« previous next »
Pages: [1] 2   Go Down

Author Topic: avast! blocking Firefox Sync  (Read 13517 times)

0 Members and 1 Guest are viewing this topic.

Offline RejZoR

  • Polymorphic Sheep
  • Serious Graphoman
  • *****
  • Posts: 9406
  • We are supersheep, resistance is futile!
    • RejZoR's Flock of Sheep
avast! blocking Firefox Sync
« on: February 19, 2015, 11:51:24 PM »
Can someone check what's going on here? From the looks of it, avast! is blocking Firefox sync for some reason. And this started happening this evening, no problems before.
Logged
Visit my webpage Angry Sheep Blog

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89057
  • No support PMs thanks
Re: avast! blocking Firefox Sync
« Reply #1 on: February 20, 2015, 12:18:19 AM »
I have syncing setup for my firefox installations - my primary system is my XP Pro desktop and secondary win7 netbook.

I just did a manual sync from my win7 netbook and no issues or alerts from avast.
Logged
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.3.6108 (build 24.3.8975.762) UI 1.0.801/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

REDACTED

  • Guest
Re: avast! blocking Firefox Sync
« Reply #2 on: February 20, 2015, 12:23:58 AM »
I'm having the same issue. I also just noticed it today.

Upon launching firefox and reaching the firefox default homepage, Avast gives me a pop up notification that a malicious URL:MAL has been blocked. The address changes slightly for me. Its a variation of these two.

URL: https:// 54.149.18.169:443/1.0/sync/1.5 (or just  https:// 54.149.18.169:443)

INFECTION: URL:MAL

PROCESS: C:\Program Files (x86)\Mozilla Firefox\Firefox.exe
« Last Edit: February 20, 2015, 12:30:03 AM by mrdvf13 »
Logged

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89057
  • No support PMs thanks
Re: avast! blocking Firefox Sync
« Reply #3 on: February 20, 2015, 12:49:02 AM »
Avast isn't alone in alerting on this as Firefox SafeBrowsing alerts if you try to connect directly to this IP address - image1

Checking the security exceptions - it is saying the site is identifying itself with invalid information - image2

If I check the firefox certificate manager it reports this certificate as services.mozilla.com (image3), yet this IP resolves to Amazon.com.

So this one is certainly weird - I don't get the alerts as this I believe must have happened at some time before and I have added an exception in the certificate manager for that IP and port number.
Logged
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.3.6108 (build 24.3.8975.762) UI 1.0.801/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

REDACTED

  • Guest
Re: avast! blocking Firefox Sync
« Reply #4 on: February 20, 2015, 01:03:00 AM »
Same here:
Logged

REDACTED

  • Guest
Re: avast! blocking Firefox Sync
« Reply #5 on: February 20, 2015, 01:05:16 AM »
DavidR, those are great screenshots and very useful.  I think you may be misinterpreting the information, however.

From my understanding this is simply a Mozilla service that is located on Amazon's server farm.  Pretty standard.  Of course if someone has hijacked the URL to point to another server on Amazon's server farm, that would be a different story (sorry, I don't have the time to check at the moment).

Avast blocking it is most likely another Avast false positive.  I'm not sure why Avast hasn't fixed it in a timely manner - they have been notified through their Labs and obviously by multiple people on their forum.  Avast hasn't responded through their Labs or on this forum.
« Last Edit: February 20, 2015, 01:13:45 AM by Techknow »
Logged

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: avast! blocking Firefox Sync
« Reply #6 on: February 20, 2015, 01:10:13 AM »
My sync is blocked too.
Logged
The best things in life are free.

Offline RejZoR

  • Polymorphic Sheep
  • Serious Graphoman
  • *****
  • Posts: 9406
  • We are supersheep, resistance is futile!
    • RejZoR's Flock of Sheep
Re: avast! blocking Firefox Sync
« Reply #7 on: February 20, 2015, 01:11:21 AM »
We know it's mozilla's service. But the fact is, avast! is blocking parts of it as seen above.
Logged
Visit my webpage Angry Sheep Blog

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89057
  • No support PMs thanks
Re: avast! blocking Firefox Sync
« Reply #8 on: February 20, 2015, 01:28:35 AM »
Quote from: Techknow on February 20, 2015, 01:05:16 AM
DavidR, those are great screenshots and very useful.  I think you may be misinterpreting the information, however.

From my understanding this is simply a Mozilla service that is located on Amazon's server farm.  Pretty standard.  Of course if someone has hijacked the URL to point to another server on Amazon's server farm, that would be a different story (sorry, I don't have the time to check at the moment).

Avast blocking it is most likely another Avast false positive.  I'm not sure why Avast hasn't fixed it in a timely manner - they have been notified through their Labs and obviously by multiple people on their forum.  Avast hasn't responded through their Labs or on this forum.

I haven't really tried to put that much of an interpretation on it, when firefox itself is saying that the certificate is for firefox, yet the IP resolves to Amazon, I know it is a server farm given the amazonaws.com domain listed as the Host of this IP in image4.

All I'm saying is that there is some latitude for confusion, how that might be interpreted by avast I simply don't know.
Logged
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.3.6108 (build 24.3.8975.762) UI 1.0.801/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

REDACTED

  • Guest
Re: avast! blocking Firefox Sync
« Reply #9 on: February 20, 2015, 01:37:11 AM »
Yep, got me too: "http://Https://54.149.18.169:443/1.0/sync/1.5" avast blocking malware. Something has spooked avast in an Amazon server farm from what I hear/read? False positive? Still syncing here.
Logged

REDACTED

  • Guest
Re: avast! blocking Firefox Sync
« Reply #10 on: February 20, 2015, 01:41:03 AM »
Quote from: DavidR on February 20, 2015, 01:28:35 AM
Quote from: Techknow on February 20, 2015, 01:05:16 AM
DavidR, those are great screenshots and very useful.  I think you may be misinterpreting the information, however.

From my understanding this is simply a Mozilla service that is located on Amazon's server farm.  Pretty standard.  Of course if someone has hijacked the URL to point to another server on Amazon's server farm, that would be a different story (sorry, I don't have the time to check at the moment).

Avast blocking it is most likely another Avast false positive.  I'm not sure why Avast hasn't fixed it in a timely manner - they have been notified through their Labs and obviously by multiple people on their forum.  Avast hasn't responded through their Labs or on this forum.

I haven't really tried to put that much of an interpretation on it, when firefox itself is saying that the certificate is for firefox, yet the IP resolves to Amazon, I know it is a server farm given the amazonaws.com domain listed as the Host of this IP in image4.

All I'm saying is that there is some latitude for confusion, how that might be interpreted by avast I simply don't know.

Your thought is an interesting one: that maybe Avast is actually performing some sort of intelligent interpretation in real time.  My limited understanding is that for "URL:Mal" Avast is simply blocking the specific URL or IP as specified in the Avast definitions.  Whether or not Avast actually interprets data on the fly for this sort of thing will have to be disclosed by someone at Avast.  Can anyone at Avast provide more details?
Logged

Offline kim_c

  • Newbie
  • *
  • Posts: 12
Re: avast! blocking Firefox Sync
« Reply #11 on: February 20, 2015, 02:29:58 AM »
Quote from: mrdvf13 on February 20, 2015, 12:23:58 AM
I'm having the same issue. I also just noticed it today.

Upon launching firefox and reaching the firefox default homepage, Avast gives me a pop up notification that a malicious URL:MAL has been blocked. The address changes slightly for me. Its a variation of these two.

URL: https:// 54.149.18.169:443/1.0/sync/1.5 (or just  https:// 54.149.18.169:443)

INFECTION: URL:MAL

PROCESS: C:\Program Files (x86)\Mozilla Firefox\Firefox.exe

I am having the same popup from avast for that URL
Logged

REDACTED

  • Guest
Re: avast! blocking Firefox Sync
« Reply #12 on: February 20, 2015, 03:34:14 AM »
Same for me, too.
Logged

REDACTED

  • Guest
Re: avast! blocking Firefox Sync
« Reply #13 on: February 20, 2015, 05:10:38 AM »
been getting this too, had spooked for bit then i read that other seeing same  things. hopeful this is fixed  soon, I use cyberfox x64 though, so it looks slightly diffrent
« Last Edit: February 20, 2015, 05:16:22 AM by kyuu »
Logged

REDACTED

  • Guest
Re: avast! blocking Firefox Sync
« Reply #14 on: February 20, 2015, 05:48:25 AM »
If this pop up, look for anything that been added. seem like, everytime i update firefox, it always seem to add something. just now, i've noticed that it added a smiley face and the caption was, "start a conversation". when i disabled and remove it, the warning stopped.
Logged
Pages: [1] 2   Go Up
« previous next »