【悲报】emsisoft website may be DNS poisoning

4毛5的诺顿

想下个扫描器去了emsisoft结果....

FX：



IE：




后续：






补：根据avast相同的遭遇及再次测试结果，确认为遭受DNS污染而非MITM攻击。

4毛5的诺顿

everything runs OK by using a proxy , now I believe the words  firefox said that:"this error could mean that someone is trying to impersonate the site, and you shouldn't continue."




nothing impossible in this country


P.S:





I'm nearly sure the emsisoft offical site had been MITM attacked. Guess WHO did this, guys

无垠穹宇

山西电信访问无任何异常

MrDeep

可能跟网站证书有关

你打开证书信息试试

4毛5的诺顿

MrDeep 发表于 2015-2-27 21:15
可能跟网站证书有关

你打开证书信息试试

这个页面是没有提供有效证书才被报的，而不是证书有问题，所以我完全没法按照你说的来“查看证书信息”

4毛5的诺顿

无垠穹宇 发表于 2015-2-27 21:14
山西电信访问无任何异常

奇怪

微软方面的说法：
“I'm getting errors on websites I always visit. What should I do?

If you encounter a certificate error at a website you've visited before without errors, it's possible the website is not configured correctly. Try retyping the address you're using. For example, if you're typing the address as https://example.com, try changing it to https://www.example.com.

It's also possible that the website's certificate has expired and the owner or operator needs to contact the certification authority to renew the certificate to continue using it. This is a website-related problem, and can't be corrected in Internet Explorer. If you're getting errors on a website you've visited successfully, contact the website to report the problem.”

简而言之就是1.网址拼写错误；2.网站证书过期

1我已经排除了，2相当于也被你排除了...

火狐提供的说法是：“很可能有人试图冒充该网站”...

到底什么鬼啊

HEMM

咩？中间人？打开也是过期，过期泥煤～

4毛5的诺顿

HEMM 发表于 2015-2-27 21:47
咩？中间人？打开也是过期，过期泥煤～

开了proxy一切正常了....我开始相信火狐的说法：“If you usually connect to this site without problems, this error could mean that someone is trying to impersonate the site, and you shouldn't continue.”。

局域网上国，无奇不有

HEMM

4毛5的诺顿 发表于 2015-2-27 21:50
开了proxy一切正常了....我开始相信火狐的说法：“If you usually connect to this site without probl ...

估计能访问的都是测漏的吧！更何况我这种局域网中网中网，多部控死，网络HIPS，过滤你每一步网页点击和搜索，严格把关监控。

4毛5的诺顿

HEMM 发表于 2015-2-27 21:59
估计能访问的都是测漏的吧！更何况我这种局域网中网中网，多部控死，网络HIPS，过滤你每一步网页点击和搜 ...

那个能正常打开的绝对是侧漏，两个连接地址根本不一样！我马上给8L补图证明！