1

So after someone mentioned Hangul on another SE site, I just felt like watching another few Korean lessons. Came across a video that I liked, and the author finished with the (usual) more-on-my-website closing. Although the domain name looked a bit funny (koreangirlinsg.com), I figured why not, could as well look. Worst thing to happen is it's a date site (which I kinda half-assumed from the name). But maybe that woman is just bad at choosing domain names.

Turns out it's one of those entirely blank portal sites that display "click to proceed" as the first thing. Well, OK, whatever. I feel some disappointment coming up, but let's not just abandon all hope. Click.

tl;dr
Next, Firefox pops up a notification saying "Firefox stopped this site from installing software on your computer, do you want to proceed? Yes, no."

Wait a moment. Now, this is a surprise.

Basically every setting that I know about which allows something or does something extra, not just in the browser but on the computer is set to "No". Components that I'm not using (which is about 50% of Windows) were removed from the install medium with NtLite prior to setup.
My browser has scripting blocked at all times, with the exception of 2-3 whitelisted sites, also I have everything that counts as "extra smart shit" which isn't absolutely necessary for displaying a website turned off. Anything I don't know, turned off. Anything I do know but don't absolutely need, turned off. Adblocker including all available ad, badware, social, and annoyance filters running, not making an exception for anyone. No Flash plugin or the like installed (even the browser-supplied H264 codec is disabled because I'm not sure why I'd need it).

So the apparently naive assumption is that the browser shouldn't generally do much but display HTML (with broken layouts, which I'm willing to accept) and load some images.

Nevertheless, it is apparently still very straightforward for a random, untrusted site to install software. And most notably, not via an exploit, but via a method that Firefox obviously deems a very acceptable, viable option (it proudly tells you it didn't just do it yet, but still asks whether you want to proceed). Makes you somehow think of Internet Explorer 20 years ago.

Apparently, there is an explicit "install haphazard software on computer" functionality built directly into HTML that I'm not aware of, and browsers support it?

What would be the rationale for such feature?
[And maybe more importantly, how do you turn this off for good?]

  • Is this really the exact message you got? Are you sure that this is really a message created by the browser and not something which is done by the web site to trick you? Could you provide an image? – Steffen Ullrich Dec 31 '18 at 14:26
  • Well, it's definitively not the exact message since I translated the message out of my memory from German to English approx 5 mins later. Though I think it's reasonably accurate. The popup looked similar to the edgy-speech-bubble ones that you get when it tells you "This Website would like to install an add-on". Although I probably don't risk anything (having already visited the site once) I'm kinda reluctant to try again for a screenshot. For what it's worth, I've looked at what wget dumps to the console (need to fake user-agent, or you just get a robots page). What I can see is.. (cont) – Damon Dec 31 '18 at 14:49
  • (cont) a variety of scripts (inline, and loaded separately) which at the first glance seem like some pretty standard unreadable no-whitespace (though not even overly obfuscated) ad stuff, browser detection, and frame trickery. Then some opentype fonts in CSS which my browser won't load, needlessly long URLs with 100+ character GET payloads, and some super awesome 1990s mouse hover scripts that change link names when the mouse is over. – Damon Dec 31 '18 at 14:54
  • The problem is that I cannot reproduce what you say within Firefox with adblock (site gets blocked). Without adblock I get only some ads and it looks like the domain is for sale. Since I cannot reproduce it I can also not explain what has happened to you. – Steffen Ullrich Dec 31 '18 at 14:57
  • 1
    Is it the same popup that appears for example on 1password.com/browsers/firefox ? In English, it says: Firefox prevented this site from *asking* you to install software on your computer. That's related to add-ons anyway, an additional warning before even asking you to install an add-on. – reed Jan 1 at 14:38
1

I suspect that what you describe is a feature Firefox implements for the HTTP protocol. Whenever a browser downloads a file from a HTTP(S) server, its reply does not contain only the requested file. The reply is augmented by a few "HTTP headers" that provide details about the file. One of the most important headers is called "Content-Type".

The easiest view to display this information is the built-in http monitor feature of Firefox
Menu -> Tools -> Web developper -> Network -> Content-Type will be listed as column "Type".

When the server replies with "Content-Type: application/x-xpinstall", a similar mesage appears:
"sourceforge.net Firefox prevented this server from asking to install software into your computer"
Those who do not fear javascript can see it for themselves for example here

This behaviour is different, when you visit the offending URL directly. In that case the message is roughly: "Application Firefox prevented this server from installing an unsigned addon. Find out more"
Example of this behaviour is this URL, which is the actual x-xpinstall URL from the example above.

The behaviour is also different if the downloaded file is properly signed.

Note that the last example had no JS/CSS/HTML. The only role HTML plays in the story is, that it triggered a download (a normal thing), which just happened to be Content-Type: application/x-xpinstall. This feature can only install potentially unsigned Firefox addons (.xpi), which is bad enough.

This MozillaKB article describes how to disable xpinstall:

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.