Results 1 to 2 of 2

Thread: Randomized Domains in Chrome on Ubuntu

  1. #1
    Join Date
    Sep 2013
    Beans
    2

    Randomized Domains in Chrome on Ubuntu

    I found today what I thought was a misbehavior on Ubuntu when I connect to a new network interface. Turns out the culprit was Chrome.

    In an effort to saturate this topic with more sources, here is a solution to what appears to be a Chrome security issue but is actually a feature. Apparently it is already known, but was not already known to me.

    I had all services off and connected my NIC, capturing traffic for a VLAN compromise investigation, and instead of what I wanted to see, I kept seeing random domains that came back with a real IP address.



    Host: kxzzskctf


    Location: http://localhost
    Expires: Fri, 12 Jun 2020 19:26:09 GMT
    Cache-Control: no-cache


    It became even more annoying when that connection was clearly operational but was not appearing on netstat.


    COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
    chrome 13467 user 41u IPv4 261742 0t0 TCP host:55652->198.105.244.23:http (CLOSE_WAIT)
    chrome 13467 user 43u IPv4 261743 0t0 TCP host:55654->198.105.244.23:http (CLOSE_WAIT)


    https://mikewest.org/2012/02/chrome-connects-to-three-random-domains-at-startup/


    Apparently it is on purpose. Hopefully this will help someone else
    Attached Images Attached Images
    Last edited by philip14; 3 Weeks Ago at 09:31 PM.

  2. #2
    Join Date
    Sep 2014
    Location
    United States
    Beans
    281
    Distro
    Ubuntu 18.04 Bionic Beaver

    Re: Randomized Domains in Chrome on Ubuntu

    Interesting. Is this an fyi or a security concern of yours?

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •