1

I don't want to name names (in case it gets them some bad publicity for any party) however if there is a call for, then I can.

I went to a website of a popular templating/framework system in order to download the latest version for a new project. On their homepage they have a link to download the latest version from their github repo. The link appears fine, it's a zip from the releases as you would suspect. However on clicking the link (or navigating to the address in Firefox) the link is redirected to an AWS url and Firefox returns a 'Deceptive Site!' page (which I can ignore) stating it could be phishing or malware.

Should I ignore this deceptive site warning?

Is Firefox just being overly cautious? (change in domain on redirection)

Is there something genuingly bad happening and the relevant orgs should be informed?

The same url is available through github itself (the releases page) and is doing the same thing, redirecting and presenting a warning.

  • Its all whitelisted now. It appears github releases are on an AWS instance (verified by a get request to the resource) and something went wrong somewhere so it was redirecting users there rather than serving the download (github problem) – Crazy Dino Jul 25 '17 at 15:58
2

Most Releases on GitHub are hosted on GitHub's own servers (codeload.github.com), so if this URL is pointing somewhere else it may be purposely hosted elsewhere by the developers rather than Github's own distribution systems.

I would exercise caution. Firefox (and other browsers) don't generally inspect the content of downloads and leave that up to the security software on your system if present. They do evaluate the hosts you are connecting to and use a combination of blacklists and other techniques to determine the safety level. The error could simply indicate that suspicious content is located somewhere else on the same host, or that the content you are actually trying to address is hosted in an insecure fashion and that the integrity of the content is questionable.

Be sure to use independent verification methods for any content you eventually download, such as PGP signatures or published hashes. If you trust the source, then a hash match or signature verification shows that you do indeed have exactly what they published.

Finally, the connection you are using may be suspicious. I don't know where you are, but some ISPs may intercept and modify traffic in-flight which Firefox is alerting you to.

Proceed with caution regardless, and if you genuinely believe it is a false positive, you should raise it first with the site owner, and encourage them to take it up with your browser's developer.

0

Should I ignore this deceptive site warning?

No. you should surf the site with cautions. Send the URL to virtustotal for second opinion.

Is Firefox just being overly cautious? (change in domain on redirection)

No. The main reason Firefox/Google/Antivirus flagging a site as phishing always means something bad is found on that webpage. E.g. exploit script, malicious redirect, XSS injection, data skimming script, phishing contents, auto-fills data stealing, etc.

Is there something genuingly bad happening and the relevant orgs should be informed?

A compromised website is a responsibility to the site owner. If the site owner fix all the issue, then they should inform firefox to remove the flag.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.