Author Topic: Tracking observatory.mozilla.org via sshscan.rubidus.com/gettin valuable alerts  (Read 1040 times)

0 Members and 1 Guest are viewing this topic.

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33891
  • malware fighter
See: https://github.com/mozilla/ssh_scan_api/issues/97 (with possible fingerprinting detected).
See PrivacyScore: https://privacyscore.org/site/30833/json/
One should use a dockerized way in stead: https://github.com/mozilla/ssh_scan_api
as the other method is abusable enough to get being blocked.

Take this with a grain of salt, but it is an indication, example scan: for our avast forum website, I have checked on...
https://privacyscore.org/site/33642/
3rd party embeds, 3rd party trackers,
4 issues on unreliable encryption - HSTS and HSTS pre-loading not installed, not using Public Key pinning.
No check on mixed content and no check for CSS attempts and ticketbleed (experimental).
No protection found against LOGJAM attacks. More unreliable checks issues...

Another lesson learned....

polonus (volunteer website security analyst and website error-hunter)
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33891
  • malware fighter
UPDATE:

Just came back to this as I detected the filter of Negotiator extension in chromium browser.
Track from -observatory.mozilla.org to -sshscan.rubidus.com
Consider: https://privacyscore.org/site/128404/
C+ grade security: https://observatory.mozilla.org/analyze/sshscan.rubidus.com
Error: Invalid certificate chain encountered during redirection (because sub.domain chain);
Check: https://hstspreload.org/?domain=rubidus.com
Outcome: Error: Cannot connect using TLS

polonus (volunteer website security analyst and website error-hunter)
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!