2

I'm using Windows 7 and Firefox 22, connecting through a regular residential wifi router.

In the last month, I've noticed that when I connect to the internet once in a while my firewall indicates that lsass wants to connect to different IPs. example:

C:\WINDOWS\SYSTEM32\LSASS.EXE
Local Security Authority Process
Remote IP: 72.21.91.29
Remote Port: 80

I'm not sure if the following is related but since the same time ago, when I connect to the internet, svhost tries to connect to port 80 to multiple certificate website like DigiCert etc.

After trying to search on Google I couldn't find a reason why is connecting to any IP and if that could be something to worry about and investigate a bit more. I haven't found anything about the second situation for this same context (pc, I am not using remote desktop neither I have the functionality enabled, it happens or just after connecting or surfing the web, this is a NEW behavior. I have two wifi to connect. One is shared with 2 more persons but none of the pcs are sharing or in a family group, the other wifi is used only by me and still, the same firewall messages show up). My first guess is that a Windows update for increased security for ipv6 (compared to the one I had) was installed?

Is this clear indication of a spyware or trojan horse or is just the usual behavior of these processes?

2

1 Answer 1

3

This is a normal part of certificate validation or revocation list update using the OCSP protocol. Enjoy reading: https://technet.microsoft.com/en-us/library/ee619730(v=ws.10).aspx https://en.m.wikipedia.org/wiki/Online_Certificate_Status_Protocol

1
  • 1
    Do you mean OCSP, Online Certificate Status Protocol? OSCP, Offensive Security Certified Professional is something else. ;) Aug 13, 2017 at 3:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .