you what Firefox should do with the file when it has been fully downloaded.

Potentially hostile files can be a security issue. Filesystems normally store files as bunch of bytes and are thus nominally immune to the file contents; but modern operating systems are not content with handling files as files. For instance, if you open a file explorer to see the directory in which downloaded files are stored, and the file has a name which ends in '.jpg' or '.png', then the file explorer will try to interpret the file contents automatically, as a picture, so as to compute and display a miniature view of the said picture. Any security hole in the JPEG or PNG support library could then be exploited by a malicious file, and it does not require any "opening click" on the file, just opening the directory.

The Web is a harsh place.

share|improve this answer
1  
this is not a problem with the web it's a problem with C for not being memory-safe –  Longpoke Feb 7 '13 at 21:20
2  
@Longpoke And with dumb programmers who use C for tasks that it's not suitable for. –  Sarge Borsch Feb 7 at 0:06

To disable it just write about:config in the address bar and search for network.prefetch-next.

Set this to false and no pre-downloading should occur. - This does not work on 18.0.2 on Ubuntu or Windows 7, although it is the only method I have found searching the web. I have tried various other settings, nothing worked. It seems that this behavior cannot be disabled.

Supposing that the file contains malware, when the pre-downloading is finished, you may receive an alert from your antivirus.

As long as you do not open the file, you should be safe. If you clicked cancel, Firefox would just delete the file.

Of course, there is always a chance that coupled with a certain vulnerability (in the browser, in the indexing software, etc) an exploit could be built, but I think this is unlikely.

share|improve this answer
    
Thank you, changing the setting in about:config worked ! –  Aerus Feb 5 '13 at 17:07
2  
@Aerus That setting affects something completely different (prefetch hints, which have nothing to do with downloads). I'm surprised that it would make a difference, and I tested with Firefox 17 on Linux and indeed it doesn't. Are you sure you tested the right thing? –  Gilles Feb 5 '13 at 23:43

Firefox isn't “pre-downloading”. You chose to start downloading by selecting “Save Link As” in the menu, or left-clicking on a link whose content type has no internal or external handler. Once Firefox has started downloading, it prompts you for a save location. As long as you haven't entered that location, it downloads the file to a temporary directory (platform-dependent), either with the server-supplied default file name plus a .part suffix or with a randomly-generated file name (I think that depends on the version, perhaps on the platform as well).

Firefox needs to start downloading before prompting you for a file name, because the default file name can be supplied by the server: the original link could be a redirection (so Firefox needs to initiate the connection and read the response code, and there could be a file name in a Content-Dispotition header (so with a 200 response, Firefox needs to read the headers).

There is no security risk here. When you click on something in a browser, it is expected that the browser will establish a connection and download the content at that link. Sure, there could be security issues (e.g. the content may trigger an exploitable browser bug), but that is a risk that you take by using a browser in the first place. To have every click in a browser pop up an “are you sure?” dialog box would be a usability nightmare, with no security benefit since you'd be clicking “yes” all the time anyway.

Ok, Firefox could pause the download after the headers. But that wouldn't serve any useful purpose (in addition to being bad for performance and usability). The exploit could be in the headers, after all.

share|improve this answer
1  
As you point out the security risk remains the same no matter if Firefox is set to prefetch the file or wait until you tell it has a final desination for the file before it begins to download the file. if the content is malicious its dangerous no matter what. –  Ramhound Feb 6 '13 at 12:40

I can imagine certain conditions for this to become a security issue:

  • The browser downloads the file that triggers a vulnerability in the file browser like the WMF vulnerability
  • A virus scanner might start scanning the partially downloaded file and it could trigger a vulnerability in the scanner. Sophos had some bad press recently.
  • A huge file that is highly compressible would download very quickly and could use up all drive space.
share|improve this answer
    
The "huge files will take up all your hdd space" isn't really a security issue. –  Ramhound Feb 6 '13 at 12:31
    
Resource exhaustion is a software weakness that can be considered a security issue if it bypasses a protection mechanisms. cwe.mitre.org/data/definitions/400.html: In some cases it may be possible to force the software to "fail open" in the event of resource exhaustion. The state of the software -- and possibly the security functionality - may then be compromised. –  Cristian Dobre Feb 6 '13 at 12:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.