4

My antivirus incessantly spams "suspicious connection blocked" upon visiting one particular profile (a network moderator) and does not stop even with browser closed; only a PC reboot helps. It shows some URL attempting to make a connection that I never clicked on. My (reputable) antivirus never behaved this way before.

What's the protocol here? Do I report the profile for further inspection?

8
  • I don't think there is a protocol. Which profile does this happen on?
    – wizzwizz4
    Nov 21, 2020 at 18:02
  • 1
    @wizzwizz4 all lowercase username Nov 21, 2020 at 18:04
  • That'll probably be because the l.apsillers.com HTTPS certificate expired in 2018.
    – wizzwizz4
    Nov 21, 2020 at 18:06
  • @wizzwizz4 Yeah, that's the suspected URL. But what's it doing trying to connect when I simply visit an SE profile? Seems like something that should be addressed Nov 21, 2020 at 18:09
  • 1
    ![alt text](https://example.com/image.png) is used to implement a (very well-designed) Game of Life simulator.
    – wizzwizz4
    Nov 21, 2020 at 18:10
  • @wizzwizz4 More like "game of reboot" for me -- guess I'll just not visit that profile. I'm still unsure there's no security hazard from enabling a profile to run arbitrary scripts or site requests from a mere visit. Nov 21, 2020 at 18:13
  • 4
    It's not running arbitrary scripts (client-side, anyway). There is a security risk with allowing profiles to hotlink to images on arbitrary domains, but that's a problem with the way your web browser works; any website could invoke it, not just SE.
    – wizzwizz4
    Nov 21, 2020 at 18:15
  • @wizzwizz4 Hopefully you're right, I lack knowledge in the field; thanks. I'll keep the q open lest anyone begs to differ, otherwise this is resolved. Nov 21, 2020 at 18:17

1 Answer 1

15

Your antivirus is screaming because that profile contains inline images hosted on a domain with an expired HTTPS certificate. The screaming is presumably there because, normally, web browsers will silently drop images if there's a connection issue; this way, you're at least warned of it.

The reason expired HTTPS certificates cause this issue is that HTTPS certificates verify you're talking to the server you think you're talking to, but website owners sometimes stop keeping their certificates safe once they've expired – so old certificates might be used by a dumpster-diving attacker.

This is only a security issue if you care about connecting specifically to this user's website, which you don't, so it's not. Your antivirus program is being overly cautious.

1
  • Unintentionally turned into a security.SE question; if mods wish to migrate I wouldn't object. Nov 22, 2020 at 8:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .