2

I've been monitoring my network traffic with Little Snitch, and today, when launching Chrome, just the default Chrome tab (shows most frequent sites), it alerted me Chrome was trying to connect over SSL to the domain

goldenticket.disconnect.me

According to whois lookup, this domain is registered to a "dedicated server" that is also an Amazon AWS instance (goldenticket-658146952.us-east-1.elb.amazonaws.com). The entry indicates its IP address is in Ashburn, VA, right outside of D.C.

Pointing a browser at disconnect.me brings up some company site about browsing security, with a product called Disconnect that I have never heard of or installed on my machine.

What else can I determine about this traffic? I can't account for it, and I've run Chrome several sessions with LS3 without seeing this before.

  • It looks like its a browser plugin. Did it somehow get installed/enabled on Chrome? I suppose you could always Fiddler the connection if you wanted to see what was going on underneath the SSL. I doubt you'd see much, but you'd see any requests that are made. – RoraΖ Jul 31 '14 at 17:50
  • 1
    So Fiddler is an HTTP proxy that can also act as an SSL proxy. You trust their certificate and they act as a MitM for your connection. This will make any SSL connection you create completely insecure until you remove the certificate from your trusted store. It allows application designers to test their code underneath the SSL, or just for people to test out what is actually being passed to server's during authentication. telerik.com/fiddler – RoraΖ Aug 1 '14 at 13:22
  • 1
    I guess here's not the place, but I'm still unclear how this is possible. Fiddler is tricking the application into using it's cert, basically? Why would it not then use the correct cert to make the actual connection, so as to not make things insecure when testing? – Jason Boyd Aug 1 '14 at 13:25
  • 1
    It's not tricking anything. You download the client. You install their certificate into your trusted store. It's called something like _DO_NOT_TRUST_Fiddler. You have to do some configuring, but then your HTTP/HTTPS connections will go through Fiddler's server's. They do a legit secure connection with your target and then send it back to you. You'll have the private key for their certificate, so through configuration you can have the client (which is collecting traffic) decrypt the sessions for you. – RoraΖ Aug 1 '14 at 13:30
  • 1
2

To answer your question:goldenticket.disconnect.me

You probably have adblock add-on installed in your chrome brower

  • That's very not nefarious. Thx. – Jason Boyd Aug 2 '14 at 8:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.