1

Sometimes, we will experience a brief "hiccup" in our AT&T UVerse internet service. When this happens, and a user happens to be surfing the web at the same time, we will suddenly be presented with this:

SSL Certificate

This will actually come from the website that the user is on, such as Gmail, or any other HTTPS website. When I click "View Certificate:"

attlocal.net Gateway Authentication cert

attlocal.net Gateway Authentication cert

Can someone explain to me what is going on here? Is there any explanation for this behavior that isn't nefarious? I mean... I'm often reminded of the quote that one should not attribute to malice what can be written off as incompetence, but... doesn't this look really sketchy? Could I be exposing otherwise encrypted data to AT&T because of this?

  • Well, what certificate is being used when this doesn't occur? Who signs Google, Facebook, etc. when you browse there normally? Whats the cert path? – Steve Jun 13 '15 at 0:44
  • During normal operation, the cert path to Gmail, just as an example, is exactly what you'd expect it to be... like GeoTrust Global CA -> Google Internet Authority G2 -> mail.google.com. But then the AT&T Uverse router glitches and my browser gets presented with a new certificate. – Ryan Ries Jun 13 '15 at 0:47
1

The rg is trying to get you to look at a different page by hijacking the one you were headed to. Similar to the way some WiFi gateways will force a redirect to an auth page by hijaçkong the first thing you try to access on 80 or 443. Att does this fptr different reasons, like when they were pushing bittorrent users to pages trying to promote paid video and music services.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.