Hacker News Reader

Comment by sfink | Hacker News Reader

I don't have any specific knowledge, but my general impression was that malware was a very real issue that nobody could come up with a realistic response to. Other than that, it seems like Send was a breakout success.

(I work for Mozilla, but mostly on the JS engine.)

View on HN

With the utmost respect, can somebody please tell if anyone thought of requiring a Firefox account? Or charge $2/mo and go from there? Products usually iterate on design and security, no? Not just give up right away?

Some of us recommended a Firefox+ service that bundles Firefox Send, the VPN, etc. and charge a monthly premium. I would've paid a lot of money. Nothing makes any sense looking from outside!

Somehow Mozilla nowadays reminds me of Yahoo! in the late 2000s and its struggles to remain relevant.

They didn’t require a Firefox account, but encouraged it by giving a significant file size limit increase.

I think you’re right, seems ashamed to give up so soon. I just have to imagine it’s a result of their current circumstances as a company.

In times of layoffs, I imagine there simply aren’t the resources to keep this thing going. I do like the idea of a ‘Firefox +’ type of service though.

2 questions:

1) how?

2) how did you know?

I can't quite see how malware would be sent with this? An exploiter uploads a file, then gets someone to download it - where's the secret sauce, why does this work better than hosting the file; each file is only downloadable once IIRC?

Next, how were Mozilla able to determine the contents of files shared (but not able to just drop by hash known malware, or run antivirus heuristics)?

The sending of malware part might be to get files served from a somewhat more trusted (and less likely to be blocked) domain. No matter how many files you sent through it, it was much less likely to get blocked at the DNS level by Quad9, OpenDNS, DNSFilter, etc. than some random compromised website. There's also a real incentive to having files retrievable only once, because if someone downloads the file and AV kills it, that email can't be passed along to someone so they can get their own clean copy for analysis.

As for how to identify it, because files were being encrypted before sending that probably was being done by seeing how much the service ended up in spam/phishing attempts - they may well have been able to get that information from filtering software vendors.

It's very common for malware to use services like this:

1) To host secondary payloads

2) To exfiltrate user data

3) In some cases even to coordinate commands to payloads

I didn't think about exfiltration - good point. I guess they could just host their own instance on <insert compromised server here> like the good old days.

Malware authors like nice APIs, just like devs do. They love when it's really nice and simple to just push some data to a storage service.

On other projects, we solved this by incorporating virustotal checking. Sure, a 0day or custom malware may get through, but thats a small number at the end of the day.

Reply on news.ycombinator.com