Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

10 Second Teleportation

upollo.ai

Post reply on HN
Print view View original

51–60 of 71 posts

Re: 10 Second Teleportation

#51

Post by ta1243 »

jitl wrote: post #16
aaron695 wrote: post #4

I'm missing something > strange devices show up for some of our customers' users > how did it load these pages which were often behind an authwall without ever logging in or having auth cookies? Either - The customer has screwed up user auth big time and some X knows that.... lets go with no - OP's data is wrong or they are reading it wrong - They are explaining it badly.

What's happening is that some MiTM Palo Alto networks system is intercepting the HTML contents of the page, waiting a bit, and then rendering that HTML content again in old Chrome on a separate machine. It's like if you go to a authenticated page that only you can see, like https://news.ycombinator.com/flagged?id=aaron695 , did "View Source", copy-and-paste that source into a HTML file, and then you send me the HTML…

Are you sure it's has the page contents, or if it's just got the URLs that were called?

Either way it feels like malware on a client machine, but doesn't necessarily mean that the page contents are being read by the malware.

I guess if you had some javascript which only loaded if the chrome version was not the latest you could confirm -- the attempt to load the URL would not occur on GoodChrome, but it would on the "security" device. Therefore if the page contents was being shipped to BadDevice completely it would be loaded, but if it was just re-loading the URLs called by GoodChrome the URL wouldn't be called.

Re: 10 Second Teleportation

#52

Post by qwertox »

Might as well be a browser extension.

I remember setting up a Confluence server which was only used by me, but had public access (still password protected).

When checking the logs, I noticed an external IP trying to access pages which I had accessed previously, but they got redirected to the log-in page. The paths were very specific, some which I had bookmarked, so it was clear that there was an extension logging my browsing and some server or person then tried to access my pages.

Re: 10 Second Teleportation

#53

Post by Sporktacular »

Aren't there systems where a server does the browsing and/or page rendering but it's controlled by terminals using other protocols?

Just speculatively, if someone was managing the setup of a room full of NSA analysts browsing for OSINT, how would they cover their tracks? What would that traffic look like?

Re: 10 Second Teleportation

#54

Post by pastage »

m463 wrote: post #44

I remember I worked somewhere where they had something like this. Most people had windows machines, but I had a mac that I had installed. My machine wanted me to accept a client certificate from palo alto networks. I did not and kept refusing. I think they had some sort of intrusive mitm proxy that filtered everything everyone was doing/browsing.

The usual way is to require a custom CA for all clients, sounds like an ineffective setup if you can just ignore it. I.e. it should be a intermediate certificate for the proxy you need to acknowledge.

Re: 10 Second Teleportation

#55

Post by sandworm101 »

Sporktacular wrote: post #53

Aren't there systems where a server does the browsing and/or page rendering but it's controlled by terminals using other protocols? Just speculatively, if someone was managing the setup of a room full of NSA analysts browsing for OSINT, how would they cover their tracks? What would that traffic look like?

It would look much like any other institution full of people doing general web browsing. A university full of foreign students googling stuff in thier home languages. A hospital full of patients googling about random stuff. An airport full of international passengers surfing twitter feeds for war news.

Re: 10 Second Teleportation

#56

Post by netsharc »

pronouncedjerry wrote: post #12
dag11 wrote: post #6

Unrelated to the article directly, it's kinda neat that the site's text selection highlight color is randomized on every mousedown.

did cursor-fidgeting-while-reading lead to this discovery?

I used to do this, I had to retire several mice because the underneath of the left mouse button was worn away from hitting the micro-switch so much..

Re: 10 Second Teleportation

#58

Post by Sporktacular »

sandworm101 wrote: post #55
Sporktacular wrote: post #53

Aren't there systems where a server does the browsing and/or page rendering but it's controlled by terminals using other protocols? Just speculatively, if someone was managing the setup of a room full of NSA analysts browsing for OSINT, how would they cover their tracks? What would that traffic look like?

It would look much like any other institution full of people doing general web browsing. A university full of foreign students googling stuff in thier home languages. A hospital full of patients googling about random stuff. An airport full of international passengers surfing twitter feeds for war news.

What they choose to investigate is itself revealing. CDNs and large hosting providers for example would be in a position to make inferences by observing and correlating traffic from that origin. I would be trying to obfuscate it using a VPN distributed over a range of countries and IP addresses. That could appear strange to a host, depending on how they implement it.

Re: 10 Second Teleportation

#59

Post by sandworm101 »

Sporktacular wrote: post #58
sandworm101 wrote: post #55

Earlier quoted context omitted.

It would look much like any other institution full of people doing general web browsing. A university full of foreign students googling stuff in thier home languages. A hospital full of patients googling about random stuff. An airport full of international passengers surfing twitter feeds for war news.

What they choose to investigate is itself revealing. CDNs and large hosting providers for example would be in a position to make inferences by observing and correlating traffic from that origin. I would be trying to obfuscate it using a VPN distributed over a range of countries and IP addresses. That could appear strange to a host, depending on how they implement it.

Except that most open source material is now encrypted. They could see lots of traffic towards Twitter/Facebook/YouTube/google and lots of overseas news sources but would have little insight into actual content.

Re: 10 Second Teleportation

#60

Post by maxlin »

"Palo Alto Networks" is something that shows up clearer than anything else in my lighttpd logs, as they include the "we're palo alto networks doing research, contact us here(email) for us not to scan" in http request headers. They appear to do full ipv4 range scan many times a day IIRC.

Funnily enough I got motivated to try to make my crawler show up the same way in my own server logs by just raw scan breadth, IE by hitting so many servers I'd see my own crawler in the logs without any kind of targeting. As a kind of "planetary level experiment" source of curiosity.

Had to tweak masscan settings till my crappy router could keep up with the routing load. Ended up with something like 500 addresses / sec, which pales in comparison to the best hardware used for this which when combined with masscan, scans the ipv4 space in 6 minutes. Managed to scan 1% of the IPV4 space while I slept before I started to get seriously throttled and got a quite angry email from my ISP. Just told them "Oh thanks for noticing, I now fixed the offending device" (pressed Control+C) and never ran the scan again lol.

Ran the scan with masscan with no blacklist. Don't recommend, at least not doing it more than once unless you get a good blacklist to follow

Post reply on HN