On 2016-02-22 22:23, Hans wrote: > Dear security team, > > please excuse if I am too paranoid. I found a strange behavior with konqueror. > > > If you do this: > > 1. Go to a website > 2. from there go to a link which points to a youtube video. > 3. start the video > 4. Close konqueror by the cross in the upper right corner. > > You then will see, that the process "konqueror" is not killed, as it should. > After a while you will see a lot of network traffic and a lot of connections to > servers from cloudfront.net and some others. > > The traffic is https encrypted, so I cannot see, what is sent, but it is a lot > (full upload bandwith). > > I do not believe, I have a malware, as I am very courious and only install > packages from the debian repo. > > But of course, I maybe too paranoid... > > However, I think, you should know. Dame happens to my jessy installation: Open Konqueror, visit heise.de and I get full bandwidth traffic from Amazon Cloud IPs. It does not go to the harddrive, and is a https thread from the KDE system. Something is buggy, a flash ad or something like that. If I kill Konqueror, the traffic stops. (oh, traffic is https traffic, looks like some ads which are loaded and loaded over and over again) > Best regards > > Hans > MfG, Lars Schimmer -- ------------------------------------------------------------- TU Graz, Institut für ComputerGraphik & WissensVisualisierung Tel: +43 316 873-5405 E-Mail: l.schimmer@cgv.tugraz.at Fax: +43 316 873-5402 PGP-Key-ID: 0x4A9B1723
Attachment:
signature.asc
Description: OpenPGP digital signature