10

While running Wireshark trying to troubleshoot some other issues, I noticed several SYN connections to ports 80 and 443 on the workstation I was using. The packets were dropped. These were coming from other workstations. There is no webserver running on this workstation, and its IP address has been the same for weeks.

Running process monitor on one of the source workstations, I found Firefox is the source of the packets.

Anyone know why Firefox would be attempting to connect to another local workstation, not a server? The workstation is running Firefox 39.0.

Edit 08/12/15: I stuck apache (via xampp) on the "victim" computer and found the very common log entry "/connect/xd_arbiter/7tUlZKGPU61.js?version=41 HTTP/1.1" 404 1354 "(some webpage)" "(useragent)". Google tells me this is something to do with Facebook, but nothing really beyond that. Does anyone know more?

  • 5
    WebRTC mapping? – Deer Hunter Aug 3 '15 at 18:40
  • 1
    What tabs were open on the Firefox running on the other computers? What extensions installed? – armani Aug 3 '15 at 22:04
  • Is your workstation within a private IP scheme like 192.168.0.0/16 which is commonly used? Does the network interface you were listening have an address within the IP scheme 169.254.0.0/16? – dan Aug 12 '15 at 17:58
  • What is the value of the host header in those requests? – Z.T. Aug 12 '15 at 18:57
4

There are several possibilities here:

  • A tab in Firefox has a website that keeps connecting and refreshing an internal IP address. That might be a home NAS appliance that by coincidence has the same IP with your computer

  • A Javascript script from a legitimate website attempts to scan the internal network using Cross Origin Requests or WebSockets. This website can do that. Note that the latest WebRTC feature can get the local IP address of a computer even it is non routable and behind a NAT.

  • Maybe a special or malicious extension or plugin is doing the traffic. Start Firefox in safe mode and see if the behaviour is the same.

  • There could be malware or an attacker on that computer that injected itself in the Firefox process to escape firewall egress restrictions (like the Windows firewall). Similarly, that instance of Firefox could have been the victim of an exploit that remained in the Firefox process.

You can open Firefox's network monitor and see which website is making HTTP requests to internal IPs.

You can also use Process Explorer to look at the Firefox process and look for strange things, like strange loaded DLLs and TCP/IP connections.

  • 1
    I did use the stack trace from procmon and couldn't find anything that looked suspicious. Malware: There are at least 3 computers doing it, so I'm willing to discount that, for now. I'll look at plugins on all three and try the network monitor. – user2891127 Aug 4 '15 at 18:52
  • 1
    No luck using your techniques, and I have identified several more workstations all hitting this one system. I put xampp on the system (just apache), and from the access logs (and a google search later), it seems to have something to do with Facebook. I've edited my original question with the new info. – user2891127 Aug 12 '15 at 17:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.