Hello and welcome to the Wednesday, July 22nd, 2006 edition of the Sands Internet Storm Centers.

Stormcast, my name is Johannes Ulrich, recording today from Jacksonville, Florida.

And this episode is brought you by the sands.edu bachelor's degree program

in Applied Cybersecurity. Well, today, I figured let's move away from WordPress. If you're running it,

if you aren't patched it, you're compromised. And, well, with that, move on to something well,

less threat related

and that's how different operating systems do detect

if they are behind a captive portal.

Anybody who has ever used any kind of public Wi-Fi network

probably has observed these captive portals,

some kind of login screen that you have to go through

in order to connect to the internet. So to support this very common practice, operating systems

and browsers have implemented a couple different methods, how they are detected if they are

behind such a captive portal, and then of course

also how to direct the user to the correct URL in order to sign in. This traffic sometimes

shows up sort of as odd and unexplained traffic in your network because users don't really consciously visit these URLs.

It's also HTTP traffic because for the captive portal to then redirect the user,

well, can't be HTTP because then the certificate check would fail.

So summarized here, a couple of the URLs being used by the major operating systems,

as well as Firefox and Chrome, who do sort of their own little trick in order to figure out

if they are behind such a captive portal.

And then we got an interesting update from Solar Winds for their Surf Hugh product.

...