10 Second Teleportation | Upollo Weblog

2024-01-18 17:53:05

The state of affairs

We began seeing some unusual units present up for a few of our clients’ customers. These units would entry the identical web page the person simply had round 10 seconds after they did, from someplace fairly totally different.

It’s clearly a VPN!

We checked out the place these requests have been coming from locations corresponding to AWS within the central US, knowledge facilities in California and related areas world wide. This may very well be somebody switching on a VPN we thought.

However wait, these are totally different units, they’ve not one of the identical cookies. If this have been a VPN it will be the identical gadget.

It’s clearly a Digital Desktop!

Seeing a machine hosted in an information middle and with all of the customers we noticed coming from these areas working for giant establishments we thought perhaps it’s only a distant cloud desktop.

We might count on a distant cloud desktop to be probably Home windows, to be comparatively speced to an actual world desktop and to have related behaviour to actual desktop as properly.

What we discovered have been person brokers purporting to be from a spread of units together with cell units, all solely ever loading a single web page with none current state like cookies. TLS fingerprints and different elements informed us that these have been persistently utilizing an previous model of Chrome.

To this point the gadget doesn’t appear like any reliable person we had ever seen. It appeared like automation of some form as most customers run a reasonably updated model of Chrome and don’t lie about their person brokers.

The habits itself can also be unusual, how did it load these pages which have been typically behind an authwall with out ever logging in or having auth cookies? That appears very odd.

It’s clearly some type of safety system!

We had pieced collectively that this was:

An automatic system
That in some way had the web page content material from a person
Would render and execute all scripts on that web page as if it was that person
Wouldn’t have any of the cookies or different context a person would have
Labored on a spread of units
Labored on HTTPS visitors
Solely confirmed up randomly for customers from massive establishments

This seems like a safety system that randomly scans pages by grabbing the web page contents, sending it to a render queue after which processing it. That is attention-grabbing as these pages can include PII, monetary particulars or different delicate data and they’re being processed on variations of Chrome seemingly tens of variations outdated, seemingly on a shared occasion.

We acquired nerd sniped at this level and needed to know what this method was. It didn’t have any person agent knowledge as that was at all times solid to match the customers. It typically ran out of AWS or different knowledge facilities and it was numerous organizations.

Lastly we noticed it begin popping up from an information middle that wasn’t a public one, Palo Alto Networks.

In the long run after studying product web page after product web page, we couldn’t work out precisely what product it was. We’re eager to seek out out so if you realize, drop us a line and tell us!

These at the moment are safely excluded from displaying up for our customers and is simply one of many many issues Upollo does to make sure it’s giving correct and actionable data to our clients.

We sit up for sharing extra enjoyable issues from the web quickly.

Be a part of the Wave

Able to revolutionize the way you acknowledge alternatives? Join the waitlist under and be among the many first to expertise its transformative energy when it launches.

Thanks! We’ll let you realize if you’re off the waitlist.

Oops! One thing went unsuitable whereas submitting the shape.