FireFox calling home?

Printable View

July 25th, 2007, 01:45 PM
Mykol

FireFox calling home?

I just happened to be running Wireshark doing some other stuff and noticed an very short SSL exchange happen. I had Firefox open, but only on a couple of regular http pages. Any ideas? I didn't think Mozilla was into this kind of secret phoning home, it seems more of an M$ trick. Here's some excerpts from the reassembled convo (with human readable extracts and snips) -- but it's just mostly the SSL cert and encryption setup stuff, nothing to indicate what it's really doing...

Anyone know what's going on?

IP dest was 63.245.209.49 (Mozilla.org)

...+.........aus2.mozilla.org.
........................F..F.?..S.....0....`..bk] .../..L.X G."..6.`...
C..F.[...u..#.F...|..............0...0.........
j
5......:0
..*.H..
.....0..1.0...U....US1.0...U....Texas1.0...U....San Antonio1.0...U....GS CA1$0"..U.
..XRamp Security Services Inc1&0$..U....XRamp Security Services GS CA0..
050105052436Z.
080105054019Z0..1.0...U....US1.0...U...
California1.0...U...
Mountain View1.0...U.
..Mozilla Foundation1.0...U...
*.mozilla.org1.0...U...
*.mozilla.org1%0#..*.H..
[email protected]

http://crl.xrampsecurity.com/XRampGSCA.crl0U..U. .N0L0J..`.H...E....0;09..+........-http://www.xrampsecurity.com/legal/issuer.asp0
July 25th, 2007, 02:19 PM
nihil

Hi Mykol,

Obviously I don't know what all that means other than than FF was establishing a secure link with the mothership.

As far as I am aware XRamp Security Services Inc. are reputable suppliers of secure communications technology and are accepted by the likes of Visa, Amex and so on.

If you let it, FF will do one or most of these:

1. Check for updates to FF
2. Check for updates to plugins to FF
3. Warn you that an update is available
4. Automatically update

I would suggest that you look at <Tools> <Options> <Updates> and see what your settings are.

If that happened this morning (GMT) then FF did do an update on my machine.

:)
July 25th, 2007, 02:28 PM
SirDice

CRL? Certificate Revocation List? It looks like an SSL certificate..

FF update check seems the most logical explanation.
July 25th, 2007, 03:45 PM
Mykol

yep

...that's what I was leading to -- an update, or a certificate update. Just wondering if anyone had any insight on anything *else* that may be going on. If it were Internet Exploder, I'd immediately think malicious, with Mozilla, I'm thinking practical (and giving the benefit of the doubt)...

cheers!
July 25th, 2007, 09:19 PM
mungyun

nihil is right. FF checks for updates rather regularly. Several times a day (Dont know the actual number) but when it does that it checks for updates for anything else like plugins etc. If you have ThunderBird, you will probably notice the same thing going on to pretty much the same internet addresses.
July 29th, 2007, 06:00 PM
Nokia

weird how it uses an SSL connection to do it though........transmitting private information maybe??? Could be worthwhile setting an SSL proxy up to see what it being sent...

//edit: although on second thoughts it is going to need to validate the identity of the remote host that is receives updates from.
July 29th, 2007, 07:42 PM
d34dl0k1

first of all, wow. we're getting paranoid about open source code? :drink:

It's using a cert to verify the update. otherwise you can't verify it's integrity. Windows update does the same thing. Or, didn't you know? :)
July 29th, 2007, 08:10 PM
nihil

Quote:

first of all, wow. we're getting paranoid about open source code?

Shame, shame and triple shame on you d34dl0k1 !!!. You actually only got a half of it there :D

Open source, closed source............... it really doesn't matter.......... both are equally crap.

What I didn't bother to mention was "what are the motives of FF to do such a thing............err like what benefits would they gain?"

To get a reasonable chance of a conviction you have to demonstrate:

1. Ability to commit the crime
2. Presence (or at least lack of alibi)
3. Motive to commit said crime

It is on #3 that the case fails miserably?

Incidentally, don't get seduced by open source............... I could provide many open sources....... and you wouldn't even know what language they were in?:p They are not "audited" by jealous "wannabees", unlike closed source applications....... mainly because such information is of no commercial value.

:cool:
July 30th, 2007, 04:48 AM
d34dl0k1

Ha! We agree both are equally crap. However, I find even the slightest accusation against Firefox to be somewhat ignorant when the benefit of THE SOURCE is available!

Seduced by open source... that's the first time i've been accused of THAT! ha.;)
July 30th, 2007, 08:17 AM
nihil

Hi, d34dl0k1,

I get the feeling that there is something of a generation gap (or three!) between us? :D

I come from a generation when you actually got the source (if you wanted it) of COTS products. So, these packages would be "closed source" in today's nomenclature because they are proprietary COTS?

I am referring to stuff like IBM's "MAAPICS" and the like, and I am talking about applications, NOT operating systems.

Now, you needed the source for systems integration and interfacing your own grown applications (typically, reporting and statistics).

What you did not do, is mess with the source (that made your application unsupportable under the terms of your EULA)............hence my use of the expression "seduce". Because there is a temptation to make amendments to the sources of today's "open source" applications. In fact you are encouraged to do so?

I take your point that the "vanilla" version of an open source application is unlikely to contain anything underhand, because it can be examined, and will have been subjected to an independent peer review.

My approach was that the provider (Mozilla) has no motivation to do such a thing anyway. My advice would be that people should just be sure to get their open source applications from the developers' or other trusted website.

Mainstream open source code will be scrutinised, but the compiled executable on http:/narstyhakzncrakz.biz will not have been. And the source could well have been amended to produce that compilation. :shocked:
July 31st, 2007, 05:57 AM
d34dl0k1

did you just say narsty? are you making up words? you are either really young or really old

i'd love to know what kind of hidden gems are hidden in some software available on sourceforge. you know, the kind that isn't popular enough to bother auditing. :halo:
July 31st, 2007, 09:40 AM
WolfeTone

Quote:

Originally Posted by d34dl0k1

did you just say narsty? are you making up words? you are either really young or really old

The more politically correct term is "Experienced". :D
July 31st, 2007, 10:12 AM
nihil

Quote:

Originally Posted by d34dl0k1

i'd love to know what kind of hidden gems are hidden in some software available on sourceforge. you know, the kind that isn't popular enough to bother auditing.

Actually, you have answered your own question. malware authors and users are "percentage players"

If it isn't popular, it isn't worth writing an exploit for because you won't find a victim.

If it is malicious of itself, you have wasted it by putting it on a site where it isn't popular. You put it on sites where idiots go: warez, crackz and P2P :D

I invent English words as I see fit..............it is my birthright :p...............

And when I started programming there were NO nancy boy GUIs, hell, there weren't even VDUs............ It was 80 column punched cards.......... real man's stuff :killcompu .................and Bill Gates was getting busted for smoking dope..................
July 31st, 2007, 01:43 PM
oofki

Plus Nihil is from the UK he can make up words and pretend like they have been around for ages. Thats just how it works.