455
edits
CFA/Security-Research/MalwareDetection: Difference between revisions
CFA/Security-Research/MalwareDetection (view source)
Revision as of 06:47, 8 August 2007
, 8 August 2007→Conclusions
| (14 intermediate revisions by the same user not shown) | |||
| Line 10: | Line 10: | ||
=== Upcoming Capabilities === | === Upcoming Capabilities === | ||
* | * Display error page when malware page is found - FF3 | ||
** Malware checking blocks page loads | |||
** Check malware URL blacklist (like StopBadware.org) | |||
** API to allow callers to determine if given URI is in the blacklist | |||
=== Features by 3rd parties or other browsers === | === Features by 3rd parties or other browsers === | ||
| Line 16: | Line 19: | ||
** Executable blocked | ** Executable blocked | ||
** Embedded content blocked (ad, video, blog, photo, etc.) | ** Embedded content blocked (ad, video, blog, photo, etc.) | ||
** Page blocked | ** Page blocked (in FF3) | ||
** Site blocked | ** Site blocked | ||
** One click to permanently add site to whitelist | |||
* Protected Mode - runs in isolation from other applications in the OS. Restricts exploits and malware from writing to any location beyond Temporary Internet Files without explicit user consent - IE7 | * Protected Mode - runs in isolation from other applications in the OS. Restricts exploits and malware from writing to any location beyond Temporary Internet Files without explicit user consent - IE7 | ||
* Cross-domain barriers - prevent script on webpages from interacting with content from the other domains or windows; protects against malware by helping prevent malicious websites from manipulating flaws in other websites - IE | * Cross-domain barriers - prevent script on webpages from interacting with content from the other domains or windows; protects against malware by helping prevent malicious websites from manipulating flaws in other websites - IE | ||
* | * Integrate sandboxing feature like Sandboxie, GreenBorder, or IE extension SpyWall Anti-Spyware; integrate virus scanning and malware protection for retrieved content/files | ||
=== Additional features === | === Additional features === | ||
* Ability to disable handling and downloading of certain file types - FF brainstorm | * Ability to disable handling and downloading of certain file types - FF brainstorm | ||
=== Screenshots === | === Screenshots === | ||
<b> | <b> Haute Secure: </b> | ||
[[Image: | [[Image:MalwareHauteSecureButton.PNG]] | ||
[[Image:MalwareHSembeddedContentBlocked.PNG]] | |||
[[Image: | [[Image:MalwareHSembeddedContentBlocked2.PNG]] | ||
[[Image:MalwareHSsiteBlocked.PNG]] | |||
<b> Search result malware detection: </b> | |||
[[Image:MalwareFinjanFFext.PNG]] | |||
=== Conclusions === | === Conclusions === | ||
* We should make decisions for users where we can, and warn without being annoying when we cannot | |||
* Specific content blocking and other warnings should display an indicator in the Address Bar with more information upon user click (like Haute Secure) | |||
* Integrate sandboxing to perform real-time checking for malware. Each malicious website is short-lived, so blacklists limit protection | |||
* Finjan FF extension takes too long to load | |||