Strange Mac Browser Behavior – Spyware?

As a TabletPC fan, I read the blog jkOnThe Run which was part of the Tablet PC podcast on TPN that is now being done directly form the site.

I was happy to see that the site picked up and linked to a "ruggedized" Tablet PC segment I did for Tech Tidbits Daily on 26th of Oct05.  So I went to the site to get a URL via my iBook so I could link back that they had linked to me! 🙂

So, I typed in the URL: http://jkontherun.blogs.com/jkontherun/ in Safari, and LittleSnitch (which I reviewed for Tech Tidbits Daily on 20th of Oct05) came up with a message (link to the picture):

Safari wants to connect to planetlab-5.cs.princeton.edu on TCP Port 8090

I said no, and I then quit Safari.  Launched it again, went to a couple of other sites, and then back to jkOnTheRun blog, and the message came up again.  So, I then sent James Kendrick an email saying "FYI … this popped up when I went to your site, maybe there is something embedded in your site?" 

James wrote back with a pen email (only the very serious Tablet PC geek sends back written emails) saying "Strange … not that he knew of … does it only happen in Safari?" …. so I tried it in Firefox and I got the same kinda of warning from Little Snitch (link to the picture):

firefox-bin wants to connect to planetlab1.cres.utexas on TCP port 8090

So what is going on? Definitely a different server, but same TCP Port.  What is PlanetLab? Is it spyware?  Is it something normally installed on Mac OS X or on the blog server?

Any thoughts?  Curious minds would like to know!

+ , , , ,

6 responses to “Strange Mac Browser Behavior – Spyware?”

  1. George Starcher Avatar

    did a wget of his url.
    then a grep on 8090 on the saved page.
    got this
    src=”http://jkontherun.blogs.com.nyud.net:8090/Readers-Choice-logo2a.jpg” width=”
    Note the nyud.net:8090 that corresponds to http://www.coralcdn.org

    Like

  2. George Starcher Avatar

    did a wget of his url.
    then a grep on 8090 on the saved page.
    got this
    src=”http://jkontherun.blogs.com.nyud.net:8090/Readers-Choice-logo2a.jpg” width=”
    Note the nyud.net:8090 that corresponds to http://www.coralcdn.org

    Like

  3. Hullo! Randomly got here when I googled about a similar handful of warnings for “planetlab” servers through port 8090 from a currently popular Reddit link about star wars: http://reddit.com/info/2nbut/comments (the actual link is at the top).
    Not sure what it’s about, but even when I deny access if I go and come back to the page it sometimes spams me with another handful of fresh 8090 planetlab like links… very odd.

    Like

  4. If you ever find this page again–got this in a reply at reddit. Apparently it’s probably a way to lessen the bandwidth load, and no cause for concern ^_^:
    http://en.wikipedia.org/wiki/Coral_Content_Distribution_Network

    Like

  5. Hullo! Randomly got here when I googled about a similar handful of warnings for “planetlab” servers through port 8090 from a currently popular Reddit link about star wars: http://reddit.com/info/2nbut/comments (the actual link is at the top).
    Not sure what it’s about, but even when I deny access if I go and come back to the page it sometimes spams me with another handful of fresh 8090 planetlab like links… very odd.

    Like

  6. If you ever find this page again–got this in a reply at reddit. Apparently it’s probably a way to lessen the bandwidth load, and no cause for concern ^_^:
    http://en.wikipedia.org/wiki/Coral_Content_Distribution_Network

    Like

Leave a comment