Recently, the facebook page changed on my computer (on others from the same router, I get the regular page). I checked the ssl certificate, and it seems to be authentic, however, as the page does not look professionally designed, I am worried it is a man in the middle attack. How to be sure if it is legitimate or not ?

facebook login

Certificate information : enter image description here

  • are you sure you type the right url? – Vipul Nair Sep 2 at 17:11
  • While you post the issuer of the certificates, here there is a link where you can read other information: thesslstore.com/blog/… – Ferdinando Sep 2 at 17:22
  • The url is correct, for the issuer see edit – user3147619 Sep 2 at 17:24
  • 2
    Why do you think it looks incorrect? What were you expecting? – schroeder Sep 2 at 18:00
  • @schroeder, you can visit facebook and see for yourself. 1. This is not the normal facebook look. 2. No report of the new look on the internet. 3. no one of my facebook friends has this look. 4. When I check on other computers (same router), I get another look, which is the regular one. 5. sub-pages have the regular look, only the home page has this different look – user3147619 Sep 2 at 18:38

Unless you have installed any certificates in your operating system or browser trust store, you can be fairly confident that any page using HTTPS is not the result of a MITM attack. In your particular case, it sounds more like a CSS resource failed to load, resulting in the corrupted layout you briefly observed.

An attacker who is sophisticated enough to perform a MITM attack against a TLS connection without getting you to trust their certificate manually is likely going to also be sophisticated enough to correctly copy a web page design so that it is completely indistinguishable from the original, legitimate layout.

You should verify that:

  1. You have not installed any certificates that you don't trust.

  2. The domain you are visiting to really is the domain you want to visit.

  3. Your browser and operating system are up-to-date.

  • Well, it depends on the attacker motivation. Sophisticated or not, if its motivation is to inform me that he can attack me or that to know that indeed I am the owner of the pc he targeted. I also was thinking it was a CSS loading problem, however, the the different look remained even after an F5 reload, and after rebooting the os, the browser and router. Anyway, now the page is back to its regular look again, hope it was just a glitch in the matrix :) – user3147619 Sep 3 at 4:34
  • @user3147619 No one is going to inform you that they can attack you, especially not by changing the layout of a web page. If it remained even after reload, then it could have been a caching issue. – forest Sep 3 at 5:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.