3

On a home LAN I encountered this error both in Linux Firefox (an ubuntu vmware VM on Win7) and from my Android phone browser from a shopping website during the checkout process a few days ago. Could this indicate some sort of MITM compromise (eg in the LAN router)? DNS compromise? Could this also be from one of the content delivery network (CDN) machines serving the paypal content being incorrectly configured or being compromised?

This Connection is Untrusted

You have asked Firefox to connect securely to www.paypal.com, but we can't confirm that your connection is secure.
Normally, when you try to connect securely, sites will present trusted identification to prove that you are going to the right place. However, this site's identity can't be verified.

What Should I Do?
If you usually connect to this site without problems, this error could mean that someone is trying to impersonate the site, and you shouldn't continue.
This site uses HTTP Strict Transport Security (HSTS) to specify that Firefox only connect to it securely. As a result, it is not possible to add an exception for this certificate.

www.paypal.com uses an invalid security certificate.

The certificate is only valid for the following names:
google.com, *.2mdn.net, *.android.com, *.appengine.google.com (many more names...)

Running nslookup on the linux machine

@1pm

nslookup www.paypal.com
Server: 127.0.1.1
Address: 127.0.1.1#53

Non-authoritative answer:
Name: www.paypal.com
Address: 216.58.217.194

Then @1:45

nslookup www.paypal.com
Server: 127.0.1.1
Address: 127.0.1.1#53

Non-authoritative answer:
www.paypal.com canonical name = www.paypal.com.akadns.net.
www.paypal.com.akadns.net canonical name = ppdirect.paypal.com.akadns.net.
ppdirect.paypal.com.akadns.net canonical name = wlb.paypal.com.akadns.net.
wlb.paypal.com.akadns.net canonical name = www.paypal.com.edgekey.net.
www.paypal.com.edgekey.net canonical name = e3694.a.akamaiedge.net.
Name: e3694.a.akamaiedge.net
Address: 184.86.122.156

What would be a remediation plan? Replace the home LAN router? Would all the devices on the home LAN also be suspect?

  • Can you share the URL of the site? – user79331 Oct 15 '15 at 7:17
  • 1
    Can you please post the issuer of the SSL certificate? Many AV programs install their own SSL certificate as a CA root certificate (and therefore acting as a MITM), in order to be able to inspect all HTTPS traffic. However, what puzzles me is that you have this issue in multiple devices (and one of them is a Linux laptop with presumably no AV installed) so the MITM must take place in your router. – dr01 Oct 15 '15 at 7:50
  • 1
    Actually, it would be interesting to see the whole certificate here: the list of domain this cert is valid for is weird – Stephane Oct 15 '15 at 7:53
  • The invalid certificate error above was for paypal.com which my browser was redirected to for payment/checkout from drugstore.com (I did not make the payment). – John J Oct 15 '15 at 9:24
  • @Stephane: More names in the 'The certificate is only valid for the following names:' list *.au.doubleclick.net, *.cc-dt.com, *.cloud.google.com, *.de.doubleclick.net, *.doubleclick.com, *.doubleclick.net, *.fls.doubleclick.net, *.fr.doubleclick.net, *.google-analytics.com, *.google.ac, *.google.ad, *.google.ae, *.google.af, *.google.ag, *.google.al, ... oogle.ws, googlecommerce.com, gstatic.com, urchin.com, youtu.be, youtube.com, youtubeeducation.com – John J Oct 15 '15 at 9:30
3

This is a really bad one. Someone delivered this fake certificate to you in the intend of being able to decrypting your HTTPS connection. As it's paypal.com it's very likely that the attacker wants to capture your credentials. This can result in looting your bank account so you better don't trust this connection.

Its hard to say in which step of the connection the MITM attack was performed or if it anyway was a MITM. It could also be maleware that installed a proxy on your host that replaces the real certificates with faked ones.

MITM Attacks can be performed in the LAN easily but can also be based on the manipulation of your or your ISPs router.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.