25

My Chrome browser keeps prompting me for Facebook authentication, even though I have never logged on to Facebook from my PC.

I am using Chrome browser from my company where they have a strong proxy to avoid social networking sites. Though, I never even tried to open Facebook or any application/site related to FB. But I am constantly getting this pop up when ever I open any site. Is that a security threat?

enter image description here

Edit

I am sorry but I don't have any knowledge about proxy server configuration. However, I can tel you about configuration of proxy account:

enter image description here

Well there are two scenarios, by default Automatically detect setting is enabled which doesn't allow us to access anything other than intranet site. However, when I am connected to VPN then I am able to use another proxy which allow me to access Google & other technical sites. (I can access Gmail, SO, Blogs but not Facebook)

  • 13
    And only http? Big red flag for me – Canadian Luke May 5 '16 at 14:11
  • 18
    @S.L.Barth: connect.facebook.net is the facebook SDK used in the like buttons, see developers.facebook.com/docs/plugins/like-button. – Steffen Ullrich May 5 '16 at 14:12
  • 1
    Please add information about your network configuration. The main question is if you have setup the company proxy explicitly in your browser or if you use it as a transparent proxy (i.e. no special setup in the browser). Apart from that it would be useful to know if there is any company internal documentation on how you should actually setup the browser in their network and if you've followed this documentation. – Steffen Ullrich May 5 '16 at 15:41
  • 1
    @S.L.Barth : whois facebook.net : Registrant Organization: Facebook, Inc. 1601 Willow Road, Menlo Park CA. So it is Facebook's URL – rkosegi May 5 '16 at 16:08
  • 1
    As @Steffen said, it's impossible to determine whether it's transparent or explicit proxy. Either ways, and as a security administrator, I recommend to check it with your network admins, and remember, there is no login Facebook pop up like that, so be more careful! – Emadeddin May 6 '16 at 17:23
36

TL;TR: it is probably a BlueCoat ProxySG or similar proxy which can be configured to behave that way. Nothing to worry about.

Details:

What you see is a dialog for HTTP basic access authentication. This is not what Facebook uses for authentication. This means that this dialog is not from Facebook itself.

My guess is that facebook.com is filtered by your "strong proxy to avoid social networking sites" but that access to this site is allowed for some authorized users. Thus what you see here is the authentication requested by the proxy you use. Usually proxy authentication is different from site authentication and it would show you that the proxy and not facebook requires authentication. But some software/appliances can be configured to issue a site authentication when used as a transparent proxy, i.e. when not being explicitly configured as proxy inside the browser.

One such proxy software is BlueCoat ProxySG. From their documentation it can be seen that it will return a site authentication (code 401) instead of proxy authentication (code 407) when used as transparent proxy:

The ProxySG appliance issues an OCS-style challenge (HTTP 401) for the first connection request from an unauthenticated client.

This leaves the question why you get this authentication request everywhere. My guess is that you don't get the dialog everywhere but on all sites which embed the Facebook Like button, which is almost everywhere. The site connect.facebook.net you see in the dialog is the Facebook SDK for the Like button.

  • 1
    One way to get rid of the facebook buttons (and thus the dialog) is using an adblocker with an appropriate filter list. (For example ublock origin list a few "Social" blocklists) – CodesInChaos May 6 '16 at 13:50
37

This is a proxy authentication pop up! And it's most likely a proxy related attack.

When you connect to the Internet through a proxy, you'll be asked to enter username and password if the proxy requires an authentication.

For example:

auth dialog

Note that the whole text The server http:// ... The server says is editable, and you can change it in the proxy server settings.

Steps of fake proxy attack:

  • Setting up a proxy with basic authentication 'no hashing on client side'
  • Performing DNS poisoning, so every request will be redirected to the proxy machine
  • ARP spoofing, so the attacker can take 'the DNS' place

After applying the attack, the following scenario happens when you open any site:

  1. HTTP request for your site, assume it's: http://www.foo.com
  2. The request will go to the fake proxy machine, so the proxy will reply with 407 authentication required no matter what your request is. And send back the server message with the reply.
  3. A pop up will show, displaying the server message.
  4. So, if you enter your info, it will go to the fake proxy, then you might be redirected to the Internet.

So, check the DNS response you're getting for any website using Wireshark. It's probably from a suspicious address, the one that achieving DNS spoofing on your network.

  • 17
    You didn't get what I meant, the pop up is for access authentication regardless of the requested page. It has nothing to do with Facebook. the attacker is using the phrase connect.facebook.net like it's kind of Social Engineering method. As I said, check it using Wireshark, and be sure to see the 407 auth required message, it should be right after your http request. – Emadeddin May 5 '16 at 15:16
  • 1
    What I'm saying is that there is no attacker and no other kind of malicious activity. It is just the "strong proxy to avoid social networking sites" they have installed in the company network which is working as intended, i.e. restricting access to social networks. – Steffen Ullrich May 5 '16 at 15:33
  • 1
    @nocomprende: In my opinion it is simply a misconfiguration of the client which then causes these unexpected authentication requests. This means it is not an attack which also explains why there is no attacker. If this would really be an attack it must be a dumb attacker which cannot even give a proper looking facebook login page to better fool its victim. Unfortunately the OP is silent about how its browser is configured in regard to the company proxy. – Steffen Ullrich May 5 '16 at 20:07
  • 1
    @nocomprende: its probably futile to argue since you seem to be convinced that it must be an attack and will interpret every argument in this direction. It is true that this behavior can be caused by an attack but it is also true that it can be caused by a misconfiguration of the proxy in the browser. And I find misconfiguration more likely. But without getting more information from the OP the question can not be ultimately answered. – Steffen Ullrich May 5 '16 at 20:30
  • 2
    A misconfiguration issue will not display http://connect.facebook.net before you even request a website. – Emadeddin May 6 '16 at 6:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.