21–30 of 71 posts
What would the benefit of something like this even be? Is it possible it's some sort of tool that archives a user's internet usage?
It is scary that for people in a corporate environment this could be rendering banking, messaging or any other pages contents.
I'm missing something > strange devices show up for some of our customers' users > how did it load these pages which were often behind an authwall without ever logging in or having auth cookies? Either - The customer has screwed up user auth big time and some X knows that.... lets go with no - OP's data is wrong or they are reading it wrong - They are explaining it badly.
What's happening is that some MiTM Palo Alto networks system is intercepting the HTML contents of the page, waiting a bit, and then rendering that HTML content again in old Chrome on a separate machine. It's like if you go to a authenticated page that only you can see, like https://news.ycombinator.com/flagged?id=aaron695 , did "View Source", copy-and-paste that source into a HTML file, and then you send me the HTML…
[0] https://docs.umbrella.com/deployment-umbrella/docs/install-c...
Edited to add link to docs.
It could be a chat preview generator. Users DM links to some internal project pages in an chat tool and the tool fetches the page in the background in an attempt to render a preview.
In this case these appeared to be all MitM'ed pages from a security device since the key wasn't in the url and it contained userids for a specific user.
Unrelated to the article directly, it's kinda neat that the site's text selection highlight color is randomized on every mousedown.
Here's my wild guess: Some other code running in the browser window (probably a browser extension, but possibly another script tag in the page, inserted by an intermediate firewall/proxy) is doing this. It could be corporate spyware (i.e. forced on users by the IT department), or an extension that only tends to be used by large institutions (because it relates to some expensive enterprise product). Alternatively, it…
The diversity of cloud networks looks to be due to these being deployed by individual institutions (eg. universities, corporations etc.) rather than only run from Palo Alto Network's data centers.
We also saw slightly different configurations with different browser versions, but with the same pattern of behaviour.
Unrelated to the article directly, it's kinda neat that the site's text selection highlight color is randomized on every mousedown.
- "Advanced URL Filtering" seems to have a feature where web content is either can be evaluated "inline" or "web payload data is also submitted to Advanced URL Filtering in the cloud" [1].
- If a URL is considered 2 spooky to load on the user's endpoint, it can instead be loaded via "Remote Browser Isolation" in a remote-desktop-like session, on demand, for that single page only [2].
I think either (or both) could explain the signals you're detecting.
[1]: https://docs.paloaltonetworks.com/advanced-url-filtering/adm....
[2]: https://docs.paloaltonetworks.com/advanced-url-filtering/adm...