Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 4 down vote favorite

After I ticked that my browser (Firefox) must require OCSP: http://i.stack.imgur.com/UeDXh.png

I got a window popped up (several times! And it still pops up.. ~randomly ~about a few 10 minutes): http://i.stack.imgur.com/NYdoe.png

I didn't visit this site, nor any wordpress domain!

$ host -t any hackedirl.files.wordpress.com
hackedirl.files.wordpress.com is an alias for lb.files.wordpress.com.
$ host -t any lb.files.wordpress.com
lb.files.wordpress.com has address 72.233.2.56
lb.files.wordpress.com has address 72.233.69.13
lb.files.wordpress.com has address 72.233.104.107
lb.files.wordpress.com has address 72.233.127.222
lb.files.wordpress.com has address 74.200.243.250
lb.files.wordpress.com has address 74.200.244.58
lb.files.wordpress.com has address 74.200.247.35
lb.files.wordpress.com has address 74.200.247.186
lb.files.wordpress.com has address 76.74.254.118
lb.files.wordpress.com has address 76.74.254.122
lb.files.wordpress.com has address 76.74.255.116
lb.files.wordpress.com has address 76.74.255.122
$

Should I start thinking of a clean reinstall of my PC? :\

share|improve this question

1 Answer

up vote 10 down vote accepted

hackedirl means HackedIRL -> Hacked In Real Life

It is a name used by sites of the Cheezburger network (fail blog and others) - just a funny name, nothing to do with hacking.

The reason you see all these IPs is that Cheezburger network uses the wordpress platform for the content of its sites and wordpress does load balancing and redundancy using DNS.

Moreover, as this tool can verify that all the certificates of the multiple servers are fine.

hackedirl.files.wordpress.com uses the same certificate with all other wordpress sites, it is issued to *.files.wordpress.com. The OCSP responder mentioned in the certificate is

Authority Information Access: OCSP - URI:http://ocsp.godaddy.com/

The error you see means "The OCSP server experienced an internal error." as you can see here.

I don't know exactly why it fails for you, but a packet capture would be usefull. All is working fine here with that site and the OCSP request.

EDIT: Looked further into the source code, and here is what really happens: This error will be presented if any of the following conditions holds true:

  • the http server session is not created, for whatever reason
  • the http client session is not created, for whatever reason
  • the http request with mime subtype "application/ocsp-request" is not made correctly
  • the response from the ocsp server is very large
  • the response has a flag set that says that it an internal error happened server side

So, my guess is that you have some connectivity problems of some sort, and you are unable to contact http://ocsp.godaddy.com/ successfully.

share|improve this answer
wow, thank you for the great answer! but I'm not visiting such sites :\ *.wordpress.org why does Firefox show me this message. – LanceBaynes May 23 '11 at 17:40
2  
you are visiting sites that use the wordpress system, like failblog.org or any other site of the cheezburger network ( list of sites here: cheezburger.com/sites ) – john May 23 '11 at 17:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.