Mozilla temporarily stops Firefox Send to combat malware abuse

Mozilla has temporarily taken Firefox Send offline so that the company can make the service less attractive to malware abuse. For example, users were not required to have an account and could not report abuse, which made Send a lot of use by criminals.

ZDNet writes that Mozilla took Firefox Send offline on Tuesday, after the news site contacted Mozilla. According to research by ZDNet, the service was actively abused by cyber criminals. The criminals would upload the malware to Firefox Send, where the file was stored encrypted. Criminals could then send the Send malware links to victims. This would have spread, among other things, ransomware, trojans and spyware.

In an interview with ZDNet, security researcher Colin Hardy says Firefox Send is attractive to cybercriminals because, for example, companies trust the Send URLs. This would prevent spam filters from blocking Send links. In addition, criminals do not have to invest time and money in developing storage services themselves, but can use the Mozilla servers. Mozilla also encrypts the Send files, which makes detecting malware more difficult. Finally, Send download links can be set to expire after a certain number of clicks or time and be password protected, making incident response difficult, Hardy said.

Mozilla tells ZDNet to temporarily take the service offline so that it can make improvements to the platform. For example, it should soon be possible for Send users to report abuse of the platform and all users who want to share files via Firefox Send will soon have to log in with a Firefox account. The tech company also says it is looking further into additional possible solutions. When Firefox Send will return is not yet known. All Send links are no longer usable due to taking the service offline.

Firefox Send was taken out of beta in March 2019 and has been available to everyone ever since. The use of an account was not mandatory, but those who logged in could upload larger files. Whoever logged in could share files of up to 2.5GB, without an account the limit was 1GB. Mozilla focuses on privacy and security with Firefox Send.