2

I've been monitoring my network traffic with Little Snitch, and today, when launching Chrome, just the default Chrome tab (shows most frequent sites), it alerted me Chrome was trying to connect over SSL to the domain

goldenticket.disconnect.me

According to whois lookup, this domain is registered to a "dedicated server" that is also an Amazon AWS instance (goldenticket-658146952.us-east-1.elb.amazonaws.com). The entry indicates its IP address is in Ashburn, VA, right outside of D.C.

Pointing a browser at disconnect.me brings up some company site about browsing security, with a product called Disconnect that I have never heard of or installed on my machine.

What else can I determine about this traffic? I can't account for it, and I've run Chrome several sessions with LS3 without seeing this before.

Improve this question
7
  • It looks like its a browser plugin. Did it somehow get installed/enabled on Chrome? I suppose you could always Fiddler the connection if you wanted to see what was going on underneath the SSL. I doubt you'd see much, but you'd see any requests that are made.
    – RoraΖ
    Commented Jul 31, 2014 at 17:50
  • 1
    So Fiddler is an HTTP proxy that can also act as an SSL proxy. You trust their certificate and they act as a MitM for your connection. This will make any SSL connection you create completely insecure until you remove the certificate from your trusted store. It allows application designers to test their code underneath the SSL, or just for people to test out what is actually being passed to server's during authentication. telerik.com/fiddler
    – RoraΖ
    Commented Aug 1, 2014 at 13:22
  • 1
    I guess here's not the place, but I'm still unclear how this is possible. Fiddler is tricking the application into using it's cert, basically? Why would it not then use the correct cert to make the actual connection, so as to not make things insecure when testing?
    – Jason Boyd
    Commented Aug 1, 2014 at 13:25
  • 1
    It's not tricking anything. You download the client. You install their certificate into your trusted store. It's called something like _DO_NOT_TRUST_Fiddler. You have to do some configuring, but then your HTTP/HTTPS connections will go through Fiddler's server's. They do a legit secure connection with your target and then send it back to you. You'll have the private key for their certificate, so through configuration you can have the client (which is collecting traffic) decrypt the sessions for you.
    – RoraΖ
    Commented Aug 1, 2014 at 13:30
  • 1
    Installing Fiddler: docs.telerik.com/fiddler/configure-fiddler/tasks/installfiddler Configuring Fiddler: docs.telerik.com/fiddler/configure-fiddler/tasks/… HTTPS decryption Setup: docs.telerik.com/fiddler/configure-fiddler/tasks/DecryptHTTPS
    – RoraΖ
    Commented Aug 1, 2014 at 13:32

1 Answer 1

Reset to default
2

To answer your question:goldenticket.disconnect.me

You probably have adblock add-on installed in your chrome brower

Improve this answer
1
  • That's very not nefarious. Thx.
    – Jason Boyd
    Commented Aug 2, 2014 at 8:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .