Google Chrome Adding Malicious Drive-By-Downloads Protection

Minimalist · Feb 20, 2019

Google to make private browsing more secure in Chrome’s Incognito mode

Many websites including Facebook collect your on-device data such as cookies to serve you targeted advertising. Privacy conscious users prefer browsing in Google Chrome's Incognito Mode than the regular browsing.

Google Chrome's privacy mode, however, doesn't completely bar sites or applications from tracking you. Over the years, hackers and developers have found loopholes in the incognito mode and have managed to track you and your web activity.
Click to expand...

https://www.thestar.com.my/tech/tec...owsing-more-secure-in-chromes-incognito-mode/

guest · Mar 11, 2019

Google Chrome to block automatic downloads initiated from ad slot iframes
Google continues its crusade against "drive-by download" attack vectors
March 11, 2019
https://www.zdnet.com/article/googl...tic-downloads-initiated-from-ad-slot-iframes/

"We plan to prevent downloads initiated from ad frames that lack a user gesture to prevent unwanted drive-by-downloads," Google developers said in a Chrome browser status page published today.

According to a design document that Google also published today, an "ad frame" is "an iframe marked as ad by the Chromium ad detection infrastructure AdTagging." This basically means any iframe that Google believes to be an ad.
Google didn't say when it plans to start blocking automatic file downloads initiated from ad slots, but the feature is expected this year.

This security feature and the protection it provides is only valid if users don't interact with the ad frames. File downloads will be allowed if users click or swipe on an ad. This will be allowed so ads can show "download" or "get it here" type of buttons.
Click to expand...

guest · Apr 10, 2019

Google Wants To Block Potentially Risky Non-Secure Downloads
April 10, 2019
https://www.bleepingcomputer.com/ne...block-potentially-risky-non-secure-downloads/

Google proposed the addition of automatic blocking of high-risk downloads from non-secure websites in future versions of its Chrome web browsers as revealed by a proposal from Google Chrome security engineer Emily Clark in the World Wide Web Consortium (W3C) public mailing list.

This means that users will no longer be able to download executables or archives delivered over an HTTP connection initiated from HTTPS websites because the Chrome web browser will tag them as mixed content and will automatically block them.

According to the Chrome engineer "We want to achieve the right balance between compatibility/user-disruption and security improvements, so we will likely start by treating certain high-risk downloads initiated from secure contexts as active mixed content and block them."
As detailed by Clark proposal, Chrome will flag "exes, dmgs, and crxs as executables, and zip/gzip/rar/tar/bzip/etc. as archives," with a full list of the targeted file types available HERE.
Click to expand...

Clark said that "We're still finalizing our metrics before we can share them publicly [...]"
Mozilla security lead Daniel Veditz also expressed interest into adding this feature within Firefox, stating that "I would be very happy to push in this direction [...]"
Click to expand...

guest · Feb 6, 2020

Google Chrome to Block Mixed Content Downloads, Prevents MiTM Attacks
February 6, 2020
https://www.bleepingcomputer.com/ne...ixed-content-downloads-prevents-mitm-attacks/

Google is moving forward with its plan to block mixed content downloads from web sites to protect users from man-in-the-middle attacks.

In an announcement posted today, Google has outlined their plan of gradually rolling out this feature in Chrome by first displaying console warnings to the eventual blocking of all mixed content downloaded files.
Google states that they are blocking these types of downloads as they are a risk to a user's security and privacy as they could be swapped out or viewed in man-in-the-middle (MiTM) attacks.

"Insecurely-downloaded files are a risk to users' security and privacy. For instance, insecurely-downloaded programs can be swapped out for malware by attackers, and eavesdroppers can read users' insecurely-downloaded bank statements," Google stated in a blog post. "To address these risks, we plan to eventually remove support for insecure downloads in Chrome."
Google further states that they plan to further restrict insecure downloads in the future, which most likely means that they will block all downloads from insecure sites regardless of what type of site the download was initiated.
Click to expand...

Testing the feature now
For users who want to test this feature, Google has an experimental flag titled 'Treat risky downloads over insecure connections as active mixed content' that can be enabled in Chrome 80 and later.

Once enabled, if you attempt to initiate a download delivered over insecure HTTP connection when they are first initiated from HTTPS websites, you will see a warning stating "[executable].exe can't be downloaded securely."
You can test this feature yourself, using this proof of concept page hosted at BleepingComputer.com.
Click to expand...

Google: Protecting users from insecure downloads in Google Chrome

Sampei Nihira · Feb 10, 2020

If anyone wants to take a test:

https://browserleaks.com/ssl

It seems to me that the BleepingComputer test fails.

Log in or Sign up

Google Chrome Adding Malicious Drive-By-Downloads Protection

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

Sampei Nihira Registered Member

Log in or Sign up

Google Chrome Adding Malicious Drive-By-Downloads Protection

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

Sampei Nihira Registered Member

Useful Searches