InformAction Forums

During this week starting from monday, I've ran into quite weird issue with Noscript...

When casually browsing websites and trying to open new pages, Noscript suddenly gives a notification of blocked redirect request to the webpage. The weird thing I've noticed is that Noscript's ABE tool only seemingly blocks webpages that use HTTP connection instead of HTTPS, hence sites like Gmail and Youtube work while sites like tvtropes.org or finnish websites like iltasanomat.fi don't. This has happened only once a day so far, and the solutions have been able to fix it by either me visiting some HTTP webpages with Chrome ( without closing Firefox), restarting Firefox and once it has only lasted only a short moment letting me back to browsing pages without doing anything. Here's a screenshot (in finnish, since I live in finland) what Noscript gives during the issue where I tried to acces finnish newspaper website from new Firefox tab.

http://i.imgur.com/qG3SayF.png The IP adress that's brushed over belongs to internet router my household uses, and it's identical in every message. After this issue occurs, the Ip adress seems to be incerted in Noscript's list of recently blocked elements...

I've posted about this in reddit and one user had this to say:

I'm no expert with NoScript, but I strongly believe that "<LOCAL> Deny" means that a script hosted on your own computer, or a redirect to a website hosted on your own computer was blocked.

This could potentially be caused by malware/adware on your computer trying to inject javascript or redirects into the website.
That could be used for example for a cross-site scripting attack, trying to steal your login session or login data, or for browser hijacking.
In this case I'd recommend cleaning up your system.

This could also be caused by other things like unusual programming practices, like a browser addon + local server program hybrid, or an edited host file.

The fact that only HTTP connections and no HTTPS connections are affected makes this seem like a someone is manipulating your internet traffic on the fly (likely your internet service provider), because that would be very hard/impossible for encrypted (HTTPS) traffic.
But doing that to inject scripts/redirects to your local computer would be weird.

I've already searched my PC for possible infection(s) with help from profeccionals from Avast forum and nothing was found. I've also written about this issue to finnish IT forum who noted the reason possibly being somehow in my internet connection. I figured it would probably be for the best to come here to request help finding if the issue would be somehow be about my computer, browser, internet connection, or possibly a hickup of Noscript addon. However, tomorrow I'll be going on a trip and won't be able to get on my computer until sunday, so I'd like to ask for quick help.

Thanks in advance!

The problem would seemingly be in your router not your computer. Since you don't have malware on your computer, I would suggest going into the router's admin interface and from there troubleshooting whatever's causing it to try to intercept your pages.

Let us know, thanks.

I'll try to look up into it, but it seemingly has to wait at seat untill sunday. My household has tested newer and "improved" connection with new router for some weeks now, but it has suffered from some occasional connection failures and overall slow connection speeds.

The Reddit commentor had it right, I reckon. It sounds like something strange is going on with your internet connection.

The problem seems to be gone itself by now. I came back from the trip yesterday and I haven't got any issues so far, but I'll report back if anything happens.

Never mind, problem still seems to occur...

I think I found the cause of the problem!

When Noscript blocked my accesses to http websites again, I opened Chrome to take a quick visit to http website since it has seemed to be one way to tempolarly fix the issue. When I tried to access a http website, Chrome suddenly redirected me into a website of our internet service provider, and the domain in address bar seemed to be the exact same as one in Noscript ABE notification messages, Ip adress, stuff about html and redirects, and lastly the webpage I tried to access. The service provider website had little window that informed me about some sort of upgrade being available. When I clicked "Upgrade", it gave me another window asking for username and password for router user interface. But since I didn't have the passowrd, I had to close it up for now. So in the end, it seems that all this time our new router has tried to insert an upgrade request into my PC all this time, out of all computers in our household, and Noscript seems to have always blocked it.

Yep, interference by your ISP is very much in line with what you'd expect for this kind of error.

Personally, that upgrade offer sounds suspicious. But if you're sure it's legitimate, then I guess it's just nagware.