Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Recently while trying to log-in to Facebook this notification starts to appear:

text

At first I ignored it (by pressing Continue), but it started to popup every time I navigate through the website!

I thought it might be a fake certification applied by the ISP so I changed my account password and started to choose Cancel every time it pop's up, I expected that the page wont load! but nothing happened and on the contrary the web page continued to load normally?

Can anyone explain what happening and clear the whole idea to me?

Message shown again and here is the Show Certificate details:

enter image description here enter image description here enter image description here

share|improve this question
2  
Does the "show certificate" say anything? If the certificate is not valid, it's for a reason: expiration date reach, certificate authority not recognised etc... can you provide more information? –  M'vy Aug 31 '11 at 12:45
    
@Mvy: there were an extra data in show certificate but now the popup no longer shown! i'll update the post as soon as the msg shown again –  Rami.Shareef Aug 31 '11 at 18:56

3 Answers 3

up vote 4 down vote accepted

Check out Dan Kaminsky's blog post on mysterious Facebook certificates. The response from Facebook:

We’re safe. Turns out we just ordered new (smaller) certs from Verisign and deployed them to a few test LBs on Monday night. We’re currently serving a mixture of digicert and verisign certificates. One of our test LBs with the new cert: a.b.c.d:443

But then have a read of @JeffFerland's blog post inspired by this week's discovery of a spoofed google.com certificate.

So it can happen, and unless you are au fait with certs and the trust assumptions, you should check any time you get an odd warning.

share|improve this answer
    
I suspected to be bogus one, but the quoted part from the article put me in an ease, so we are safe! right? :) –  Rami.Shareef Aug 31 '11 at 19:26

started to choose Cancel every time it pop's up, I excpected the page not to load! but nothing happened and the web page continue to load normally?

Some web pages are a combination of secure content (passed through https) and non-secure content (passed through http). Providing secure content is expensive in terms of equipment, network latency, and cache faults. So, many websites use secure channels only for the content that needs protection. When you chose 'Cancel' the non-secure parts of the web site loaded and the secure components did not load. Since the majority of the content is likely not to be considered sensitive, you may not notice much difference.

share|improve this answer
    
nice explanation, so what about the username/Password combination? i guess FB wont validate my account while login if I choose Cancel? –  Rami.Shareef Aug 31 '11 at 19:01
    
I would expect that username and password whould be through a secure channel, so if you click Cancel you should not be able to login. –  this.josh Sep 1 '11 at 5:21

From your screenshots, the certificate looks as a normal, valid certificate, bearing the name "*.opendns.com". However, you may be trying to visit a URL which begins with: "https://0-197.channel.facebook.com/". In that situation, your Web browser is expected to complain, because the name in the URL (0-197.channel.facebook.com) does not match what is found in the certificate.

The browser message is confusing because it says things a bit backwards. At the SSL level, the server is not claiming to be 0-197.channel.facebook.com; that's quite the contrary, indeed: the server is claiming to have a name matching *.opendns.com.

What probably happened is that:

  • Some Facebook-related page points, possibly internally (i.e. you would not see it in the URL bar), to a HTTPS URL with the name 0-197.channel.facebook.com, leading your browser to go visit that URL.
  • For some reason, after DNS resolution and connection and so on, the server sends a certificate with, as name, *.opendns.com. Possibly, some intern at Facebook put the wrong certificate in place. Or some other intern at Facebook misconfigured some DNS server, making the name 0-197.channel.facebook.com point to the wrong IP address, namely the IP address of a server which legitimately goes under a name matching *.opendns.com. Or some intern at your ISP goofed up when configuring a router, leading to the same kind of misdirection. Or possibly the culprit is not an intern but a full-time employee.

In any case, your browser is right in complaining, and by clicking "Continue" you are telling it "shut up, I know what I am doing"; and that's rarely a good idea. To investigate the issue further (if it still happens, which I doubt since this question is from two years ago), the things to do are the following:

  1. See what makes your browser visit that strange-looking URL. This might be worth some investigation.
  2. Inspect the certificate to see all the names in it.
  3. From a cmd.exe window (I assume you use Windows, from your screenshots), type nslookup 0-197.channel.facebook.com to see what IP address this name resolves too.
  4. Do some reverse lookups (e.g. with this tool) to see who owns that IP address (in this case, does it look like something from Facebook ?).
  5. Do not click on "Continue".

99% (at least) of SSL-related browser warnings are the result of an honest-to-God configuration mistake, but the remaining 1% are attacks, which is why you must heed the warning.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.