What is "vibiu-dau.com" have i been hacked?

SpeakYourMind

If you create a new profile with the same stuff does this keep occurring?

I can't it is the Owner profile. It wouldn't be the same if i did it in another profile i suppose.

I will try with an VPN.

This seems like redirection and ISP manipulation or some App trying to quickly open a browser and get some data and close and it isn't expecting https enforcement.

Actually this is what i was wondering about, wether some redirection of ISP has happened through hacking OR that the government is spying on me. German government has a stake in german telecom. And i have been on demonstrations, speaking about the violations of the german ground law through the surveillance state the police took in several instances my identification. I promoted petitions, for the german parliament, where suddenly the petition site of the german parliament came under strange attacks. Without my promotion the petition probably wouldn't have succeded. And my number will be in lot of peoples telephonbook that i think are surveilled by the security apparatus.

To make a long story short if the government used a "predato" tool or ordered my ISP to reroute the traffic is that what it would look when it has an error? Or is it some App redirecting traffic? Of course the wouldn't want to show this like that but maybe something is not working properly?

the real problem is that this only happens every couple of days so it is hard to test by deinstalling apps to see if one of them was it.. Nevertheless i will trow some of...

cyclk

Hello,

I found this thread via Google search. I have a Pixel 7a still without GrapheneOS. Everything default no simcard.
Today I wanted to transfer some photos to a Windows 11 PC.

Have the Pixel connected via USB with data transfer enable. The DCIM folder appears
and in the background Firefox opens the web page without asking and then emits a quiet beep.

http://vibiu-dau.com/zclkvisitor/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX?campaignid=XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX

I have changed the exact code that possibly identifies me with the exact number of X.

I have noscript on so probably only half as bad but already questionable the whole thing.
Maybe that brings a little more light into the dark hope that someone else can say something about it.

zkz

cyclk is there a chance the OS on your machine itself is compromised, and not the pixel?

Either way I'd suggest backing up important data (and not the applications themselves) doing a reset on both your machine and your pixel.

Muta

SpeakYourMind

It is registered in Middlesex GB
Registrant: identity protection services
Number: +44.1483307527

Matth

SpeakYourMind

It says you type in "yout" and Vanadium then suggests the "wrong" site.

What search engine have you defined in Vanadium? I would believe it comes from your search engine, as it tries to autocomplete. But not quite sure.

Have you tried to install another browser, like Firefox and see if it happens there as well? That way it could be your phone, or just an issue in your app.

forumuser

[deleted] ISPs have done this. They clone certain https certificates so the traffic passes through them to the ISP as clear and then pass the traffic to the real site https cert encrypted to monitor user input for monetization or surevilance. It is not often but has been found in the wild with sufficient testing to show it occurred but probably is harder to do now as https has gained more traction.

other8026

forumuser You'll need to provide proof for this claim. An ISP cannot just simply "clone" a certificate. Even though they have the info about the certificate, they do not have the private key, and therefore cannot decrypt anything to sniff or modify the traffic. Nor can they spoof or sign their own certificate since the info on the certificate won't match the domain name.

forumuser

other8026 https certificate spoofing for man in the middle attacks happen. There are many examples and I don't have to prove anything.

This is like if I said ransomeware has affected people and you said "But Windows Defender blocks that. Where is your proof?"

I am neither a computer scientist engineer nor an educator and don't want to take the effort to prove the claim. It's possible I am incorrect, but have read articles about this.

[deleted]

forumuser https certificate spoofing for man in the middle attacks happen.

The handshake includes these (rough) steps:

The server sends its public key.
The client encrypts setup info with that public key, and sends it back to the server.
The server decrypts the client's submission and uses it to derive a shared secret.
Further steps use that shared secret to set up the actual encryption to be used.

So the answer to your question is, since an imposter can't perform step 3 (since it doesn't have the private key) it can never move on to step 4. It doesn't have the shared secret, so it can't complete the handshake.

Quoted as it is from https://security.stackexchange.com/a/20062, Which is licensed under CC BY-SA 3.0 DEED: https://creativecommons.org/licenses/by-sa/3.0/. No change were made.

de0u

forumuser https certificate spoofing for man in the middle attacks happen.

But they don't just happen. See, for example: https://security.stackexchange.com/questions/64352/

If an ISP can get you to install a root CA cert they made up, they may have you, modulo certificate pinning. But they can't just inject a fake cert for google.com into your browser and start listening.

Issuing fake certs is getting harder, not easier, see: https://en.m.wikipedia.org/wiki/Certificate_Transparency

other8026

[deleted] since an imposter can't perform step 3 (since it doesn't have the private key) it can never move on to step 4. It doesn't have the shared secret, so it can't complete the handshake.

Right. Unless an attacker can brute-force a private key (virtually impossible within our lifetimes, but certificates usually have an expiration date for added security)

forumuser There are many examples and I don't have to prove anything.

I hate to be like this, but I also hate for people on this forum to read your post and believe what you've written. You do have to prove what you're claiming here. Without the private key and without help from a trusted CA (not going to happen, which is why they're trusted), it's virtually impossible to spoof a certificate.

de0u

[deleted] CAs can still get hacked themselves or their own malicious employees could help the attacker [...]

If a CA is compromised and then an ISP is compromised (to do DNS spoofing or traffic re-routing) and certificate pinning isn't happening...

Again, this isn't something an ISP can just decide to do.

forumuser https certificate spoofing for man in the middle attacks happen. There are many examples [...]

What's your "favorite" example?

[deleted]

other8026 (not going to happen, which is why they're trusted)

CAs can still get hacked themselves or their own malicious employees could help the attacker, but Certificate Transperancy will mean more trouble for the CA though.

other8026

[deleted] other8026 (not going to happen, which is why they're trusted)

CAs can still get hacked themselves or their own malicious employees could help the attacker, but Certificate Transperancy will mean more trouble for the CA though.

Yeah, I guess I should have written that part a little clearer. I just meant that under normal circumstances trusted CAs won't just issue certificates without first checking the person doing the request has the authority to do so. If they fail to do that part of their jobs, then they probably shouldn't be a CA.

admin

This thread is full of baseless speculation and misinformation. We expect better and will take moderation action if needed.

« Previous Page