dslreports logo
 
    All Forums Hot Topics Gallery
spc
Search similar:


uniqs
2891

bleepity
@24.5.46.x

bleepity

Anon

[Security] "pop up" that I have no idea where it is coming from

Hello, I am a pretty well versed Mac user, on a friends computer, he keeps gutting a pop up window, that is coming from Comcast.

It looks like this, and shares some interesting characteristics:
»i.imgur.com/1zhRWii.jpg

A few things to take note of:
1) It appears to be a Safari window, or at least uses webkit
2) There is a url at the bottom, but I cropped it away, you can't go directly to the url as it has three dots in the center of it to show you it has been shortened.
3) It is able to do one thing that only the help center viewer on the Mac can do, which is "Always be on top", you can never make this window go away, aside from closing it, it floats above all other windows
4) It seems to spawn on awake from sleep, not on reboot, but after the machine has gone to sleep, wake the machine up, and it will pop up.
5) There is no item in the startup items/login items that corresponds to it
6) I can't locate any processes to it, other than than strangely names processes I have never seen, making me think it is up to much more "no good" that it appears. Unfortunately, it is not my computer, and my friend is not the type of person to care much about this stuff.
7) There is no app associated with the window, when you activate it, it will be the last active app, be that Finder, Safari, whatever, so there are no prefs or menus to quit it from.

I suppose I could close all apps, which I have done, and it just sits there, and then one by one start closing off suspect items in the list of processes running, but I know i will hit one that locks the machine, and be in a loop of troubleshooting forever.

I figured someone here has seen this. I am about to install my networking tools and start seeing what is being injected, when, and where, but I figured I would ask here first.

Tobin
join:2003-09-21
Burlingame, CA

1 edit

Tobin

Member

Re: [Security] "pop up" that I have no idea where it is coming from

It appears that his wifi adapter is automatically trying to connect to an xfinitywifi SSID, which requires an account. There's multiple ways to stop this from happening, such as lowering the priority of that particular SSID on the list of known wifi networks.

As to why it uses a seemingly unassimilated WebKit window, it does that in iOS too.
cheeseman
join:2014-06-19
Palo Alto, CA

cheeseman to bleepity

Member

to bleepity
Tobin is onto it.

Your system is trying to connect to an Xfinity wifi hotspot. On newer versions of Mac OS and iOS, the OS detects if you are in a captive portal by trying to visit »www.apple.com/library/te ··· ess.html.

If it doesn't see the word "success" come back, it pops up the captive portal in a separate window. It attempts to save your login info from that window, so that it can do it automatically the next time you connect to that hotspot.

Go to system preferences > network > wi-fi > advanced and remove "xfinitywifi" from the list of preferred networks.