Fresh downloads of each. Run netstat on both and get an ‘established’ TCP connection (outside vpn) to 55.65.117.34 which a ‘whois’ search says is related to US Air Force, USAISC (United States Army Intelligence and Security Command) (and google). See pics. [netstat_kali_unknown_connection] [Kal…

Seems like firefox-esr is connected to 55.65.117.34.bc.googleusercontent.com when you launch it That sucks… how can I disable this in firefox ??? Edit: seems like my answer is somewhere in here

[image] fralb5: Seems like firefox-esr is connected to 55.65.117.34.bc.googleusercontent.com when you launch it There is also a mozilla domain pointing to that IP address (34.117.65.55): $ host 55.65.117.34.bc.googleusercontent.com 55.65.117.34.bc.googleusercontent.com has address 34.117.65.…

Thanks @Skalman and @fralb5 . Yes I noticed the IP came out in reverse in the whois lookups but I don’t know why. If you use google maps and go to the physical address given is shows a Google data center. Running: sudo ss -tp gives this output: State Recv-Q Send-Q Local Address:Por…

@code9n in my opinion there is no better tool than OpenSnitch to control which program is allowed to talk to which IP address. AFAIK you should be able to install it on almost every Linux system. I use it on all my devices to keep the programs in check, and keep certain connections i don’t want fo…

Thanks, @Manuel , I’ll look it up . . .

If you happen to have the Librem 5, there is a guide by @Kyle_Rankin for how to use OpenSnitch on it. [image] Snitching on Phones That Snitch On You – Purism Purism makes premium phones, laptops, mini PCs and servers running free software on PureOS. Purism products respect people's priv…

That googevil connection must be related to Safe Browsing (or rather, “safe” browsing /s): Security/Safe Browsing - MozillaWiki Do you have “Block dangerous and deceptive content” enabled in FF settings? For shock value, go to about:config and type in “google.” By the way, have you removed Google…

That “Block dangerous and deceptive content” was enabled but tuning it off doesn’t make a lot of difference. With it off: ss -tp shows the menacing IP address as 34.117.65.55 and netstat shows it as 65.55.117.34 How that putting the IP address in reverse order is a thing I don’t understand, not …

Totally removed Google from the search engine settings but using FF still connects to that 55.65.117.34 (and / or it’s reverse depending on which command you use to check). Thanks for the ideas, @amarok .

[image] code9n: How that putting the IP address in reverse order is a thing I don’t understand, not how IPv4 works that I ever heard. Read up on “reverse dns” it’s a thing that’s been around a long time.

That’s not reverse DNS that I know of, DNS is where you have a domain name and look up the IPv4 address. Reverse DNS is where you have the IP address and want the domain name. Isn’t it? All the docs I can find say it is . . . Reverse DNS lookup In computer networks, a reverse DNS lo…

Backdoor in FireFox in Kali and Parrot OSes (and others)

Software

FranklyFlawless October 15, 2023, 2:06pm 9

If you happen to have the Librem 5, there is a guide by @Kyle_Rankin for how to use OpenSnitch on it.

More Proof Firefox is Bad