3

So I received a non-filtered email earlier today supposedly from Itunes under my email address with an invoice for Netflix subscription. Some of the links were genuine, but ultimately I clicked on a bogus link before it clicked that it was spam.

My browser picked up on the dodgy site and warned me it was unsafe at which point I realised and exited the website. However, I'm unsure if any damage could be done by this point? I did not actually see the webpage and obviously did not enter any details.

I was working on a programming assignment for university at the time which I saved as a .asl file. I saved it and restarted my computer. However, now I've gone to open the file again, I've found my code gone and instead there is a list of urls, most of which I recognie as ones I've visited.

They are in the format...

url.com:HSTS 15 16234 1482854842001,1,0 www.url2.com:HSTS 1 16236 1438483201934,1,1 .......

The numbers I've given are mostly randomised but of the same/similar length as the ones in the file. The last two digits are all 1s or 0s.

Does anyone have any idea what this could be? Should I be worried? Maybe it's a result of something else?

3

The provided data looks like the SiteSecurityServiceState.txt file from Firefox.

It saves (next to other security related information) the HSTS-enabled domains and the data needed to implement HSTS on the client site.

This might be of interest (to know the sites you visit that do use HSTS and when the browser does allow a downgrade attack again due to expired HSTS headers) if you are to be targeted with such an attack.

Yet, this does not explain how this might ended up there.

If the site was able to bypass your browser and use a drive by attack that extracted those information and wrote to any recently saved file, you might have bigger problems (think: bot net, ransom ware,...) to worry than your HSTS-information leaked.

Make sure you didn't accidentally copy & paste that data there (or instructed a program to do so). If you didn't, you'd may have to nuke from orbit to be sure nothing is left on your machine.

  • I definitely couldn't have copied and pasted it as I didn't have that file open and had never seen it before, and it definitely wasn't like that when I saved it. I did however switch the computer off by holding down the standby button (since it was taking too long to shut down the programs individually. This was only after I saved it though) – Wolff Mar 19 '16 at 3:10
  • Well, depending on your operating system and file system, this might explain it. It could be possible (if improbable) that the sudden shutdown messed up the file system. – Tobi Nary Mar 19 '16 at 9:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.