firefox

firefox

Why do users ignore malware warnings?

Posted on February 26, 2014 - 16:03 by ccondon

At StopBadware, it's important to us to measure how different parts of the Web are responding to malware. One of the ways we do this is to look at data about users who ignore malware warnings. For instance: what kinds of content do Web users most often insist are not malicious? 

The following is a breakdown of the top kinds of sites for which Firefox users clicked through "Reported attack site" warnings in 2013. 

Content for which Web users most often ignore malware warnings

 

(Note: There are about 30 sites included in this data. Percentages are not representative of all Firefox users who clicked through malware warnings last year—only users who clicked through warnings for the top sites that referred traffic to StopBadware.)

Background: Firefox's link to StopBadware is a two-step process: a user must click "Ignore" on a warning and then click a separate button on a toolbar Firefox displays at the top of websites blacklisted by Google. The toolbar button says, "This isn't an attack site." When clicked, it prompts Firefox to redirect those users to StopBadware's landing page

It's also worth noting that a number of the sites represented in this chart were later found to have been compromised via infected ad networks. This is one of the reasons malvertising is so insidious: it's one of the most common ways big, high-traffic sites are compromised...and users are much more likely to ignore warnings for popular sites with which they're familiar. 

StopBadware, Mozilla, and Google

On CNet yesterday, Chris Soghoian blogged an interview with Mike Shaver at Mozilla. In it, StopBadware's role is mischaracterized. It turns out it was nothing more than a misunderstanding, and we're happy to be working with Mozilla to set the record straight.

Mozilla, Google, and StopBadware are all expected to play a role in ensuring that the needs of both users and web site owners will be addressed in Firefox 3. Mozilla is working with Google to provide a list of potentially harmful URLs that will be used by Firefox to warn users before they browse to a site that may contain malware. This data comes from Google's own scanning and research, not from StopBadware, as reported. (Our Clearinghouse allows users to search for a site to see if it is currently on Google's warning list.)

StopBadware's role will be (as it is now) to ensure that users and web site owners receive as much information as possible about the warning and to provide a transparent review process to assist site owners in understanding why a site was flagged and/or notifying Google that it has been cleaned.

By working together, we help protect users from potentially dangerous web sites while ensuring that owners of legitimate sites have a way to understand the warnings, clean up their sites, and remove the warnings.