Plugin connects to suss IP over http

[Alex Cochrane]

Ubuntu 10.10
kernel 2.6.35-23-generic
rhythmbox 0.13.1-0ubuntu6
rhythmbox-ubuntuone-music-store 0.1.9-0ubuntu1

When the Ubuntu one plugin for rhythmbox is enabled it connects to 119.31.248.194 over http. When the plugin is disabled it does not. The IP hosts a password submission form with no other information. It is a Korean IP which seems to be hosted in Singapore. :sadface

[Chow Loong Jin (hyperair)]

Could you get a tcpdump/wireshark capture on this IP address? Something like:
sudo tcpdump -s0 -wblah.pcap host 119.31.248.194

[Alex Cochrane (alexcochrane)]

Attached

[Roman Yepishev (rye)]

Hello,

Could you please run the following:

sudo netstat -lntp | grep 119.31.248.194

That should give us the name of the application that contacts that host. Ubuntu One music store uses only SSL connections to 7digital servers and Canonical DC so this plaintext transmission is very suspicious.

[Roman Yepishev (rye)]

Sorry, that should have been

sudo netstat -ntp | grep 119.31.248.194

[Alex Cochrane (alexcochrane)]

Roman I don't have access to the computer this moment but the outcome of netstat -tac --program showed rhythmbox as the running program

[Alex Cochrane (alexcochrane)]

Netstat attached FWIW

Also might be worth noting that the digital connection is over http not https (I was told the only connections rhythmbox made were over https to 7digital and ubuntu one)

tcp 0 1043 192.168.1.10:44457 84.45.95.231:80 ESTABLISHED 2491/rhythmbox

[Alex Cochrane (alexcochrane)]

s/digital/7digital

[Alex Cochrane (alexcochrane)]

Any news on this? Can anyone replicate it? I can replicate this across a number of boxen here.