sharing a user experience

[gustavo-iniguez-goya]

Some weeks ago, while hanging around on the internet, a new opensnitch dialog popped up. I don't have a set of permanent rules, most of them are temporary, so it looked normal to see yet another connection dialog, but something caught my attention. The port was 89, and I was testing a regex for destination ports like "(53|80|443)", so some web was connecting to the port 89? At least it seemed strange to me.

I ignored it for some days, until I got bored of it and decided to investigate what was creating it, because it was starting to be very annoying and repetitive. As it was being created from chromium, and after discard all the possible pages/tabs, I grepped the extensions for the urls (ext.*.extenbalanc.org) and I realized that the extension Video Downloader Plus was the culprit.

The extension sends a lot of data to remote servers, not only every page you visit along with your IP, country, user-agent, etc, as you can see in the video (note: null fields in the video are because the dns server points to a pi-hole docker, otherwise it would reveal the real data).

This is not new news, others analyzed this and other extensions and concluded that they were ad/spyware at best: https://adguard.com/en/blog/unimania-spyware-campaign.html

In summary, glad that opensnitch caught it, I thought I had to share it :)

[Ph0rk0z]

This is why I've been searching for a real firewall on linux since forever. Eset does the same thing for me on windows. It is surprising what connects.

[gustavo-iniguez-goya]

I've read a post about websockets that is worth mentioning here:
https://nullsweep.com/why-is-this-website-port-scanning-me/

When I added support for intercepting connections to localhost I didn't think in that scenario, but the truth is that some pages are abusing websockets.

[Pain-Patate]

This is why I've been searching for a real firewall on linux since forever. Eset does the same thing for me on windows. It is surprising what connects.

I'm agree with you

Some weeks ago
,...
In summary, glad that opensnitch caught it, I thought I had to share it :)

Great to your share. I'm a fucking noob in ports, firewall, but I hope to help you, on Openitch

[gustavo-iniguez-goya]

created a new wiki page where I'll add others examples like this one. You're wellcome to share other experiences if you find something suspicious, curious or interesting.