31 ms·

> happened at least three times over the span of around two years Well, it's certainly difficult to speculate as to the causes of these past events. I can thin

> happened at least three times over the span of around two years Well, it's certainly difficult to speculate as to the causes of these past events. I can think of a slew of reasons you may have had the experiences you mention; ssl stripping being just one of them. So, without being able to reliably reproduce the problem, I'm afraid your only recourse will be to stay vigilant and... have investigation tools ready (e.g. wireshark) for the next time it happens.

Ms-J 3y ago
SSL stripping would cause the sites to not display an encrypted connection, definitely. But what really puzzles me is the redirection. I'm thinking it has to do with the routes being tampered with. Yes, I'll need to check more with WS.
- reliefcrew 3y ago
  > what really puzzles me is the redirection. I'm thinking it has to do with the routes There are many possibilities. I'd, personally, refrain from using the words "tampered" and "attacks" since they carry a moral implication. It also seems it could be that a name based virtual host configuration changed mid session. I suppose this could be considered routing in a sense as well. Again, the fact that it hasn't happened often and that your memory/knowledge of the exact transaction of packets is likely incomplete, makes all this just speculation. My guess is it's probably just a glitch and nothing nefarious is going on. I wouldn't be too worried. It's good you're keeping an eye on things though!
  - Ms-J 3y ago
    Thanks for the suggestions. The reason I use such strong words is because the type of redirects are very specific as what I'm working on using those boxes has nothing to do with the type of sites that were pushed to me. The sites that I was loading were usually large, microsoft.com for one example but was redirected to something that has nothing to do with technology. I understand it's "speculation" since I don't know the exact mechanism or have proof as to what happened, but it's very far from a glitch. Again, this happened a few times on multiple different physical computers and didn't set off any alerts in my security systems.

Ms-J 3y ago

SSL stripping would cause the sites to not display an encrypted connection, definitely. But what really puzzles me is the redirection. I'm thinking it has to do with the routes being tampered with. Yes, I'll need to check more with WS.

reliefcrew 3y ago
> what really puzzles me is the redirection. I'm thinking it has to do with the routes There are many possibilities. I'd, personally, refrain from using the words "tampered" and "attacks" since they carry a moral implication. It also seems it could be that a name based virtual host configuration changed mid session. I suppose this could be considered routing in a sense as well. Again, the fact that it hasn't happened often and that your memory/knowledge of the exact transaction of packets is likely incomplete, makes all this just speculation. My guess is it's probably just a glitch and nothing nefarious is going on. I wouldn't be too worried. It's good you're keeping an eye on things though!
- Ms-J 3y ago
  Thanks for the suggestions. The reason I use such strong words is because the type of redirects are very specific as what I'm working on using those boxes has nothing to do with the type of sites that were pushed to me. The sites that I was loading were usually large, microsoft.com for one example but was redirected to something that has nothing to do with technology. I understand it's "speculation" since I don't know the exact mechanism or have proof as to what happened, but it's very far from a glitch. Again, this happened a few times on multiple different physical computers and didn't set off any alerts in my security systems.