Why Is NoSCRIPT Connecting to Third Party IPs upon Startup?

Ask for help about NoScript, no registration needed to post
Csky
Posts: 6
Joined: Sat May 09, 2015 2:50 am

Why Is NoSCRIPT Connecting to Third Party IPs upon Startup?

Post by Csky »

I was watching my firewall's active connections list and noticed something peculiar. Even though I had a blank tab loaded in Firefox, firefox was still connecting to several IPs. So I started firefox in Safemode and discovered in Safemode it did not connect. So I disabled all the plugins and started enabling them one at a time. It turns out that only two addons were phoning home to various IPs and announcing my online presence and NoScript was the worst offender. Here is an example list of IPs NoScript connects to when simply firefox starts up and the truncated results of WHOIS searches on them.

-178.255.83.1 RIPE Network Coordination Centre (RIPE)
-69.195.158.195 Joe's Datacenter, LLC Kansas City
-173.239.79.210 Unwired Network Operations Center
-23.77.237.50 AKAMAI

What's going on here NoScript? Are you duping us all and it turns out you've been spyware all along? What is Joe's Datacenter?

I've used NoScript for years now and reaped the perceived benefits but has it been spyware all along? Just asking, not accusing. What is going on here? Not pleased.
Last edited by Csky on Wed Nov 04, 2015 6:44 pm, edited 2 times in total.
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101 Firefox/26.0 IceDragon/26.0.0.2
barbaz
Senior Member
Posts: 10841
Joined: Sat Aug 03, 2013 5:45 pm

Re: Why Is NoSCRIPT Connecting to Third Party IPs upon Start

Post by barbaz »

That's Giorgio's own site and the associated OCSP server, contacted for obtaining your own WAN IP for the NoScript Options > ABE > WAN IP in LOCAL setting and validating the SSL certificate, respectively.

Not "spyware".
*Always* check the changelogs BEFORE updating that important software!
-
Guest

Re: Why Is NoSCRIPT Connecting to Third Party IPs upon Start

Post by Guest »

barbaz wrote:That's Giorgio's own site and the associated OCSP server,Not "spyware".
Right, that's what "phoning home means" and it is announcing each and every user's online presence as soon as they load up firefox. So what about the other three ips?
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0
barbaz
Senior Member
Posts: 10841
Joined: Sat Aug 03, 2013 5:45 pm

Re: Why Is NoSCRIPT Connecting to Third Party IPs upon Start

Post by barbaz »

Guest wrote:Right, that's what "phoning home means" and it is announcing each and every user's online presence as soon as they load up firefox.
Does it matter in this case?
http://www.informaction.com/index.php?page=privacy
Guest wrote:So what about the other three ips?
Well, not sure. I'll restart my browser with all blank tabs in just a moment and see what IP's it connects to on startup...
I forgot that NoScript also contacts your own WAN IP :oops: , for fingerprinting so that it can protect it better. So one of them is just your own IP.

Some of them your DNS perhaps?

The OP said that some of the connections on startup are caused by another extension.. can you list the IP's you see, if different? Which of the IP's in the OP (if any) are NOT contacted if NoScript is disabled?

Oh and if this is a bigger deal to you than having your WAN IP protected, what happens if you set about:config > noscript.ABE.wanIpCheckURL to an empty string and disable WAN IP in LOCAL from NoScript Options > Advanced > ABE?



EDIT OK let me make this clearer.
-178.255.83.1 RIPE Network Coordination Centre (RIPE) = Comodo's OCSP server
-69.195.158.195 (I got 69.195.158.198 instead, but according to my DNS, same thing) Joe's Datacenter, LLC Kansas City = Giorgio's site, WAN IP check https://secure.informaction.com/ipecho/

My NoScript only connects to those two plus my WAN IP... so that's three connections, not five.
Again, are you SURE that these connections you mention are ALL NoScript?


EDIT2 Try a reverse DNS lookup on all those IP's. That is sometimes more informative than a WHOIS lookup.

EDIT3 @Csky: You might want to go to NoScript Options > Advanced > ABE, note the WAN IP displayed, and obscure that one in your post. That might make it easier to track down the two "rogue" connections.
*Always* check the changelogs BEFORE updating that important software!
-
User avatar
therube
Ambassador
Posts: 7924
Joined: Thu Mar 19, 2009 4:17 pm
Location: Maryland USA

Re: Why Is NoSCRIPT Connecting to Third Party IPs upon Start

Post by therube »

Disable NoScript, restart FF & see what connects.

(There are all kinds of domains that FF connects to, by default, for all kinds of purposes. Update checks, blocklist update, telemetry data...)
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.19) Gecko/20110420 SeaMonkey/2.0.14 Pinball NoScript FlashGot AdblockPlus
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 SeaMonkey/2.33.1
barbaz
Senior Member
Posts: 10841
Joined: Sat Aug 03, 2013 5:45 pm

Re: Why Is NoSCRIPT Connecting to Third Party IPs upon Start

Post by barbaz »

@Csky: Looked it up - "AT&T Internet Services (SIS-80)" is apparently your own IP, you posted from that one. Feel free to obscure that IP in your post if you want, I'm deliberately going to avoid reposting it so that you can just do that when you want on your own.

173.239.79.210 = observatory6.eff.org
Got HTTPS Everywhere?

I've no idea the Akamai one. Possibly another OCSP server, hosted by Akamai?
*Always* check the changelogs BEFORE updating that important software!
-
Csky
Posts: 6
Joined: Sat May 09, 2015 2:50 am

Re: Why Is NoSCRIPT Connecting to Third Party IPs upon Start

Post by Csky »

barbaz wrote: I've no idea the Akamai one. Possibly another OCSP server, hosted by Akamai?
Yes there was another addon that was connecting and I disabled it and eventually uninstalled it and did not list the IPS it was connecting to, just the ones NS was. It was a download manager to make firefox's new dm look like the old "Toolkit" one.

Akamai seems to be everywhere. To my understanding it a webhosting service that is analogous to a radio repeater intended to speed up internet traffic. I do not like it though. Often NS catches it, sometimes in-order to load a page I have to allow it. But I was surprised when I discovered NS using it.
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0
barbaz
Senior Member
Posts: 10841
Joined: Sat Aug 03, 2013 5:45 pm

Re: Why Is NoSCRIPT Connecting to Third Party IPs upon Start

Post by barbaz »

NoScript does not use Akamai as far as I know and as noted in my above post.
*Always* check the changelogs BEFORE updating that important software!
-
Csky
Posts: 6
Joined: Sat May 09, 2015 2:50 am

Re: Why Is NoSCRIPT Connecting to Third Party IPs upon Start

Post by Csky »

barbaz wrote:NoScript does not use Akamai as far as I know and as noted in my above post.
You said you had no idea which implies that it may or may not. Also getting a google connection now. No connections on startup now but now I am troubleshooting the ones while browsing that have nothing to do with where I am browsing. Also why is my browser version displaying below and how do I prevent that? I'm not a heavy user of forum boards.
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0
barbaz
Senior Member
Posts: 10841
Joined: Sat Aug 03, 2013 5:45 pm

Re: Why Is NoSCRIPT Connecting to Third Party IPs upon Start

Post by barbaz »

Csky wrote:You said you had no idea
I said I had no idea what it was. It doesn't imply that I think it could be NoScript related.
Csky wrote:Also getting a google connection now.
When I've seen that it's related to the browser's google safebrowsing feature
Csky wrote:Also why is my browser version displaying below and how do I prevent that?
It displays below as a diagnostic tool for us and there is no way to prevent display it. (Any site can see that info.)
Sometimes knowing a poster's browser/OS can make it a lot easier to help them.
*Always* check the changelogs BEFORE updating that important software!
-
User avatar
therube
Ambassador
Posts: 7924
Joined: Thu Mar 19, 2009 4:17 pm
Location: Maryland USA

Re: Why Is NoSCRIPT Connecting to Third Party IPs upon Start

Post by therube »

Disable NoScript, restart FF & see what connects.

(There are all kinds of domains that FF connects to, by default, for all kinds of purposes. Update checks, blocklist update, telemetry data...)
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.19) Gecko/20110420 SeaMonkey/2.0.14 Pinball NoScript FlashGot AdblockPlus
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0 SeaMonkey/2.33.1
Csky
Posts: 6
Joined: Sat May 09, 2015 2:50 am

Re: Why Is NoSCRIPT Connecting to Third Party IPs upon Start

Post by Csky »

therube wrote: Disable NoScript, restart FF & see what connects.

(There are all kinds of domains that FF connects to, by default, for all kinds of purposes. Update checks, blocklist update, telemetry data...)
Thanks rube I already saw that. Please read the original post. It's how I discovered some of these connections were being made from NS and it does not answer my specific inquiry.
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0
Csky
Posts: 6
Joined: Sat May 09, 2015 2:50 am

Re: Why Is NoSCRIPT Connecting to Third Party IPs upon Start

Post by Csky »

barbaz wrote: I said I had no idea what it was. It doesn't imply that I think it could be NoScript related.
Well if you don't know then it could be. I'm just saying that is what is understood when you say you have no idea, that you do not know. In other words, you're now saying you do have an idea that it is at least not NS related. Ok I'm not here to give lessons in semantics, that's enough.
When I've seen that it's related to the browser's google safebrowsing feature
Do you know which one? Block reported attack sites or block forgeries? Probably both?
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0
barbaz
Senior Member
Posts: 10841
Joined: Sat Aug 03, 2013 5:45 pm

Re: Why Is NoSCRIPT Connecting to Third Party IPs upon Start

Post by barbaz »

Csky wrote:Do you know which one? Block reported attack sites or block forgeries?
It's both of those (they're two separate databases).
*Always* check the changelogs BEFORE updating that important software!
-
User avatar
Thrawn
Master Bug Buster
Posts: 3106
Joined: Mon Jan 16, 2012 3:46 am
Location: Australia
Contact:

Re: Why Is NoSCRIPT Connecting to Third Party IPs upon Start

Post by Thrawn »

Csky wrote:
barbaz wrote: I said I had no idea what it was. It doesn't imply that I think it could be NoScript related.
Well if you don't know then it could be.
If I saw the browser making a connection to some random domain like cksks.soie.net, then I would have no idea what it was, but I would be pretty sure it was nothing to do with NoScript.
Last edited by barbaz on Fri May 29, 2015 1:28 am, edited 1 time in total.
Reason: fix quote tags
======
Thrawn
------------
Religion is not the opium of the masses. Daily life is the opium of the masses.

True religion, which dares to acknowledge death and challenge the way we live, is an attempt to wake up.
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:38.0) Gecko/20100101 Firefox/38.0
Post Reply